AWS evs documentation change
Summary
Added comprehensive documentation for Self-deployed mode including prerequisites, step-by-step creation process, VLAN subnet sizing, security considerations, troubleshooting, and cleanup procedures. Updated prerequisites list, AWS CLI command sequences, and corrected minor typos.
Security assessment
The changes introduce a new 'Security considerations' section detailing the shared responsibility model for Self-deployed mode, including credential management, patching responsibilities, and network hardening requirements. However, there's no evidence of addressing a specific security vulnerability or incident.
Diff
diff --git a/evs/latest/userguide/getting-started.md b/evs/latest/userguide/getting-started.md index b0a06e47a..bb291b58b 100644 --- a//evs/latest/userguide/getting-started.md +++ b//evs/latest/userguide/getting-started.md @@ -7 +7 @@ -PrerequisitesCreate a VPC with subnets and route tablesChoose your HCX connectivity optionConfigure the VPC main route tableConfigure DNS and NTP servers using the VPC DHCP option setSet up a VPC Route Server instance with endpoints and peersCreate a network ACL to control Amazon EVS VLAN subnet trafficCreate an Amazon EVS environmentVerify Amazon EVS environment creationExplicitly associate Amazon EVS VLAN subnets to a VPC route tableRetrieve VCF credentials and access VCF management appliancesClean upNext steps +PrerequisitesCreate a VPC with subnets and route tablesChoose your HCX connectivity optionConfigure the VPC main route tableConfigure DNS and NTP servers using the VPC DHCP option setSet up a VPC Route Server instance with endpoints and peersCreate a network ACL to control Amazon EVS VLAN subnet trafficCreating an Amazon EVS environment with Self-deployed modeCreate an Amazon EVS environmentVerify Amazon EVS environment creationExplicitly associate Amazon EVS VLAN subnets to a VPC route tableRetrieve VCF credentials and access VCF management appliancesClean upNext steps @@ -14,0 +15,4 @@ After you’re finished, you’ll have an Amazon EVS environment that you can us +Amazon EVS can deploy VCF for you, or you can use **Self-deployed** mode to install VCF yourself. For the VCF versions that Amazon EVS supports, see [VCF versions and EC2 instance types provided by Amazon EVS](./versions-provided.html). + +For Self-deployed mode, see Creating an Amazon EVS environment with Self-deployed mode. The procedures under Create an Amazon EVS environment cover environment creation where Amazon EVS deploys VCF for you. + @@ -38,0 +43,2 @@ For information about VCF versions provided by Amazon EVS, see [VCF versions and + * Creating an Amazon EVS environment with Self-deployed mode + @@ -143,4 +148,0 @@ AWS CLI - --- - . Store the VPC ID for use in subsequent commands. - + - [source,bash] @@ -148 +150 @@ AWS CLI -VPC_ID=$(aws ec2 describe-vpcs \ \--filters Name=tag:Name,Values=evs-vpc \ \--query 'Vpcs[0].VpcId' \ \--output text) \--- + 3. Store the VPC ID for use in subsequent commands. @@ -150 +152,6 @@ VPC_ID=$(aws ec2 describe-vpcs \ \--filters Name=tag:Name,Values=evs-vpc \ \--qu - 3. Enable DNS hostnames and DNS support. + VPC_ID=$(aws ec2 describe-vpcs \ + --filters Name=tag:Name,Values=evs-vpc \ + --query 'Vpcs[0].VpcId' \ + --output text) + + 4. Enable DNS hostnames and DNS support. @@ -159 +166 @@ VPC_ID=$(aws ec2 describe-vpcs \ \--filters Name=tag:Name,Values=evs-vpc \ \--qu - 4. Create a private subnet in the VPC. + 5. Create a private subnet in the VPC. @@ -167 +174 @@ VPC_ID=$(aws ec2 describe-vpcs \ \--filters Name=tag:Name,Values=evs-vpc \ \--qu - 5. Store the private subnet ID for use in subsequent commands. + 6. Store the private subnet ID for use in subsequent commands. @@ -174 +181 @@ VPC_ID=$(aws ec2 describe-vpcs \ \--filters Name=tag:Name,Values=evs-vpc \ \--qu - 6. (Optional) Create a public subnet if internet connectivity is needed. + 7. (Optional) Create a public subnet if internet connectivity is needed. @@ -182 +189 @@ VPC_ID=$(aws ec2 describe-vpcs \ \--filters Name=tag:Name,Values=evs-vpc \ \--qu - 7. (Optional) Store the public subnet ID for use in subsequent commands. + 8. (Optional) Store the public subnet ID for use in subsequent commands. @@ -189 +196 @@ VPC_ID=$(aws ec2 describe-vpcs \ \--filters Name=tag:Name,Values=evs-vpc \ \--qu - 8. (Optional) Create and attach an internet gateway if the public subnet is created. + 9. (Optional) Create and attach an internet gateway if the public subnet is created. @@ -203 +210 @@ VPC_ID=$(aws ec2 describe-vpcs \ \--filters Name=tag:Name,Values=evs-vpc \ \--qu - 9. (Optional) Create a NAT gateway if internet connectivity is needed. + 10. (Optional) Create a NAT gateway if internet connectivity is needed. @@ -219 +226,10 @@ VPC_ID=$(aws ec2 describe-vpcs \ \--filters Name=tag:Name,Values=evs-vpc \ \--qu - 10. Create and configure the necessary route tables. + NAT_GW_ID=$(aws ec2 describe-nat-gateways \ + --filter Name=tag:Name,Values=evs-nat \ + --query 'NatGateways[0].NatGatewayId' \ + --output text) + +###### Note + +The NAT gateway must be in the `available` state before you create a route that references it. To check, run `aws ec2 describe-nat-gateways --nat-gateway-ids $NAT_GW_ID --query 'NatGateways[0].State'`. + + 11. Create and configure the necessary route tables. @@ -239 +255 @@ VPC_ID=$(aws ec2 describe-vpcs \ \--filters Name=tag:Name,Values=evs-vpc \ \--qu - 11. Add the necessary routes to the route tables. + 12. Add the necessary routes to the route tables. @@ -251 +267 @@ VPC_ID=$(aws ec2 describe-vpcs \ \--filters Name=tag:Name,Values=evs-vpc \ \--qu - 12. Associate the route tables with your subnets. + 13. Associate the route tables with your subnets. @@ -679,0 +696,4 @@ Your environment deployment fails if you don’t meet these Amazon EVS requireme +###### Note + +The NSX uplink VLAN subnet does not exist yet when you create the route server peers — Amazon EVS creates it during environment creation. Choose the two peer IP addresses from the **planned** NSX uplink VLAN CIDR block (the value you will pass as `initialVlans.nsxUplink`). The two IP addresses must fall within that planned CIDR block and remain unused. + @@ -681,0 +702,13 @@ For more information about setting up VPC Route Server, see the [Route Server ge +When you follow that tutorial, use the following Amazon EVS-specific values: + + * **Amazon-side ASN** — the BGP ASN of the VPC Route Server. Use any private ASN (for example, `65022`). The NSX Edge Tier-0 gateway uses this value as its BGP neighbor (remote) ASN in Step 5: Configure NSX networking, so note the value you choose. + + * **Route server endpoints** — create two endpoints, both in the service access subnet. + + * **Route server peers** — We recommend that you create four route server peers and configure a full mesh, so that each of the two NSX Edge nodes peers with both route server endpoints. A full mesh keeps routes propagating if a route server endpoint goes into maintenance. At minimum, you must create two peers. Use a unique IP address from your planned NSX uplink VLAN CIDR for each peer, and set the peer ASN to the NSX Edge Tier-0 ASN that you configure in Step 5: Configure NSX networking (for example, `65000`). + + * **Propagation** — enable route server propagation on the route table associated with your service access subnet. That route table must have at least one explicit subnet association. + + + + @@ -684 +717 @@ For more information about setting up VPC Route Server, see the [Route Server ge -When enabling Route Server propagation, ensure that all route tables being propagated have at least one explicit subnet association. BGP route advertisement fails if the route table does have an explicit subnet association. +When enabling Route Server propagation, ensure that all route tables being propagated have at least one explicit subnet association. BGP route advertisement fails if the route table does not have an explicit subnet association. @@ -728,0 +762,585 @@ EC2 security groups do not function on elastic network interfaces that are attac +## Creating an Amazon EVS environment with Self-deployed mode + +Amazon EVS supports a Self-deployed mode that provides you full control over your VCF deployment using the VCF Installer or your preferred Infrastructure as Code solutions to automate the deployment. For example scripts that automate your VCF deployment, see the [Solutions for Amazon EVS](https://github.com/aws/solutions-for-amazon-evs) repository on GitHub. + +For the VCF versions currently supported in Self-deployed mode, see [VCF versions and EC2 instance types provided by Amazon EVS](./versions-provided.html). + +### Overview + +In Self-deployed mode, you create an Amazon EVS environment, add hosts, and then install and configure VCF yourself. Amazon EVS provisions the AWS networking and VLAN subnets; you deploy VCF with the VCF Installer (or your own IaC) and connect it back to Amazon EVS with connectors. + +Before you begin, complete the AWS networking and account prerequisites for your environment. For more information, see [Setting up Amazon Elastic VMware Service](./setting-up.html) and the prerequisite checklist in [Amazon EVS deployment prerequisite checklist](./evs-deployment-prereq-checklist.html). + +Then complete these steps in order: + + 1. **Create the environment ** — Amazon EVS provisions your VLAN subnets. + + 2. **Create DNS records ** — Create A and PTR records for your ESX hosts and VCF management appliances. + + 3. **Add hosts ** — Add bare-metal EC2 hosts to your environment. + + 4. **Install VCF ** — Install VCF on your hosts using the VCF Installer. + + 5. **Configure NSX networking ** — Create your overlay networks on the NSX Edges and configure routing to your VPC. + + 6. **Create connectors ** — Create connectors so that Amazon EVS can monitor your deployment and report license usage. + + 7. **Verify your environment ** — Confirm that your hosts, management appliances, and connectors are healthy. + + + + +### Billing + +After you add hosts to your environment, you accrue AWS charges for the EC2 bare-metal instances as you would for any other EC2 instance, regardless of whether you have installed VCF on them yet. + +If you have created an environment in Self-deployed mode but not yet added hosts or installed VCF, AWS may reach out to you using the email address associated with your AWS account, requesting that you either complete setup or remove the environment. + +To stop accruing charges for hosts that you are no longer using, delete those hosts. For more information, see Clean up an Amazon EVS environment with Self-deployed mode. + +### Step 1: Create the environment + +In Self-deployed mode, environment creation provisions the Amazon EVS VLAN subnets that you specify. It does not deploy VCF or create hosts. + +###### Example + +Amazon EVS console + + + 1. Go to the Amazon EVS console. + +###### Note + +Ensure that the AWS Region shown in the upper right of your console is the AWS Region that you want to create your environment in. + + 2. In the navigation pane, choose **Environments**. + + 3. Choose **Create environment**. + + 4. On the **Configure environment** step, do the following. + + 1. Review the **AWS account requirements** panel to confirm that your account meets Amazon EVS prerequisites. + + 2. (Optional) For **Name** , enter an environment name. + + 3. For **VCF version** , choose **Self-deployed**. + + 4. Choose **Next**. + + 5. On the **Configure networks and connectivity** step, do the following. + + 1. For **VPC** , choose the VPC that you previously created. + + 2. For **Service access subnet** , choose the private subnet that you previously created. + + 3. (Optional) For **Service access security group - optional** , choose up to two security groups that control communication between the Amazon EVS control plane and your VPC. Amazon EVS uses the default security group if no security group is chosen. + +###### Note + +Ensure that the security groups you choose provide connectivity to the Amazon EVS VLAN subnets. + + 4. Under **Management connectivity** , enter CIDR blocks for the Amazon EVS VLAN subnets. Amazon EVS creates these VLAN subnets as part of environment creation. + +###### Important + +Amazon EVS VLAN subnets can only be created during environment creation, and cannot be modified after the environment is created. You must ensure that the VLAN subnet CIDR blocks are properly sized before creating the environment. For sizing guidance, see VLAN subnet sizing guidance. + + 5. Under **Expansion VLANs** , enter CIDR blocks for additional Amazon EVS VLAN subnets that you can use to extend your VCF deployment. + + 6. Under **Workload/VCF connectivity** , enter the CIDR block for the NSX uplink VLAN. + +###### Note + +In Self-deployed mode, you do not select VPC Route Server peers when you create the environment. You configure BGP peering between the NSX Edge Tier-0 gateway and your VPC Route Server yourself, after you install VCF. For more information, see Step 5: Configure NSX networking and Set up a VPC Route Server instance with endpoints and peers. + + 7. Choose **Next**. + + 6. (Optional) On the **Add tags** step, add tags and choose **Next**. + +###### Note + +Hosts that you subsequently add to this environment receive the following tag: `DoNotDelete-EVS-[<environmentId>]-[<hostname>]`. Do not delete, stop, or shut down these hosts outside of Amazon EVS. Doing so causes Amazon EVS to lose visibility into the host and can put your environment into an impaired state. + +###### Note + +Tags associated with the Amazon EVS environment do not propagate to underlying AWS resources such as EC2 instances. + + 7. On the **Review and create** step, review your configuration and choose **Create environment**. + +An information alert on the **Review** page confirms: "Your environment infrastructure will be provisioned now. After creation, add hosts and deploy VCF from the Environment Detail page." +