AWS mgn documentation change
Summary
Added documentation for FSx for ONTAP support including data flow details, iSCSI network requirements, certificate-based authentication via Secrets Manager, configuration limitations, and setup guide reference.
Security assessment
The change introduces security documentation for certificate-based authentication between MGN and FSx for ONTAP using Secrets Manager and specifies iSCSI port requirements, enhancing security guidance without addressing a specific vulnerability.
Diff
diff --git a/mgn/latest/ug/does-mgn.md b/mgn/latest/ug/does-mgn.md index 277c0dd2f..84dc6a7de 100644 --- a//mgn/latest/ug/does-mgn.md +++ b//mgn/latest/ug/does-mgn.md @@ -7 +7 @@ -Does MGN work with Microsoft Windows Failover Clustering?Does MGN work with Bitlocker encryption? +Does MGN work with Microsoft Windows Failover Clustering?Does MGN work with Bitlocker encryption?Does MGN work with FSx for ONTAP? @@ -22,0 +23,30 @@ AWS Transform MGN does not support OS-based disk encryption features such as Bit +## Does MGN work with FSx for ONTAP? + +Yes. MGN can replicate data volumes to an FSx for ONTAP file system. The following describes how data flows during replication and launch: + + * **During replication** : The AWS Replication Agent on your source servers sends data to MGN replication servers. When FSx for ONTAP is configured as the target storage type, MGN writes the replicated data volumes to the FSx for ONTAP file system via iSCSI. + + * **At launch and cutover** : The target EC2 instances connect to the FSx for ONTAP file system via iSCSI to access their data volumes. The boot volume always remains on Amazon EBS. + + * **Network** : Security groups must allow iSCSI traffic (port 3260) between MGN instances and the FSx for ONTAP file system. + + * **Authentication** : Communication is secured using certificate-based authentication. You store the certificates in AWS Secrets Manager, and MGN uses them to authenticate with the FSx for ONTAP file system. + + + + +**Key points:** + + * Agent-based replication only – FSx for ONTAP is supported only with agent-based replication. + + * Per-server configuration – You can use FSx for ONTAP for some servers and Amazon EBS for others in the same wave. + + * Boot volume – Always stored on Amazon EBS regardless of target storage type. + + * Up to 5 FSx for ONTAP file systems per account concurrently. + + + + +For full setup instructions, see [FSx for ONTAP configuration guide](./fsx-ontap.html). +