AWS prescriptive-guidance documentation change
Summary
Rebranded 'Application Migration Service' to 'MGN' throughout the document, including agent names, endpoint references, and blog post links.
Security assessment
Changes are purely branding updates from 'Application Migration Service' to 'MGN' with no modifications to security configurations, requirements, or vulnerabilities. All security-related content (VPC endpoints, security groups, DNS configurations) remains functionally identical.
Diff
diff --git a/prescriptive-guidance/latest/rehost-servers-over-private-networks-mgn/configuration.md b/prescriptive-guidance/latest/rehost-servers-over-private-networks-mgn/configuration.md index 89ec7dbcc..abe11963e 100644 --- a//prescriptive-guidance/latest/rehost-servers-over-private-networks-mgn/configuration.md +++ b//prescriptive-guidance/latest/rehost-servers-over-private-networks-mgn/configuration.md @@ -5 +5 @@ -[Documentation](/index.html)[AWS Prescriptive Guidance](https://aws.amazon.com/prescriptive-guidance/)[Migrating on-premises servers to AWS over private networks by using AWS Application Migration Service](welcome.html) +[Documentation](/index.html)[AWS Prescriptive Guidance](https://aws.amazon.com/prescriptive-guidance/)[Migrating on-premises servers to AWS over private networks by using AWS Transform MGN](welcome.html) @@ -7 +7 @@ -Subnets and routing configurationsVPC endpoints configurationVPC interface endpointsVPC gateway endpointsDNS resolver inbound endpointsElastic network interface security groupsInstalling Application Migration Service Agent on source servers +Subnets and routing configurationsVPC endpoints configurationVPC interface endpointsVPC gateway endpointsDNS resolver inbound endpointsElastic network interface security groupsInstalling MGN Agent on source servers @@ -22 +22 @@ This section describes the configuration for the most restrictive scenario (repl -The following sections assume that the initial Application Migration Service configuration is already complete, as described in the blog posts [Accelerate your Migration with AWS Application Migration Service](https://aws.amazon.com/blogs/mt/accelerate-your-migration-with-aws-application-migration-service/) and [How to Use the New AWS Application Migration Service for Lift-and-Shift Migrations](https://aws.amazon.com/blogs/aws/how-to-use-the-new-aws-application-migration-service-for-lift-and-shift-migrations/)). This discussion focuses on components that are specific to the restrictive scenario, and assumes a private staging subnet that has no connectivity to the internet. +The following sections assume that the initial MGN configuration is already complete, as described in the blog posts [Accelerate your Migration with AWS Transform MGN](https://aws.amazon.com/blogs/mt/accelerate-your-migration-with-aws-application-migration-service/) and [How to Use the New AWS Transform MGN for Lift-and-Shift Migrations](https://aws.amazon.com/blogs/aws/how-to-use-the-new-aws-application-migration-service-for-lift-and-shift-migrations/)). This discussion focuses on components that are specific to the restrictive scenario, and assumes a private staging subnet that has no connectivity to the internet. @@ -32 +32 @@ You will use that private subnet as a staging subnet for replication-related res -You now need to create VPC endpoints in the staging subnet to provide connectivity for the replication servers and Application Migration Service Agents from on-premises subnets. +You now need to create VPC endpoints in the staging subnet to provide connectivity for the replication servers and MGN Agents from on-premises subnets. @@ -36 +36 @@ Here's a full list of VPC endpoints you need: - * Application Migration Service and Amazon EC2 interface endpoints, which provide their own elastic network interfaces with private IP addresses and private DNS names to be used by both replication servers and Agents. (Agents will use only the Application Migration Service endpoint.) + * MGN and Amazon EC2 interface endpoints, which provide their own elastic network interfaces with private IP addresses and private DNS names to be used by both replication servers and Agents. (Agents will use only the MGN endpoint.) @@ -40 +40 @@ Here's a full list of VPC endpoints you need: - * Amazon S3 interface endpoint that provides a specific elastic network interface with a dedicated private IP address in the private subnet. Application Migration Service Agents will use this address through a specific DNS name. + * Amazon S3 interface endpoint that provides a specific elastic network interface with a dedicated private IP address in the private subnet. MGN Agents will use this address through a specific DNS name. @@ -50 +50 @@ AWS service | VPC endpoint type | Private DNS | Related subnet -**Application Migration Service** | Interface | Enabled | Staging private subnet +**MGN** | Interface | Enabled | Staging private subnet @@ -77 +77 @@ This allows any instance running in the subnet that is using the default [Dynami - * Resolve the DNS name of Application Migration Service (`mgn.<region>.amazonaws.com`) to a private IP address assigned to the elastic network interface. + * Resolve the DNS name of MGN (`mgn.<region>.amazonaws.com`) to a private IP address assigned to the elastic network interface. @@ -79 +79 @@ This allows any instance running in the subnet that is using the default [Dynami - * Connect to Application Migration Service by using the local network only. + * Connect to MGN by using the local network only. @@ -84 +84 @@ This allows any instance running in the subnet that is using the default [Dynami -That fixes connectivity for any instances running in the staging subnet (such as the Application Migration Service replication server or conversion server) for any AWS service that has interface endpoints provisioned in the subnet (such as Amazon EC2, Application Migration Service, Systems Manager, AWS KMS, and so on). +That fixes connectivity for any instances running in the staging subnet (such as the MGN replication server or conversion server) for any AWS service that has interface endpoints provisioned in the subnet (such as Amazon EC2, MGN, Systems Manager, AWS KMS, and so on). @@ -102 +102 @@ Local CIDR | `"local"` -The configuration described in the previous section is sufficient for instances that are running inside the AWS subnets, because they are already configured to use internal Amazon Route 53 DNS servers. However, on-premises source servers require additional steps to be able to communicate with AWS services privately. In particular, Application Migration Service Agent has to download the installer from Amazon S3 and then communicate with Application Migration Service by using DNS names provided in the [documentation](https://docs.aws.amazon.com/mgn/latest/ug/Network-Requirements.html#TCP-443). On-premises servers use their default DNS servers to resolve these DNS names, resulting in public IP addresses. Communications with these addresses over HTTPS/TCP port 443 are eventually blocked by corporate firewalls. +The configuration described in the previous section is sufficient for instances that are running inside the AWS subnets, because they are already configured to use internal Amazon Route 53 DNS servers. However, on-premises source servers require additional steps to be able to communicate with AWS services privately. In particular, MGN Agent has to download the installer from Amazon S3 and then communicate with MGN by using DNS names provided in the [documentation](https://docs.aws.amazon.com/mgn/latest/ug/Network-Requirements.html#TCP-443). On-premises servers use their default DNS servers to resolve these DNS names, resulting in public IP addresses. Communications with these addresses over HTTPS/TCP port 443 are eventually blocked by corporate firewalls. @@ -108 +108 @@ To prevent this, you need to configure source servers or their default DNS serve -Each elastic network interface has a dedicated security group associated with it, which must permit traffic that's expected for this elastic network interface and corresponding endpoint. Thus, the DNS resolver endpoint's security group should permit inbound UDP port 53 (and sometimes TCP port 53) for DNS requests, and the endpoint security groups for most other services (Application Migration Service, Amazon EC2, Systems Manager, and so on) need inbound HTTPS/TCP port 443 enabled. +Each elastic network interface has a dedicated security group associated with it, which must permit traffic that's expected for this elastic network interface and corresponding endpoint. Thus, the DNS resolver endpoint's security group should permit inbound UDP port 53 (and sometimes TCP port 53) for DNS requests, and the endpoint security groups for most other services (MGN, Amazon EC2, Systems Manager, and so on) need inbound HTTPS/TCP port 443 enabled. @@ -110 +110 @@ Each elastic network interface has a dedicated security group associated with it -## Installing Application Migration Service Agent on source servers +## Installing MGN Agent on source servers @@ -112 +112 @@ Each elastic network interface has a dedicated security group associated with it -To install Application Migration Service Agent on source servers, you need to supply the DNS names of the Application Migration Service and Amazon S3 interface endpoints to the Agent's command line parameters (see [Installing the Agent on a secured network](https://docs.aws.amazon.com/mgn/latest/ug/installing-agent-blocked.html) in the Application Migration Service documentation). +To install MGN Agent on source servers, you need to supply the DNS names of the MGN and Amazon S3 interface endpoints to the Agent's command line parameters (see [Installing the Agent on a secured network](https://docs.aws.amazon.com/mgn/latest/ug/installing-agent-blocked.html) in the MGN documentation). @@ -114 +114 @@ To install Application Migration Service Agent on source servers, you need to su -For the Application Migration Service endpoint, you can use any of the DNS names associated with it—a private DNS field (`mgn.<region>.amazonaws.com`) or a VPC-specific DNS name (`vpce-<VPC-id>-<suffix>.mgn.<region>.vpce.amazonaws.com`)—and supply an argument: `--endpoint <FQDN>`. In fact, if you skip this argument, the Agent uses the specified AWS Region to reconstruct the default DNS FQDN (`mgn.<region>.amazonaws.com`) and uses the FQDN to access the Application Migration Service control plane. In most cases, that default behavior should suffice, as long as that FQDN resolves from the source server correctly to the private IP address of the elastic network interface for the Application Migration Service VPC endpoint created in the staging subnet. +For the MGN endpoint, you can use any of the DNS names associated with it—a private DNS field (`mgn.<region>.amazonaws.com`) or a VPC-specific DNS name (`vpce-<VPC-id>-<suffix>.mgn.<region>.vpce.amazonaws.com`)—and supply an argument: `--endpoint <FQDN>`. In fact, if you skip this argument, the Agent uses the specified AWS Region to reconstruct the default DNS FQDN (`mgn.<region>.amazonaws.com`) and uses the FQDN to access the Application Migration Service control plane. In most cases, that default behavior should suffice, as long as that FQDN resolves from the source server correctly to the private IP address of the elastic network interface for the MGN VPC endpoint created in the staging subnet. @@ -124 +124 @@ That wildcard DNS name can be used for the `--s3-endpoint` argument, as in the f -The next section provides an example of configuring Application Migration Service, including all required VPC endpoints, and deploying the Agents by using VPC endpoints on Windows and Linux source servers. The section covers both manual and automated deployment. +The next section provides an example of configuring MGN, including all required VPC endpoints, and deploying the Agents by using VPC endpoints on Windows and Linux source servers. The section covers both manual and automated deployment.