AWS solutions documentation change
Summary
Updated documentation to reflect transition from IRSA to EKS Pod Identity for pod authentication, standardized placeholder notation (<STAGE>), fixed command formatting, updated CloudFormation template URLs, and improved parameter documentation clarity.
Security assessment
The changes primarily involve documentation updates for a feature transition (IRSA to EKS Pod Identity) which is an AWS security feature improvement, but there's no evidence of a specific security vulnerability being addressed. The updates improve clarity and accuracy but don't disclose or remediate a security weakness.
Diff
diff --git a/solutions/latest/migration-assistant-for-amazon-opensearch-service/deploy-the-solution.md b/solutions/latest/migration-assistant-for-amazon-opensearch-service/deploy-the-solution.md index 33ce8c2d6..75aa47222 100644 --- a//solutions/latest/migration-assistant-for-amazon-opensearch-service/deploy-the-solution.md +++ b//solutions/latest/migration-assistant-for-amazon-opensearch-service/deploy-the-solution.md @@ -36 +36 @@ To deploy this solution on Amazon EKS, you need: -The bootstrap script handles cluster creation, IAM role wiring (IRSA), private image mirroring, VPC endpoint setup, and Helm chart installation. +The bootstrap script handles cluster creation, IAM role wiring (EKS Pod Identity), private image mirroring, VPC endpoint setup, and Helm chart installation. @@ -42 +42 @@ Choose one of the following CloudFormation templates to deploy the Amazon EKS in - * [Launch with a new VPC](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/new?templateURL=https://solutions-reference.s3.amazonaws.com/migration-assistant-for-amazon-opensearch-service/latest/migration-assistant-for-amazon-opensearch-service-create-vpc.template=ImplementationGuide) — Creates a new VPC with the required networking, public and private subnets, NAT gateway, and Amazon EKS cluster. + * [Launch with a new VPC](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/new?templateURL=https://solutions-reference.s3.amazonaws.com/migration-assistant-for-amazon-opensearch-service/latest/migration-assistant-for-amazon-opensearch-service-create-vpc-eks.template) — Creates a new VPC with the required networking, public and private subnets, NAT gateway, and Amazon EKS cluster. @@ -44 +44 @@ Choose one of the following CloudFormation templates to deploy the Amazon EKS in - * [Launch into an existing VPC](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/new?templateURL=https://solutions-reference.s3.amazonaws.com/migration-assistant-for-amazon-opensearch-service/latest/migration-assistant-for-amazon-opensearch-service-import-vpc.template=ImplementationGuide) — Uses an existing VPC. The selected subnets must be in different Availability Zones and must allow outbound connectivity (either through a NAT gateway or VPC endpoints, depending on whether you are deploying into isolated subnets). + * [Launch into an existing VPC](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/new?templateURL=https://solutions-reference.s3.amazonaws.com/migration-assistant-for-amazon-opensearch-service/latest/migration-assistant-for-amazon-opensearch-service-import-vpc-eks.template) — Uses an existing VPC. The selected subnets must be in different Availability Zones and must allow outbound connectivity (either through a NAT gateway or VPC endpoints, depending on whether you are deploying into isolated subnets). @@ -53 +53 @@ After the CloudFormation stack deploys, run the bootstrap script to install the -Throughout this guide, `STAGE` is a short label such as `dev`, `staging`, or `prod`. It is used in cluster and resource names so you can keep multiple deployments separate. +Throughout this guide, `<STAGE>` is a short label such as `dev`, `staging`, or `prod`. It is used in cluster and resource names so you can keep multiple deployments separate. @@ -58 +58 @@ Throughout this guide, `STAGE` is a short label such as `dev`, `staging`, or `pr - chmod +x aws-bootstrap.sh + && chmod +x aws-bootstrap.sh @@ -71,6 +71,6 @@ Group | Flag | Purpose -**Identity** | `--stack-name name` | AWS CloudFormation stack name (required with `--deploy-*-cfn`) -| `--stage name` | Short label for cluster and resource names. Defaults to `dev` -| `--region region` | AWS Region -| `--vpc-id id` | Existing VPC ID (with `--deploy-import-vpc-cfn`) -| `--subnet-ids id1,id2` | Comma-separated subnets in different Availability Zones (with `--deploy-import-vpc-cfn`) -**Versioning** | `--version tag` | Pin to a published GitHub release tag (find tags at [OpenSearch Migrations Releases](https://github.com/opensearch-project/opensearch-migrations/releases)). Use this for reproducible deployments. +**Identity** | `--stack-name <name>` | AWS CloudFormation stack name (required with `--deploy-*-cfn`) +| `--stage <name>` | Short label for cluster and resource names. Defaults to `dev` +| `--region <region>` | AWS Region +| `--vpc-id <id>` | Existing VPC ID (with `--deploy-import-vpc-cfn`) +| `--subnet-ids <id1,id2>` | Comma-separated subnets in different Availability Zones (with `--deploy-import-vpc-cfn`) +**Versioning** | `--version <tag>` | Pin to a published GitHub release tag (find tags at [OpenSearch Migrations Releases](https://github.com/opensearch-project/opensearch-migrations/releases)). Use this for reproducible deployments. @@ -80,3 +80,3 @@ Group | Flag | Purpose -| `--ma-images-source registry` | Copy Migration Assistant images from another Amazon ECR registry. Useful when images were built on a separate cluster with internet access -**Access** | `--eks-access-principal-arn arn` | Grant a CI role or teammate cluster-admin access. Combine with `--skip-cfn-deploy --skip-console-exec` to grant access without redeploying -| `--kubectl-context name` | Set a custom alias for the kubectl context (defaults to the Amazon EKS cluster name) +| `--ma-images-source <registry>` | Copy Migration Assistant images from another Amazon ECR registry. Useful when images were built on a separate cluster with internet access +**Access** | `--eks-access-principal-arn <arn>` | Grant a CI role or teammate cluster-admin access. Combine with `--skip-cfn-deploy --skip-console-exec` to grant access without redeploying +| `--kubectl-context <name>` | Set a custom alias for the kubectl context (defaults to the Amazon EKS cluster name) @@ -87 +87 @@ Group | Flag | Purpose -| `--tls-mode pca-existing --pca-arn arn` | Use an existing AWS Private CA +| `--tls-mode pca-existing --pca-arn <arn>` | Use an existing AWS Private CA @@ -89,2 +89,2 @@ Group | Flag | Purpose -**Helm** | `--namespace name` | Override the Migration Assistant namespace (default: `ma`) -| `--helm-values path` | Extra values file for the Helm install — for example, to customize `workloadsNodePool.architectures` +**Helm** | `--namespace <name>` | Override the Migration Assistant namespace (default: `ma`) +| `--helm-values <path>` | Extra values file for the Helm install — for example, to customize `workloadsNodePool.architectures` @@ -136 +136 @@ Update your kubeconfig to point at the new Amazon EKS cluster: - aws eks update-kubeconfig --region REGION --name migration-eks-cluster-STAGE-REGION + aws eks update-kubeconfig --region <REGION> --name migration-eks-cluster-<STAGE>-<REGION> @@ -161 +161 @@ The deployment creates a default Amazon S3 bucket for migration artifacts and sn - s3://migrations-default-ACCOUNT_ID-STAGE-REGION + s3://migrations-default-<ACCOUNT_ID>-<STAGE>-<REGION> @@ -171 +171 @@ If your workflow needs a snapshot role ARN, look it up from the AWS CloudFormati - --stack-name YOUR_STACK_NAME \ + --stack-name <YOUR_STACK_NAME> \ @@ -183,2 +183,2 @@ For sources that require basic authentication, create a Kubernetes secret in the - --from-literal=username=SOURCE_USER \ - --from-literal=password=SOURCE_PASSWORD \ + --from-literal=username=<SOURCE_USER> \ + --from-literal=password=<SOURCE_PASSWORD> \ @@ -189 +189 @@ For sources that require basic authentication, create a Kubernetes secret in the -For Amazon OpenSearch Service domains, Amazon OpenSearch Serverless collections, and other AWS services that authenticate with SigV4, the Amazon EKS stack uses [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) to give two sets of pods an AWS identity: +For Amazon OpenSearch Service domains, Amazon OpenSearch Serverless collections, and other AWS services that authenticate with SigV4, the Amazon EKS stack uses [EKS Pod Identity](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html) to give two sets of pods an AWS identity: @@ -240 +240 @@ If AWS CloudFormation fails, check the stack status first: - aws cloudformation describe-stacks --stack-name STACK_NAME --query "Stacks[0].StackStatus" + aws cloudformation describe-stacks --stack-name <STACK_NAME> --query "Stacks[0].StackStatus" @@ -245,2 +245,2 @@ If the stack is stuck in `ROLLBACK_COMPLETE` or `CREATE_FAILED`, delete it and r - aws cloudformation delete-stack --stack-name STACK_NAME - aws cloudformation wait stack-delete-complete --stack-name STACK_NAME + aws cloudformation delete-stack --stack-name <STACK_NAME> + aws cloudformation wait stack-delete-complete --stack-name <STACK_NAME> @@ -251 +251 @@ If AWS CloudFormation succeeded but the Helm portion failed, rerun only the boot - ./aws-bootstrap.sh --skip-cfn-deploy --stage STAGE --region REGION + ./aws-bootstrap.sh --skip-cfn-deploy --stage <STAGE> --region <REGION>