AWS deadline-cloud medium security documentation change
Summary
Restructured content about multi-region monitors, clarified that a single monitor shows farms across regions except those using customer managed keys, and added guidance on when to create additional monitors.
Security assessment
Explicitly documents security implications of customer managed keys (CMK) restricting cross-region visibility. Highlights regional isolation benefits for outage resilience, which is a security consideration.
Diff
diff --git a/deadline-cloud/latest/userguide/monitors-additional-regions.md b/deadline-cloud/latest/userguide/monitors-additional-regions.md index d7a694575..6500e6093 100644 --- a//deadline-cloud/latest/userguide/monitors-additional-regions.md +++ b//deadline-cloud/latest/userguide/monitors-additional-regions.md @@ -7 +7 @@ -Cross-Region IAM Identity Center accessIAM Identity Center multi-Region replication +Managing users across RegionsWhen to create additional monitorsComparison of multi-monitor approachesCross-Region IAM Identity Center accessIAM Identity Center multi-Region replication @@ -9 +9 @@ Cross-Region IAM Identity Center accessIAM Identity Center multi-Region replicat -# Create monitors in additional Regions +# Monitors and farms in multiple Regions @@ -11 +11 @@ Cross-Region IAM Identity Center accessIAM Identity Center multi-Region replicat -Each Deadline Cloud monitor manages resources in a single AWS Region. To manage resources in additional Regions, you can create a separate monitor in each Region. +The Deadline Cloud monitor displays farms from all AWS Regions where AWS Deadline Cloud (Deadline Cloud) is available. When you open the monitor, you see farms in the same Region as the monitor and farms in other Regions that do not use a customer managed key. In most cases, a single monitor is all you need, even if you have farms in multiple Regions. @@ -13 +13 @@ Each Deadline Cloud monitor manages resources in a single AWS Region. To manage -If your IAM Identity Center instance is not available in the Region where you want to create a monitor, you have the following options: +## Managing users across Regions @@ -15 +15 @@ If your IAM Identity Center instance is not available in the Region where you wa - * **Cross-Region IAM Identity Center access** – Create a monitor in a different Region, and Deadline Cloud reads IAM Identity Center identity data from the Region where your IAM Identity Center instance is located. This option requires no changes to your IAM Identity Center configuration. +You can add users and groups to farms in any Region from the Deadline Cloud console. The console handles cross-Region AWS IAM Identity Center (IAM Identity Center) membership assignment. For more information about managing farm membership, see [Managing users in Deadline Cloud](./managing-users.html). @@ -17 +17 @@ If your IAM Identity Center instance is not available in the Region where you wa - * **IAM Identity Center multi-Region replication** – Replicate your IAM Identity Center instance to additional Regions so that monitors in those Regions use an IAM Identity Center replica in the same Region. This option provides lower latency and regional availability, but requires additional IAM Identity Center configuration. +## When to create additional monitors @@ -18,0 +19 @@ If your IAM Identity Center instance is not available in the Region where you wa +Because a single monitor shows farms in all Regions, you typically need only one monitor. You might want additional monitors in the following situations: @@ -19,0 +21,5 @@ If your IAM Identity Center instance is not available in the Region where you wa + * **Customer managed keys in multiple Regions** – A monitor cannot display farms in other Regions that use a customer managed key. If you have farms with customer managed keys in multiple Regions, you need a monitor in each of those Regions. + + * **Regional availability** – You want all Deadline Cloud resources, including the monitor, IAM Identity Center instance, and farms, to remain within a single Region. This configuration ensures that an outage in one Region does not affect your ability to manage resources in another Region. + + * **Multiple IAM Identity Center instances** – Each monitor connects to one IAM Identity Center instance. If your organization uses separate IAM Identity Center instances for different teams or business units, you need a monitor for each instance. @@ -22 +27,0 @@ If your IAM Identity Center instance is not available in the Region where you wa -The following diagram shows how each approach works. @@ -24 +28,0 @@ The following diagram shows how each approach works. - @@ -26 +30,5 @@ The following diagram shows how each approach works. -The following table compares the two approaches. +The following diagram and table compare the two approaches for connecting additional monitors to your IAM Identity Center instance across Regions. + +## Comparison of multi-monitor approaches + + @@ -28 +36 @@ The following table compares the two approaches. -Comparison of multi-Region approaches Consideration | Cross-Region IAM Identity Center access | IAM Identity Center multi-Region replication +Comparison of multi-monitor approaches Consideration | Cross-Region IAM Identity Center access | IAM Identity Center multi-Region replication