AWS prescriptive-guidance documentation change
Summary
Updated guidance for automatically restarting AWS Replication Agent on RHEL without disabling SELinux. Added architecture diagram, changed credential method to temporary credentials, improved command formatting, and reordered steps.
Security assessment
The change promotes better security practices by shifting from permanent access keys to temporary credentials via AWS STS and IAM Roles Anywhere. This reduces long-term credential exposure risks. However, there's no evidence this addresses a specific disclosed vulnerability.
Diff
diff --git a/prescriptive-guidance/latest/patterns/restart-the-aws-replication-agent-automatically-without-disabling-selinux-after-rebooting-a-rhel-source-server.md b/prescriptive-guidance/latest/patterns/restart-the-aws-replication-agent-automatically-without-disabling-selinux-after-rebooting-a-rhel-source-server.md index 48aeeff39..30e5edb64 100644 --- a//prescriptive-guidance/latest/patterns/restart-the-aws-replication-agent-automatically-without-disabling-selinux-after-rebooting-a-rhel-source-server.md +++ b//prescriptive-guidance/latest/patterns/restart-the-aws-replication-agent-automatically-without-disabling-selinux-after-rebooting-a-rhel-source-server.md @@ -7 +7 @@ -SummaryPrerequisites and limitationsToolsEpicsRelated resources +SummaryPrerequisites and limitationsArchitectureToolsEpicsRelated resources @@ -9 +9 @@ SummaryPrerequisites and limitationsToolsEpicsRelated resources -# Restart the AWS Replication Agent automatically without disabling SELinux after rebooting a RHEL source server +# Automatically restart the AWS Replication Agent after a RHEL reboot without disabling SELinux @@ -11 +11 @@ SummaryPrerequisites and limitationsToolsEpicsRelated resources - _Anil Kunapareddy, Venkatramana Chintha, and Shanmugam Shanker, Amazon Web Services_ + _Anil Kunapareddy, Amazon Web Services_ @@ -15 +15 @@ SummaryPrerequisites and limitationsToolsEpicsRelated resources -AWS Application Migration Service helps simplify, expedite, and automate the migration of your Red Hat Enterprise Linux (RHEL) workload to the Amazon Web Services (AWS) Cloud. To add source servers to Application Migration Service, you install the AWS Replication Agent on the servers. +AWS Application Migration Service helps simplify, expedite, and automate the migration of Red Hat Enterprise Linux (RHEL) workloads to the Amazon Web Services (AWS) Cloud. To add source servers to Application Migration Service, you install the [AWS Replication Agent](https://docs.aws.amazon.com/mgn/latest/ug/agent-installation.html) on the servers. @@ -17 +17 @@ AWS Application Migration Service helps simplify, expedite, and automate the mig -Application Migration Service provides real-time, asynchronous, block-level replication. This means that you can continue normal IT operations during the entire replication process. These IT operations might require that you reboot or restart your RHEL source server during the migration. If this happens, the AWS Replication Agent will not restart automatically, and your data replication will stop. Typically, you can set Security-Enhanced Linux (SELinux) to **disabled** or **permissive** mode to automatically restart AWS Replication Agent. However, your organization’s security policies might prohibit disabling SELinux, and you might also have to [relabel your files](https://access.redhat.com/solutions/3176). +Application Migration Service provides real-time, asynchronous, block-level replication. This means that you can continue normal IT operations during the entire replication process. These IT operations might require that you reboot or restart your RHEL source server during the migration. If this happens, the AWS Replication Agent will not restart automatically, and your data replication will stop. Typically, you can set Security-Enhanced Linux (SELinux) to **disabled** or **permissive** mode to automatically restart the AWS Replication Agent. However, your organization’s security policies might prohibit disabling SELinux, and you might also have to [relabel your files](https://access.redhat.com/solutions/3176). @@ -42,0 +43,6 @@ This pattern describes how to automatically restart the AWS Replication Agent wi +## Architecture + +The following image shows the architecture for this approach. + + + @@ -45 +51 @@ This pattern describes how to automatically restart the AWS Replication Agent wi -**AWS services** + _AWS services_ @@ -52 +58 @@ This pattern describes how to automatically restart the AWS Replication Agent wi -**Linux commands** +_Linux commands_ @@ -54 +60 @@ This pattern describes how to automatically restart the AWS Replication Agent wi -The following table provides a list of Linux commands that you will run on your RHEL source server. These are also described in the epics and stories for this pattern. +The following table provides a list of Linux commands that you run on your RHEL source server. These are also described in the epics and stories for this pattern. @@ -56 +62 @@ The following table provides a list of Linux commands that you will run on your -Command| Description +**Command**| **Description** @@ -58,10 +64,10 @@ Command| Description -`#systemctl –version`| Identifies the system version. -`#systemctl list-units --type=service`| Lists all active services that are available on the RHEL server. -`#systemctl list-units --type=service | grep running`| Lists all services that are currently running on the RHEL server. -`#systemctl list-units --type=service | grep failed`| Lists all services that failed to load after the RHEL server rebooted or restarted. -`restorecon -Rv /etc/rc.d/init.d/aws-replication-service`| Changes the context to `aws-replication-service`. -`yum install policycoreutils*`| Installs the policy core utilities that are required for the operation of the SELinux system. -`ausearch -c "insmod" --raw | audit2allow -M my-modprobe`| Searches the audit log and creates a module for policies. -`semodule -i my-modprobe.pp`| Activates the policy. -`cat my-modprobe.te`| Displays the contents of the `my-modprobe.te` file. -`semodule -l | grep my-modprobe`| Checks whether the policy has been loaded to the SELinux module. +`#systemctl –version`| Identifies the system version +`#systemctl list-units --type=service`| Lists all active services that are available on the RHEL server +`#systemctl list-units --type=service | grep running`| Lists all services that are currently running on the RHEL server +`#systemctl list-units --type=service | grep failed`| Lists all services that failed to load after the RHEL server rebooted or restarted +`#restorecon -Rv /etc/rc.d/init.d/aws-replication-service`| Changes the context to `aws-replication-service` +`#yum install policycoreutils*`| Installs the policy core utilities that are required for the operation of the SELinux system +`#ausearch -c "insmod" --raw | audit2allow -M my-modprobe`| Searches the audit log and creates a module for policies +`#semodule -i my-modprobe.pp`| Activates the policy +`#cat my-modprobe.te`| Displays the contents of the `my-modprobe.te` file +`#semodule -l | grep my-modprobe`| Checks whether the policy has been loaded to the SELinux module @@ -73 +79,6 @@ Task| Description| Skills required -Create an Application Migration Service user with an access key and a secret access key. | To install the AWS Replication Agent, you must create an Application Migration Service user with the required AWS credentials. For instructions, see the [Application Migration Service documentation](https://docs.aws.amazon.com/mgn/latest/ug/credentials.html).| Migration engineer +Generate AWS temporary credentials.| The [temporary credentials](https://docs.aws.amazon.com/mgn/latest/ug/credentials.html) provided by Application Migration Service use a similar mechanism to the one used by [AWS Identity and Access Management Roles Anywhere](https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html).To create temporary credentials, you need to: + + 1. [Create a new IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) with the `AWSApplicationMigrationAgentInstallationPolicy` policy. + 2. [Request temporary security credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html) through AWS Security Token Service (AWS STS) by using the [AssumeRole API](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html).You can generate temporary credentials by using the AWS Command Line Interface (AWS CLI). For an example, see the [AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/sts/assume-role.html#examples). + +| Migration engineer @@ -76 +87 @@ Install the AWS Replication Agent.| - 1. Sign in to the AWS Management Console and open the AWS Migration Service console at [https://console.aws.amazon.com/mgn/home](https://console.aws.amazon.com/mgn/home). + 1. Sign in to the AWS Management Console and open the [AWS Application Migration Service console](https://console.aws.amazon.com/mgn/home). @@ -82,2 +93,2 @@ Install the AWS Replication Agent.| -Restart or reboot the RHEL source server.| Restart or reboot your RHEL source server when its **Data replication status** displays **Stalled** on the [Migration dashboard](https://docs.aws.amazon.com/mgn/latest/ug/migration-dashboard.html).| Migration engineer -Check data replication status.| Wait for one hour and then check the **Data replication status** again on the Migration dashboard. It should be in the **Healthy** state.| Migration engineer +Check data replication status.| Wait until the replication is complete, and then check the **Data replication status** on the Migration dashboard. It should be in the **Healthy** state.| Migration engineer +Restart or reboot the RHEL source server.| Restart or reboot the RHEL source server. Notice the **Data replication status** displays as **Stalled** on the [Migration dashboard](https://docs.aws.amazon.com/mgn/latest/ug/migration-dashboard.html).| Migration engineer @@ -88,2 +99,2 @@ Identify the system version.| Open the command line interface for your RHEL sour -List all active services.| To list all active services available on the RHEL server, run the command:`#systemctl list-units --type=service`| Migration engineer -List all running services.| To list all services that are currently running on the RHEL server, use the command:`#systemctl list-units --type=service | grep running`| Migration engineer +List all active services.| To list all active services available on the RHEL server, run the following command:`#systemctl list-units --type=service`| Migration engineer +List all running services.| To list all services that are currently running on the RHEL server, use the following command:`#systemctl list-units --type=service | grep running`| Migration engineer @@ -94,7 +105,7 @@ Task| Description| Skills required -Change the security context.| In the command line interface for your RHEL source server, run the following command to change the security context to the AWS replication service:`restorecon -Rv /etc/rc.d/init.d/aws-replication-service`| Migration engineer -Install core utilities.| To install the core utilities required for the operation of the SELinux system and its policies, run the command:`yum install policycoreutils*`| Migration engineer -Search the audit log and create a module for policies.| Run the command:`ausearch -c "insmod" --raw | audit2allow -M my-modprobe`| Migration engineer -Display the contents of the my-modprobe-te file. | The `my-modprobe.te` file is generated by the **audit2allow** command. It includes the SELinux domains, policy source directory, and subdirectories, and specifies the access vector rules and transitions associated with the domains. To display the contents of the file, run the command:`cat my modprobe.te`| Migration engineer -Activate the policy.| To insert the module and make the policy package active, run the command:`semodule -i my-modprobe.pp`| Migration engineer -Check whether the module has been loaded. | Run the command:`semodule -l | grep my-modprobe`After the SELinux module is loaded, you will no longer have to set SELinux to **disabled** or **permissive** mode during your migration.| Migration engineer -Reboot or restart the RHEL source server and verify the data replication status.| Open the AWS Migration Service console, navigate to **Data replication progress** , and then reboot or restart your RHEL source server. Data replication should now resume automatically after the RHEL source server reboots.| Migration engineer +Change the security context.| In the command line interface for your RHEL source server, run the following command to change the security context to the AWS replication service:`#restorecon -Rv /etc/rc.d/init.d/aws-replication-service`| Migration engineer +Install core utilities.| To install the core utilities required for the operation of the SELinux system and its policies, run the following command:`#yum install policycoreutils*`| Migration engineer +Search the audit log and create a module for policies.| Run the following command:`#ausearch -c "insmod" --raw | audit2allow -M my-modprobe`| Migration engineer +Display the contents of the `my-modprobe-te` file.| The `my-modprobe.te` file is generated by the **audit2allow** command. It includes the SELinux domains, policy source directory, and subdirectories, and it specifies the access vector rules and transitions associated with the domains. To display the contents of the file, run the following command:`#cat my modprobe.te`| Migration engineer +Activate the policy.| To insert the module and make the policy package active, run the following command:`#semodule -i my-modprobe.pp`| Migration engineer +Check whether the module has been loaded.| Run the following command:`#semodule -l | grep my-modprobe`After the SELinux module is loaded, you no longer have to set SELinux to **disabled** or **permissive** mode during your migration.| Migration engineer +Reboot or restart the RHEL source server and verify the data replication status.| Open the AWS Application Migration Service console, navigate to **Data replication progress** , and then reboot or restart your RHEL source server. Data replication should now resume automatically after the RHEL source server reboots.| Migration engineer @@ -104 +115,3 @@ Reboot or restart the RHEL source server and verify the data replication status. - * [Application Migration service documentation](https://docs.aws.amazon.com/mgn/latest/ug/what-is-application-migration-service.html) + * [Application Migration Service documentation](https://docs.aws.amazon.com/mgn/latest/ug/what-is-application-migration-service.html) + + * [Application Migration Service policies](https://docs.aws.amazon.com/mgn/latest/ug/mgn-policies.html) @@ -110,2 +122,0 @@ Reboot or restart the RHEL source server and verify the data replication status. - * [Application Migration Service policies](https://docs.aws.amazon.com/mgn/latest/ug/mgn-policies.html) - @@ -121 +132 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Resolve connection errors after migrating SQL Server to AWS +Migration @@ -123 +134 @@ Resolve connection errors after migrating SQL Server to AWS -Re-architect +Create AWS CloudFormation templates for AWS DMS