AWS prescriptive-guidance documentation change
Summary
Added new 'Best practices' section with security recommendations, updated prerequisites for OS/.NET versions, clarified IIS installation/uninstallation steps, added key deletion step post-migration, and included new 'Additional information' section.
Security assessment
The changes add security best practices documentation including securing exported keys during transfer and mandatory post-migration deletion of sensitive XML key files. While these improve security posture, there's no evidence they address a specific existing vulnerability.
Diff
diff --git a/prescriptive-guidance/latest/patterns/migrate-iis-hosted-applications-to-amazon-ec2-by-using-appcmd.md b/prescriptive-guidance/latest/patterns/migrate-iis-hosted-applications-to-amazon-ec2-by-using-appcmd.md index f62cb8413..21c479213 100644 --- a//prescriptive-guidance/latest/patterns/migrate-iis-hosted-applications-to-amazon-ec2-by-using-appcmd.md +++ b//prescriptive-guidance/latest/patterns/migrate-iis-hosted-applications-to-amazon-ec2-by-using-appcmd.md @@ -7 +7 @@ -SummaryPrerequisites and limitationsArchitectureToolsEpicsRelated resources +SummaryPrerequisites and limitationsArchitectureToolsBest practicesEpicsRelated resourcesAdditional information @@ -15 +15 @@ SummaryPrerequisites and limitationsArchitectureToolsEpicsRelated resources -When you migrate Internet Information Services (IIS)-hosted applications to Amazon Elastic Compute Cloud (Amazon EC2) instances, you need to address several authentication challenges. These challenges include re-entering domain credentials for application pool identities and potentially regenerating machine keys for proper website functionality. You can use AWS Directory Service to establish trust relationships with your on-premises Active Directory or create a new managed Active Directory in AWS. This pattern describes a clean migration approach that uses the backup and restore functionality of IIS on Amazon EC2 instances. The approach uses appcmd.exe to uninstall and reinstall IIS on the target EC2 instances, enabling successful migration of IIS-hosted websites, application pool identities, and machine keys. +When you migrate Internet Information Services (IIS)-hosted applications to Amazon Elastic Compute Cloud (Amazon EC2) instances, you need to address several authentication challenges. These challenges include re-entering domain credentials for application pool identities and potentially regenerating machine keys for proper website functionality. This pattern describes a clean migration approach that uses the backup and restore functionality of IIS on Amazon EC2 instances. The approach uses appcmd.exe to uninstall and reinstall IIS on the target Amazon EC2 instances, enabling successful migration of IIS-hosted websites, application pool identities, and machine keys. @@ -25 +25 @@ When you migrate Internet Information Services (IIS)-hosted applications to Amaz - * Understanding of IIS working principles such as administration and configuration. + * Understanding of IIS working principles, such as administration and configuration. @@ -30,0 +31,8 @@ When you migrate Internet Information Services (IIS)-hosted applications to Amaz + * Windows Server 2012 R2 or later on both source and target servers. + + * Microsoft .NET Framework 4.5 or later installed on both servers (required for aspnet_regiis.exe key container operations) + + * A method to transfer backup files and exported key XML files from the source to target server, such as Amazon Simple Storage Service (Amazon S3), a shared network drive, or secure copy. + + * The source and target IIS instances must run the same IIS version (8.5 or 10.0). + @@ -61 +69 @@ When you migrate Internet Information Services (IIS)-hosted applications to Amaz - * MGN + * AWS Transform MGN @@ -78 +86 @@ The solution includes the following steps: - 3. MGN launches EC2 instances in the application subnet with the replicated data. The target EC2 instance runs IIS and contains the migrated applications with their associated Amazon Elastic Block Store (Amazon EBS) volumes. After the initial replication, MGN continues to sync changes until you're [ready to cut over](https://docs.aws.amazon.com/mgn/latest/ug/migration-dashboard.html#ready-for-cutover1) to the new environment. + 3. MGN launches Amazon EC2 instances in the application subnet with the replicated data. The target Amazon EC2 instance runs IIS and contains the migrated applications with their associated Amazon Elastic Block Store (Amazon EBS) volumes. After the initial replication, MGN continues to sync changes until you're [ready to cut over](https://docs.aws.amazon.com/mgn/latest/ug/migration-dashboard.html#ready-for-cutover1) to the new environment. @@ -102,0 +111,15 @@ The solution includes the following steps: +## Best practices + + * **Secure exported key files** – The XML files that contain the exported private keys should be transferred securely (encrypted in transit) and deleted from boththe source and target servers after a successful migration. + + * **Test in a non-production environment** – Perform the backup and restore procedure on a test server before running it in production. + + * **Document application pool identities** – Before migration, record all application pool identity credentials because you must re-enter passwords after the restore. + + * **Back up SSL certificates separately** – The appcmd.exe backup does not include SSL or TLS certificates. Export these separately using the Certificates MMC snap-in or PowerShell + + * **Verify web content files** – The IIS configuration backup does not include web application files (wwwroot content). Make sure that these are migrated with the server image through AWS Transform MGN. + + + + @@ -109,3 +132,3 @@ Create backups of IIS-hosted websites, configuration key, and `WAS` key.| To cre - 1. Open a command prompt and run as administrator. - 2. Run the following command: `c:\windows\system32\inetsrv` - 3. Run the following command, replacing `<backupname>` with your value: `appcmd.exe add backup "<backupname>"` + 1. Open a command prompt as administrator. + 2. Run the following command: `cd c:\windows\system32\inetsrv` + 3. Run the following command, replacing `<backupname>` with your value: `appcmd.exe add backup "<backupname>` @@ -115,3 +138,4 @@ To export the configuration key and the `WAS` key, do the following: - 1. Run the following command: `cd c:\windows\Microsoft.NET\Framework\v2.0.50727 5. aspnet_regiis.exe -px "iisConfigurationKey"` - 2. Run the following command: `C:\temp\iisConfKey.xml -pri` - 3. Run the following command: `aspnet_regiis.exe -px "iisWasKey" C:\temp\iisWasKey.xml -pri` + 1. Create the export directory: `mkdir C:\temp` + 2. Run the following command: `cd c:\windows\Microsoft.NET\Framework64\v4.0.30319` + 3. Run the following command: `aspnet_regiis.exe -px "iisConfigurationKey" C:\temp\iisConfKey.xml -pri` + 4. Run the following command: `aspnet_regiis.exe -px "iisWasKey" C:\temp\iisWasKey.xml -pri` @@ -128,2 +152,2 @@ Uninstall IIS on the target server.| To uninstall IIS on the target server, use - 4. Clear the **web IIS** checkbox and then choose **Next** , **Next**. - 5. Select the **Restart destination server automatically** checkbox. When the uninstallation is completed, the system reboots. + 4. Clear the **Web Server (IIS)** checkbox and then choose **Next** , and **Next**. + 5. Select the **Restart destination server automatically** checkbox. When the uninstall process is completed, the system reboots. @@ -139 +163 @@ Install IIS on the target server.| To install IIS on the target server, use the - 5. Choose all the checkboxes that are shown in **App development** , **Add features** , **Select all features**. You can select features at a granular level just before the confirmation. + 5. Choose all the checkboxes that are shown in **App development** , **Add features** , and **Select all features**. You can select features at a granular level just before the confirmation. @@ -148 +172 @@ Restore IIS websites and configuration.| To restore the IIS backups that you cre - 1. Create a folder named `backup` in the `C:\windows\system32\inetsrv` folder and place the source backup folder inside it. + 1. Create a folder named `backup` in the `C:\windows\system32\inetsrv` folder, and then place the source backup folder inside it. @@ -153 +177 @@ Restore IIS websites and configuration.| To restore the IIS backups that you cre - 6. Run the following command: `cd c:\windows\Microsoft.NET\Framework64\v2.0.50727\` + 6. Run the following command: `cd c:\windows\Microsoft.NET\Framework64\v4.0.30319` @@ -156,0 +181,3 @@ Restore IIS websites and configuration.| To restore the IIS backups that you cre + 10. Open IIS Manager and verify that all websites, application pools, and virtual directories are restored. + 11. Browse to each website to confirm it is serving content correctly. + 12. After confirming the restoration is successful, delete the exported key files from `C:\temp`:`del C:\temp\iisConfKey.xml``del C:\temp\iisWasKey.xml` @@ -192,0 +220,9 @@ Restore IIS websites and configuration.| To restore the IIS backups that you cre +## Additional information + + * The appcmd.exe backup includes: application pools, sites, global configuration, and IIS schema. It does not include web content files, SSL certificates, or shared configuration files. + + * For large-scale IIS farm migrations, consider using the PowerShell Web-Administration module for scripted backup and restore operations. + + + +