AWS mgn documentation change
Summary
Added new section 'Communication between staging area subnet and S3' with dual-stack endpoint requirements and VPC gateway endpoint policy instructions
Security assessment
While the change involves network security configurations (firewall rules/VPC endpoints), it's operational guidance for new repository access patterns. No evidence of security vulnerability remediation.
Diff
diff --git a/mgn/latest/ug/preparing-environments.md b/mgn/latest/ug/preparing-environments.md index 653e6a0f6..c00825464 100644 --- a//mgn/latest/ug/preparing-environments.md +++ b//mgn/latest/ug/preparing-environments.md @@ -97,0 +98,2 @@ SSL interception should not be applied for communication between replication ser + * Communication between the staging area subnet and Amazon S3 + @@ -130 +132 @@ The AWS Replication Agent installer and the staging area subnet require access t - https://al2023-repos-<region>-de612dc2.s3.<region>.amazonaws.com/ + https://al2023-repos-<region>-de612dc2.s3.dualstack.<region>.amazonaws.com/ @@ -139 +141 @@ For IPv6/dual-stack environments, use the Amazon S3 dual-stack endpoint format: -If your staging area subnet does not have outbound internet access, ensure that your Amazon S3 VPC gateway endpoint policy allows access to the Amazon Linux 2023 package repository bucket (`al2023-repos-<region>-de612dc2`). +Ensure that your Amazon S3 VPC gateway endpoint policy allows access to the Amazon Linux 2023 package repository bucket (`al2023-repos-<region>-de612dc2`). This bucket is accessed through the Amazon S3 dual-stack endpoint. @@ -231,0 +234,28 @@ There are two ways to establish direct connectivity to the Internet for the VPC +### Communication between the staging area subnet and Amazon S3 + +The staging area subnet requires access to Amazon S3 for both replication and conversion operations. Replication servers and conversion servers are based on Amazon Linux 2023 (AL2023) and require access to the AL2023 package repository hosted in Amazon S3 for package installation and updates. + +The AL2023 package repository bucket is accessed through the Amazon S3 dual-stack endpoint. You must ensure that the staging area subnet can reach the following Amazon S3 URL: + + + https://al2023-repos-<region>-de612dc2.s3.dualstack.<region>.amazonaws.com/ + +Replace <region> with the AWS Region code you are replicating to (for example, `us-east-1`). + +Depending on your network configuration, ensure access using one or both of the following methods: + + * **Firewall-restricted environments** – If the staging area subnet has outbound internet access through a firewall or proxy, add the AL2023 repository URL to your allowlist. For the complete list of Amazon S3 URLs to allowlist, see Endpoints and firewall allowlist. + + * **Isolated subnets (no internet access)** – If the staging area subnet does not have outbound internet access and uses an Amazon S3 VPC gateway endpoint, ensure that the endpoint policy allows access to the AL2023 package repository bucket. Add the following resource ARN to the endpoint policy: + + "arn:aws:s3:::al2023-repos-<region>-de612dc2/*" + +For the complete Amazon S3 VPC endpoint policy example, see Endpoints and firewall allowlist. + + + + +###### Important + +Without access to the AL2023 package repository, replication servers may fail to launch or function correctly, and conversion servers may fail during the boot conversion process. +