AWS dms documentation change
Summary
Restructured setup guide to emphasize console automation for resource creation, consolidated prerequisite tasks, replaced detailed step-by-step instructions with high-level resource requirements, and provided predefined IAM role configurations.
Security assessment
The changes reorganize documentation without addressing security vulnerabilities. The S3 encryption requirement (SSE-S3) was already documented and merely relocated. No evidence of security incident remediation exists in the diff.
Diff
diff --git a/dms/latest/userguide/set-up.md b/dms/latest/userguide/set-up.md index e2958cb48..c73f79db7 100644 --- a//dms/latest/userguide/set-up.md +++ b//dms/latest/userguide/set-up.md @@ -7 +7 @@ -Create a VPCCreate an S3 bucketStore credentials in Secrets ManagerCreate IAM policiesCreate IAM roles +Configure VPC, Amazon S3, and Secrets ManagerCreate IAM roles and policies @@ -11 +11 @@ Create a VPCCreate an S3 bucketStore credentials in Secrets ManagerCreate IAM po -To set up DMS Schema Conversion, complete the following tasks. Then you can set up an instance profile, add data providers, and create a migration project. +Before you create an instance profile, add data providers, and create a migration project, complete the following prerequisite tasks. These tasks configure the AWS resources that DMS Schema Conversion needs, such as a VPC, an Amazon S3 bucket, AWS Secrets Manager secrets, and IAM roles with permissions policies. @@ -13,134 +13 @@ To set up DMS Schema Conversion, complete the following tasks. Then you can set -###### Topics - - * Create a VPC based on Amazon VPC - - * Create an Amazon S3 bucket - - * Store database credentials in AWS Secrets Manager - - * Create IAM policies - - * Create IAM roles - - - - -## Create a VPC based on Amazon VPC - -In this step, you create a virtual private cloud (VPC) in your AWS account. This VPC is based on the Amazon Virtual Private Cloud (Amazon VPC) service and contains your AWS resources. - -###### To create a VPC for DMS Schema Conversion - - 1. Sign in to the AWS Management Console and open the Amazon VPC console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/). - - 2. Choose **Create VPC**. - - 3. On the **Create VPC** page, enter the following settings: - - * **Resources to create** – **VPC and more** - - * **Name tag auto-generation** – Choose **Auto-generate** and enter a globally unique name. For example, enter `sc-vpc`. - - * **IPv4 CIDR block** – `10.0.1.0/24` - - * **NAT gateways** – **In 1 AZ** - - * **VPC endpoints** – **None** - - 4. Keep the rest of the settings as they are, and then choose **Create VPC**. - - 5. Choose **Subnets** , and take a note of your public and private subnet IDs. - -To connect to your Amazon RDS databases, create a subnet group that includes public subnets. - -To connect to your on-premises databases, create a subnet group that includes private subnets. For more information, see [Create an instance profile for DMS Schema Conversion](./getting-started-instance.html). - - 6. Choose **NAT gateways**. Choose your **NAT gateway** and take a note of your **Elastic IP address**. - -Configure your network to make sure that AWS DMS can access your source on-premises database from this NAT gateway's public IP address. For more information, see [Using an internet connection to a VPC](./instance-profiles-network.html#instance-profiles-network-internet). - - - - -Use this VPC when you create your instance profile and target databases on Amazon RDS. - -## Create an Amazon S3 bucket - -To store information from your migration project, create an Amazon S3 bucket. DMS Schema Conversion uses this Amazon S3 bucket to save items such as assessment reports, converted SQL code, information about database schema objects, and so on. - -###### To create an Amazon S3 bucket for DMS Schema Conversion - - 1. Sign in to the AWS Management Console and open the Amazon S3 console at [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/). - - 2. Choose **Create bucket**. - - 3. On the **Create bucket** page, select a globally unique name for your S3 bucket. For example, enter `sc-s3-bucket`. - - 4. For **AWS Region** , choose your Region. - - 5. For **Bucket Versioning** , choose **Enable**. - - 6. Keep the rest of the settings as they are, and then choose **Create bucket**. - - - - -###### Note - -DMS Schema Conversion (SC) works only with S3 buckets that use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3). Other encryption configurations, including Server-Side Encryption with AWS KMS (SSE-KMS), Customer-Provided Keys (SSE-C), or Client-Side Encryption, are not currently supported by SC and prevents it from accessing the S3 bucket. If using a different encryption method, you must create a separate S3 bucket with SSE-S3 for use with DMS Schema Conversion. - -## Store database credentials in AWS Secrets Manager - -Store your source and target database credentials in AWS Secrets Manager. Make sure that you replicate these secrets to your AWS Region. DMS Schema Conversion uses these secrets to connect to your databases in the migration project. - -###### To store your database credentials in AWS Secrets Manager - - 1. Sign in to the AWS Management Console and open the AWS Secrets Manager console at [https://console.aws.amazon.com/secretsmanager/](https://console.aws.amazon.com/secretsmanager/). - - 2. Choose **Store a new secret**. - - 3. The **Choose secret type** page opens. For **Secret type** , choose the type of database credentials to store: - - * **Credentials for Amazon RDS database** – Choose this option to store credentials for your Amazon RDS database. For **Credentials** , enter the credentials for your database. For **Database** , choose your database. - - * **Credentials for other database** – Choose this option to store credentials for your source Oracle or SQL Server databases. For **Credentials** , enter the credentials for your database. - - * **Other type of secret** – Choose this option to store only the user name and password to connect to your database. Choose **Add row** to add two key-value pairs. Make sure that you use `username` and `password` for key names. For values related to these keys, enter the credentials for your database. - - 4. For **Encryption key** , choose the AWS KMS key that Secrets Manager uses to encrypt the secret value. Choose **Next**. - - 5. On the **Configure secret** page, enter a descriptive **Secret name**. For example, enter `sc-source-secret` or `sc-target-secret`. - - 6. Choose **Replicate secret** and then for **AWS Region** choose your Region. Choose **Next**. - - 7. On the **Configure rotation** page, choose **Next**. - - 8. On the **Review** page, review your secret details, and then choose **Store**. - - - - -To store credentials for your source and target databases, repeat these steps. - -## Create IAM policies - -###### To create an IAM policy for DMS Schema Conversion to access Amazon S3 - - 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). - - 2. In the navigation pane, choose **Policies**. - - 3. Choose **Create policy**. - - 4. On the **Select service** page, choose **Amazon S3** from the list. - - 5. In the **Actions allowed** , choose `PutObject`, `GetObject`, `GetObjectVersion`, `GetBucketVersioning`, `GetBucketLocation`, `ListBucket`. - - 6. In the **Resources** specify the ARN of the bucket that you created in the previous section. Choose **Next**. - - 7. On the **Review and create** page, enter a descriptive name. For example: `sc-s3-policy`. Then, choose **Create policy**. - - - - -###### To create an IAM policy for DMS Schema Conversionto access AWS Secrets Manager +###### Console automates resource creation @@ -148 +15 @@ To store credentials for your source and target databases, repeat these steps. - 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). +When you create a migration project using the AWS Management Console, AWS DMS can automatically create the required IAM roles and Amazon S3 bucket on your behalf. If you prefer to create these resources manually, or if you use the AWS CLI or API, complete the following steps. For more information about creating migration projects, see [ Creating migration projects](./migration-projects-create.html). @@ -150,24 +17 @@ To store credentials for your source and target databases, repeat these steps. - 2. In the navigation pane, choose **Policies**. - - 3. Choose **Create policy**. - - 4. On the **Select service** page, choose **Secrets Manager** from the list. - - 5. Choose **Next**. The **Add permissions** page opens. - - 6. In the **Actions allowed** , choose: `GetSecretValue` and `DescribeSecret`. - - 7. On the **Review and create** page, enter a descriptive name. For example: `sc-secrets-manager-policy`. Then, choose **Create policy**. - - - - -## Create IAM roles - -Create AWS Identity and Access Management (IAM) roles to use in your migration project. DMS Schema Conversion uses these IAM roles to access your Amazon S3 bucket and database credentials stored in AWS Secrets Manager. - -###### To create an IAM role that provides access to your Amazon S3 bucket - - 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). - - 2. In the navigation pane, choose **Roles**. +###### Topics @@ -175 +19 @@ Create AWS Identity and Access Management (IAM) roles to use in your migration p - 3. Choose **Create role**. + * Configure VPC, Amazon S3, and Secrets Manager @@ -177 +21 @@ Create AWS Identity and Access Management (IAM) roles to use in your migration p - 4. On the **Select trusted entity** page, choose **AWS service**. Choose **DMS**. + * Create IAM roles and policies @@ -179 +22,0 @@ Create AWS Identity and Access Management (IAM) roles to use in your migration p - 5. Choose **Next**. The **Add permissions** page opens. @@ -181 +23,0 @@ Create AWS Identity and Access Management (IAM) roles to use in your migration p - 6. For **Filter policies** , enter `S3`. Choose the **sc-s3-policy** policy that you created in the previous section. @@ -183 +24,0 @@ Create AWS Identity and Access Management (IAM) roles to use in your migration p - 7. Choose **Next**. The **Name, review, and create** page opens. @@ -185 +26 @@ Create AWS Identity and Access Management (IAM) roles to use in your migration p - 8. For **Role name** , enter a descriptive name. For example, enter `sc-s3-role`. Choose **Create role**. +## Configure VPC, Amazon S3, and Secrets Manager @@ -187 +28 @@ Create AWS Identity and Access Management (IAM) roles to use in your migration p - 9. On the **Roles** page, enter `sc-s3-role` for **Role name**. Choose **sc-s3-role**. +Before you create IAM roles and policies, you need the following AWS resources for your migration project. @@ -189 +30 @@ Create AWS Identity and Access Management (IAM) roles to use in your migration p - 10. On the **sc-s3-role page** , choose the **Trust relationships** tab. Choose **Edit trust policy**. +###### Amazon Virtual Private Cloud @@ -191 +32 @@ Create AWS Identity and Access Management (IAM) roles to use in your migration p - 11. Thes AWS DMS regional service principal has the following format: +You need a VPC with connectivity to your source and target databases from subnets in at least two Availability Zones. You can use an existing VPC that meets these requirements, or create a new one, for example named `sc-vpc`. For more information about network configuration, see [Setting up a network for DMS Schema Conversion](./instance-profiles-network.html). @@ -193 +34 @@ Create AWS Identity and Access Management (IAM) roles to use in your migration p