AWS transform documentation change
Summary
Updated documentation for VMware server migration prerequisites, added detailed steps for migration initialization, expanded configuration guidance for EC2 launch templates, enhanced resource tagging requirements including ENIs, restructured replication and launch settings sections, and added storage type details for initial sync
Security assessment
The changes enhance documentation of security-related configurations including IAM role creation during migration initialization, strict resource tagging requirements to prevent misconfiguration (especially for ENIs), and guidance for security group mapping. However, there's no evidence of addressing a specific security vulnerability or incident.
Diff
diff --git a/transform/latest/userguide/transform-vmware-migrate-servers.md b/transform/latest/userguide/transform-vmware-migrate-servers.md index 37cc1aff4..3381376d3 100644 --- a//transform/latest/userguide/transform-vmware-migrate-servers.md +++ b//transform/latest/userguide/transform-vmware-migrate-servers.md @@ -7 +7 @@ -Prerequisites and migration execution defaultsStep 1: Set up migration waveStep 2: Validate and confirm inventoryStep 3: Deploy replication agentsStep 4: Data replicationStep 5: TestingStep 5b: Mark applications as ready for cutoverStep 6: CutoverServer lifecycle statesDeployment approvals +Prerequisites and Configure Migration DefaultsStep 1: Set up migration waveStep 2: Validate and confirm inventoryStep 3: Deploy replication agentsStep 4: Data replicationStep 5: TestingStep 5b: Mark applications as ready for cutoverStep 6: CutoverServer lifecycle statesDeployment approvals @@ -17 +17 @@ For waves with a _containerize_ migration strategy, AWS Transform runs the sourc - 1. Prerequisites and migration execution defaults + 1. Prerequisites and Configure Migration Defaults @@ -34 +34 @@ For waves with a _containerize_ migration strategy, AWS Transform runs the sourc -## Prerequisites and migration execution defaults +## Prerequisites and Configure Migration Defaults @@ -39,0 +40,6 @@ Before starting rehost migration, ensure you have the following in place: +###### Note + +If you completed all the steps of an end-to-end migration job in AWS Transform, your target accounts and inventory file are already prepared — the inventory file will have been generated for you during the migration planning step. Network infrastructure set up through AWS Transform network migration is also ready. If you did not build your network infrastructure through AWS Transform, ensure it is set up in advance before starting rehost migration. + +Before starting rehost migration, verify that you have the networking resources and infrastructure in place to host your servers. You can use AWS Transform landing zone and network migration capabilities or any other tools for that. + @@ -49,5 +55 @@ Before starting rehost migration, ensure you have the following in place: -###### Important - -Before starting rehost migration, verify that you have the networking resources and infrastructure in place to host your servers. You can use AWS Transform landing zone and network migration capabilities or any other tools for that. - -### Migration execution defaults +### Configure Migration Defaults @@ -55 +57 @@ Before starting rehost migration, verify that you have the networking resources -Before starting wave execution, you configure default settings that apply to all your target accounts. These defaults define how your Amazon EC2 instances are launched and how the general migration is configured. You can override these defaults at the wave level during wave setup. +Before starting your multi-account migration execution, you should configure default settings that apply to all your target accounts. These defaults define how your Amazon EC2 instances are launched and how the general migration is configured. You can override these defaults at the wave level during wave setup. @@ -67 +69,14 @@ You can modify the suggested Amazon EC2 instance types to include recommendation -#### Default launch settings +#### Migration initialization + +To start migration, AWS Transform initializes MGN for every AWS Region in which you plan to migrate, as well as all target accounts the service will be used in. During the initialization process: + + * The required IAM roles and policies are created. + + * The required default templates are configured. + + + + +For information on the initialization process, see [Initializing AWS Transform MGN with the console](https://docs.aws.amazon.com/mgn/latest/ug/mgn-initialize-console.html) in the _MGN User Guide_. + +#### Amazon EC2 launch template @@ -69 +84,13 @@ You can modify the suggested Amazon EC2 instance types to include recommendation -To change default launch settings, go to the MGN console and apply the changes you want. For more information, see [Launch settings](https://docs.aws.amazon.com/mgn/latest/ug/launch-settings.html) in the _MGN User Guide_. +The launch settings include two parts: the general launch settings, and the Amazon EC2 launch template, which determines how a test or cutover instance is launched for each source server in AWS. + +Launch settings, including the Amazon EC2 launch template, can be defined at the account level and are then applied to each source server automatically each time you add a source server to AWS Transform MGN. The launch settings defaults defined in this section can be applied to all your target accounts automatically. + +AWS Transform presents the list of available launch template settings. You can choose to continue with the defaults or configure your launch template. If you choose to configure, AWS Transform provides a link to a human-in-the-loop (HITL) review that contains all the parameters of the launch template settings. You can also make modifications directly through the chat interface for any parameters you wish. + +[Source servers](https://docs.aws.amazon.com/mgn/latest/ug/source-servers.html) are created with the account launch template settings. Once source servers are created with these default settings, you can change them at the source server launch settings level. You can change source server settings on any parameter using the chat interface, or for bulk operations using the inventory Excel file during Step 2: Validate and confirm inventory. + +To review the full list of launch template settings and details, see [Launch general settings](https://docs.aws.amazon.com/mgn/latest/ug/launch-general-settings.html) in the _MGN User Guide_. + +#### Additional Amazon EC2 launch template changes + +For additional Amazon EC2 launch template changes, you should perform them on the template ID for each target account. This option is available inside the wave setup. AWS Transform guides you through it and provides the appropriate link. @@ -109 +136 @@ For multi-account migrations, AWS Transform also creates the following role duri -After service permissions are confirmed, AWS Transform verifies that all required resources are properly tagged. The following tags are required: +After service permissions are confirmed, AWS Transform verifies that all required resources are properly tagged for the migration to be operated by the agent successfully. If any resources are missing required tags, AWS Transform provides a link to the tagging page where you can apply the missing tags before continuing. The following tags are required: @@ -111 +138 @@ After service permissions are confirmed, AWS Transform verifies that all require - * Source servers must have tags `CreatedBy: AWSTransform` and `ATWorkspace: <workspace_id>`. + * Existing source servers must have tags `CreatedBy: AWSTransform` and `ATWorkspace: <workspace_id>`. If you have already started replication on source servers and created them in the AWS Transform MGN service, you need to tag these servers so that AWS Transform can correlate them with the source servers discovered from your on-premises environment, and avoid unnecessary creation of duplicate source servers. AWS Transform automatically correlates between them using the user-provided ID, FQDN, or hostname keys. @@ -113 +140 @@ After service permissions are confirmed, AWS Transform verifies that all require - * VPCs and subnets must have tags `CreatedFor: AWSTransform` and `ATWorkspace: <workspace_id>`. VPCs and subnets created by the AWS Transform network migration agent are automatically tagged with these tags. + * Network resources must be properly tagged for both replication (staging area) and launch instances. AWS Transform displays the full list of network resources in your target account, with an indication of whether each resource is already tagged or not. You can review the list and select any untagged resources you want to add. For each resource you select, AWS Transform applies the relevant tag: @@ -114,0 +142 @@ After service permissions are confirmed, AWS Transform verifies that all require + * `CreatedBy: AWSTransform` or `CreatedFor: AWSTransform`, depending on the resource type. @@ -115,0 +144 @@ After service permissions are confirmed, AWS Transform verifies that all require + * `ATWorkspace: <workspace_id>` is applied to all selected resources. @@ -116,0 +146 @@ After service permissions are confirmed, AWS Transform verifies that all require +VPCs and subnets created by the AWS Transform network migration agent are automatically tagged. @@ -118 +148 @@ After service permissions are confirmed, AWS Transform verifies that all require -If any resources are missing required tags, AWS Transform provides a link to the tagging page where you can apply the missing tags before continuing. + * In addition to VPCs and subnets, AWS Transform also displays all existing Elastic Network Interfaces (ENIs) found in your target account. If you want AWS Transform to use them as part of your instance launch, they must be tagged with `CreatedFor: AWSTransform` and `ATWorkspace: <workspace_id>`. For more information on how to attach or add ENIs to the Amazon EC2 launch template, see [Detailed considerations](https://docs.aws.amazon.com/mgn/latest/ug/detailed-considerations.html) in the _MGN User Guide_. @@ -120 +149,0 @@ If any resources are missing required tags, AWS Transform provides a link to the -###### Note @@ -122 +150,0 @@ If any resources are missing required tags, AWS Transform provides a link to the -VPCs and subnets created by the AWS Transform network migration agent are automatically tagged. If you set up your own VPCs and subnets, you must manually apply the following tags so that they appear in AWS Transform's list of available subnets: @@ -124 +151,0 @@ VPCs and subnets created by the AWS Transform network migration agent are automa - * Key: `CreatedFor` Value: `AWSTransform` @@ -126 +153 @@ VPCs and subnets created by the AWS Transform network migration agent are automa - * Key: `ATWorkspace` Value: `workspace-id` (find your workspace ID in the AWS Transform web app URL: `https://.../workspace/`workspace-id`/job/`job-id``) +### Add networking data to inventory @@ -127,0 +155 @@ VPCs and subnets created by the AWS Transform network migration agent are automa +AWS Transform adds networking information from your network migration to the inventory file. This step maps your servers to the appropriate target subnets and security groups based on the network configuration generated during the migrate network phase. @@ -128,0 +157 @@ VPCs and subnets created by the AWS Transform network migration agent are automa +### Replication and launch settings @@ -129,0 +159 @@ VPCs and subnets created by the AWS Transform network migration agent are automa +#### Replication settings configuration @@ -131 +161 @@ VPCs and subnets created by the AWS Transform network migration agent are automa -### Add networking data to inventory +Replication settings determine how data is replicated from your source servers to AWS. Configure the replication settings in the replication template before adding source servers to AWS Transform MGN. AWS Transform shows you all the replication settings parameters — you can configure them through a dedicated HITL or through the chat interface. @@ -133 +163 @@ VPCs and subnets created by the AWS Transform network migration agent are automa -AWS Transform adds networking information from your network migration to the inventory file. This step maps your servers to the appropriate target subnets and security groups based on the network configuration generated during the migrate network phase. +For more details about the replication settings parameters, see [Replication settings template](https://docs.aws.amazon.com/mgn/latest/ug/replication-settings-template.html) in the _MGN User Guide_. @@ -135 +165,5 @@ AWS Transform adds networking information from your network migration to the inv -### Replication and launch settings +#### Launch template settings + +The launch template allows you to control the way AWS Transform MGN launches instances in AWS. The default configuration defined in the template is automatically applied to every newly added server. You can configure launch template settings through a dedicated HITL or through the chat interface. + +For more details about the launch template settings parameters, see [Launch template](https://docs.aws.amazon.com/mgn/latest/ug/launch-template.html) in the _MGN User Guide_. @@ -137 +171 @@ AWS Transform adds networking information from your network migration to the inv -To change replication and launch settings, go to the MGN console and apply the changes you want. For more information, see [Replication settings](https://docs.aws.amazon.com/mgn/latest/ug/replication-settings.html) and [Launch settings](https://docs.aws.amazon.com/mgn/latest/ug/launch-settings.html) in the _MGN User Guide_. +AWS Transform also provides a link to the Amazon EC2 launch template ID associated with the launch template, allowing you to change additional Amazon EC2 launch template attributes. To edit the Amazon EC2 launch template, follow the instructions in [Launch template](https://docs.aws.amazon.com/mgn/latest/ug/launch-template.html) in the _MGN User Guide_. @@ -416 +450 @@ The replication process consists of two phases: - * **Initial sync** – A complete copy of the source server data to AWS. Data is stored as EBS snapshots in the target account. Duration depends on data volume and network bandwidth. + * **Initial sync** – A complete copy of the source server data to AWS. Data is stored as Amazon Elastic Block Store (Amazon EBS) snapshots or on Amazon FSx for NetApp ONTAP (FSx for ONTAP) volumes in the target account, depending on your configured target storage type. For more information, see [Target storage type](https://docs.aws.amazon.com/mgn/latest/ug/replication-server-settings.html#ebs-volume) in the _MGN User Guide_. Duration depends on data volume and network bandwidth.