AWS drs documentation change
Summary
Updated documentation to clarify network requirements for AWS Replication Agent installation using PrivateLink. Added distinction between management traffic (using VPC endpoints) and replication traffic (using VPN/DirectConnect). Improved parameter formatting and corrected endpoint examples.
Security assessment
The changes enhance documentation about securing network traffic by clarifying the separation of management traffic (handled via VPC endpoints) from replication traffic (using private connections). While this improves security awareness, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/drs/latest/userguide/installing-agent-blocked.md b/drs/latest/userguide/installing-agent-blocked.md index 44db05506..231e4cc50 100644 --- a//drs/latest/userguide/installing-agent-blocked.md +++ b//drs/latest/userguide/installing-agent-blocked.md @@ -11 +11 @@ Create a VPC Endpoint for AWS Elastic Disaster RecoveryUse the created VPC Endpo -The AWS DRS AWS Replication Agent installer needs network access to AWS Elastic Disaster Recovery and S3 endpoints. If your on-premises network is not open to Elastic Disaster Recovery and S3 endpoints, then you can install the Agent with the aid of PrivateLink. +The AWS Replication Agent installer needs network access to AWS Elastic Disaster Recovery and S3 endpoints. If your on-premises network is not open to AWS Elastic Disaster Recovery and S3 endpoints, you can install the agent by using PrivateLink. @@ -13 +13 @@ The AWS DRS AWS Replication Agent installer needs network access to AWS Elastic -You can connect your on-premises network to the subnet in your staging area VPC using AWS VPN or DirectConnect. To use the AWS VPN or DirectConnect, you must activate private IP in the replication settings. +VPC endpoints created through PrivateLink handle only **management traffic** between the AWS Replication Agent and the AWS Elastic Disaster Recovery service. Management traffic includes agent installation, authentication, and API communication. @@ -15 +15,5 @@ You can connect your on-premises network to the subnet in your staging area VPC -These topics describe the connectivity prerequisites that enable you to install the agent. All of the settings apply to the target account (or the staging account in a multi-account scenario) and Region where you want to handle the recovery. +**Replication traffic** (the actual data replication between your source servers and the replication servers in AWS) does not use VPC endpoints. Replication traffic flows directly between the source and replication servers over your VPN or DirectConnect connection. To enable private replication, activate the private IP option in the replication settings. VPC endpoints are not required for private replication. + +You can connect your on-premises network to the subnet in your staging area VPC using AWS VPN or DirectConnect. To use AWS VPN or DirectConnect, you must activate private IP in the replication settings. + +The following topics describe the connectivity prerequisites that enable you to install the agent. All of the settings apply to the target account (or the staging account in a multi-account scenario) and Region where you want to handle the recovery. @@ -19 +23 @@ These topics describe the connectivity prerequisites that enable you to install -To allow the AWS Replication Agent installer to communicate with AWS Elastic Disaster Recovery, create an interface VPC endpoint for AWS Elastic Disaster Recovery in your staging area subnet. This VPC endpoint is used exclusively for management traffic; replication data is transmitted directly between the source and replication servers. For more information, see [Creating an Interface Endpoint](https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html#create-interface-endpoint.html) in the Amazon VPC User Guide. +To allow the AWS Replication Agent installer to communicate with AWS Elastic Disaster Recovery, create an interface VPC endpoint for AWS Elastic Disaster Recovery in your staging area subnet. This VPC endpoint is used exclusively for management traffic; replication data is transmitted directly between the source and replication servers. For more information, see [Creating an Interface Endpoint](https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html#create-interface-endpoint) in the Amazon VPC User Guide. @@ -33 +37 @@ If the AWS replication agents are installed with a principal using [ AWSElasticD -Once you have created the VPC Endpoint, the AWS Replication Agent can connect to Elastic Disaster Recovery via VPN/DirectConnect by using the --endpoint installation parameter. Learn more about [Private DNS for interface endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html#vpce-private-dns) in the _Amazon VPC User Guide_. +After you create the VPC Endpoint, the AWS Replication Agent can connect to AWS Elastic Disaster Recovery through VPN or DirectConnect by using the `--endpoint` installation parameter. For more information, see [Private DNS for interface endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html#vpce-private-dns) in the Amazon VPC User Guide. @@ -35 +39 @@ Once you have created the VPC Endpoint, the AWS Replication Agent can connect to -Run the AWS Replication Agent installer with the --endpoint parameter. Enter your endpoint-specific DNS hostname within the parameter. The installer is then able to connect to AWS Elastic Disaster Recovery via the endpoint over your VPN/DirectConnect connection. +Run the AWS Replication Agent installer with the `--endpoint` parameter. Enter your endpoint-specific DNS hostname within the parameter. The installer then connects to AWS Elastic Disaster Recovery through the endpoint over your VPN or DirectConnect connection. @@ -37 +41 @@ Run the AWS Replication Agent installer with the --endpoint parameter. Enter you -Example of an interface endpoint DNS name: vpce-0123456789-abcdef.drs.<REGION>.vpce.amazonaws.com +Example of an interface endpoint DNS name: `vpce-0123456789-abcdef.drs.<REGION>.vpce.amazonaws.com` @@ -41 +45 @@ Example of an interface endpoint DNS name: vpce-0123456789-abcdef.drs.<REGION>.v -To allow the AWS Replication Agent installer to communicate with S3, create an interface S3 endpoint for AWS Elastic Disaster Recovery in your staging area subnet. For more information, see [Endpoints for Amazon S3](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html) in the _Amazon VPC User Guide_. The endpoint requires a security group that allows connection from the agent, enabling it to download components it needs for the installation. +To allow the AWS Replication Agent installer to communicate with S3, create an interface S3 endpoint for AWS Elastic Disaster Recovery in your staging area subnet. For more information, see [Endpoints for Amazon S3](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html) in the Amazon VPC User Guide. The endpoint requires a security group that allows connection from the agent, enabling it to download components it needs for the installation. @@ -45 +49 @@ To allow the AWS Replication Agent installer to communicate with S3, create an i -Once you have created the interface VPC Endpoint, the AWS Replication Agent can connect to S3 via VPN/DirectConnect by using the --s3-endpoint installation parameter. Learn more about [Private DNS for interface endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html#vpce-private-dns) in the _Amazon VPC User Guide_. +After you create the interface VPC Endpoint, the AWS Replication Agent can connect to S3 through VPN or DirectConnect by using the `--s3-endpoint` installation parameter. For more information, see [Private DNS for interface endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html#vpce-private-dns) in the Amazon VPC User Guide. @@ -47 +51 @@ Once you have created the interface VPC Endpoint, the AWS Replication Agent can -Run the AWS Replication Agent installer with the --s3-endpoint parameter. Enter your endpoint-specific DNS hostname. The installer is then able to connect to Elastic Disaster Recovery via the endpoint over your VPN/DirectConnect connection. +Run the AWS Replication Agent installer with the `--s3-endpoint` parameter. Enter your endpoint-specific DNS hostname. The installer then connects to S3 through the endpoint over your VPN or DirectConnect connection. @@ -49 +53 @@ Run the AWS Replication Agent installer with the --s3-endpoint parameter. Enter -Example of an interface endpoint DNS name: vpce-0123456789-abcdef.s3.<REGION>.vpce.amazonaws.com +Example of an interface endpoint DNS name: `vpce-0123456789-abcdef.s3.<REGION>.vpce.amazonaws.com` @@ -53 +57 @@ Example of an interface endpoint DNS name: vpce-0123456789-abcdef.s3.<REGION>.vp -To prepare the staging area subnet in a private subnet, two more endpoints have to be created to ensure the successful creation of the replication servers. +To prepare the staging area subnet in a private subnet, create two more endpoints to ensure the successful creation of the replication servers. @@ -55 +59 @@ To prepare the staging area subnet in a private subnet, two more endpoints have - * EC2 Interface Endpoint: used to establish connectivity to EC2 endpoint from the staging area subnet + * **EC2 Interface Endpoint** – Used to establish connectivity to the EC2 endpoint from the staging area subnet. @@ -57 +61 @@ To prepare the staging area subnet in a private subnet, two more endpoints have - * S3 Gateway Endpoint: used by the replication servers to download the replication software from S3 + * **S3 Gateway Endpoint** – Used by the replication servers to download the replication software from S3. @@ -62 +66 @@ To prepare the staging area subnet in a private subnet, two more endpoints have -For more information about setting up AWS Elastic Disaster Recovery with a site-to-site VPN connection, [visit this blog post](https://aws.amazon.com/blogs/storage/cross-region-aws-elastic-disaster-recovery-agent-installation-in-a-secured-network). +For more information about setting up AWS Elastic Disaster Recovery with a site-to-site VPN connection, see [Cross-Region AWS Elastic Disaster Recovery agent installation in a secured network](https://aws.amazon.com/blogs/storage/cross-region-aws-elastic-disaster-recovery-agent-installation-in-a-secured-network).