AWS mgn medium security documentation change
Summary
Added detailed storage parameter documentation including encryption controls and KMS key management
Security assessment
Explicitly documents security-critical features: EBS encryption configuration, KMS key management for volume encryption, and deletion policies to prevent orphaned volumes. Provides specific permission requirements (kms:CreateGrant etc.) for secure implementation.
Diff
diff --git a/mgn/latest/ug/detailed-considerations.md b/mgn/latest/ug/detailed-considerations.md index 5c0459501..b036dbdd4 100644 --- a//mgn/latest/ug/detailed-considerations.md +++ b//mgn/latest/ug/detailed-considerations.md @@ -70,5 +70 @@ AWS Application Migration Service automatically provisions the maximum IOPS poss - * **Delete on termination** – Do **not** change or edit this field. This should not be included in the launch template. - - * **Encrypted** – **Do not** change or edit this field. This should not be included in the launch template. - - * **Key** – **Do not** change or edit this field. This should not be included in the launch template. + * **Throughput** – Set the throughput in MiB/s for the volume. This setting applies only to gp3 volumes. Refer to the [EBS volume types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html) documentation for supported values. @@ -79,0 +76,14 @@ AWS Application Migration Service automatically provisions the maximum IOPS poss + * ###### Important + +The following storage parameters: **Volume initialization rate** , **EBS card index** , **Delete on termination** , and **KMS key** can only be configured per individual source server. Bulk editing of these parameters is not currently supported. To edit these parameters through the EC2 launch template console, see [Selecting the default template](./ec2-selecting.html). + +**Volume initialization rate** – Controls how fast a volume created from a snapshot is initialized, at a provisioned rate of 100–300 MiB/s. Use this for latency-sensitive workloads where you need the volume fully initialized quickly after launch. This setting is not supported on Outposts, Local Zones, or Wavelength Zones. AWS charges apply for provisioned initialization rate. If not set, no provisioned initialization is used and the volume initializes at default speed. + + * **EBS card index** – Assigns a volume to a specific EBS card on instance types with multiple EBS controllers. Use this to spread I/O across cards for higher aggregate throughput. This setting only has an effect on multi-card instance types (for example, `i4i.metal`, `r5b.24xlarge`). If not set, AWS automatically distributes volumes across available EBS cards. + + * **Delete on termination** – Specifies whether an Amazon EBS volume is automatically deleted when the attached Amazon EC2 instance is terminated. Set this to **No** iif you want the volumes to persist after instance termination, for example to preserve data for rollback or to reattach the volume to another instance. Set this to **Yes** for data volumes when you want to avoid orphaned volumes that continue incurring storage costs.This setting takes effect only after cutover is finalized and the instance is under your ownership. If not explicitly configured, the default behavior is **Yes** for root volumes and **No** for additional volumes. + + * **Encrypted** – Set this to **Yes** if you are specifying a KMS key for the volume. If you are not using a per-volume KMS key, encryption is controlled through the [EBS Encryption](./replication-server-settings.html#ebs-encryption) section of the replication settings. + + * **KMS key** – You can specify a customer-managed KMS key to use for encrypting target volumes. If set, this key takes precedence over the key used during replication. If not set, the replication snapshot's KMS key is used. Ensure that your MGN launch role has `kms:CreateGrant`, `kms:Decrypt`, and `kms:GenerateDataKey` permissions on the specified key. +