AWS prescriptive-guidance documentation change
Summary
Updated terminology from 'MGN' to 'AWS Transform MGN', corrected links, removed redundant content, and improved clarity for private network migration configurations.
Security assessment
Changes are editorial improvements and terminology updates (e.g., 'Direct Connect' to 'AWS Direct Connect'). No security vulnerabilities, exploits, or weaknesses are mentioned or addressed. The content still describes secure private network configurations but doesn't introduce new security documentation.
Diff
diff --git a/prescriptive-guidance/latest/rehost-servers-over-private-networks-mgn/configuration.md b/prescriptive-guidance/latest/rehost-servers-over-private-networks-mgn/configuration.md index abe11963e..cfdb4624d 100644 --- a//prescriptive-guidance/latest/rehost-servers-over-private-networks-mgn/configuration.md +++ b//prescriptive-guidance/latest/rehost-servers-over-private-networks-mgn/configuration.md @@ -5 +5 @@ -[Documentation](/index.html)[AWS Prescriptive Guidance](https://aws.amazon.com/prescriptive-guidance/)[Migrating on-premises servers to AWS over private networks by using AWS Transform MGN](welcome.html) +[Documentation](/index.html)[AWS Prescriptive Guidance](https://aws.amazon.com/prescriptive-guidance/)[Migrating on-premises servers to AWS over private networks by using AWS Transform MGN](introduction.html) @@ -11,3 +11 @@ Subnets and routing configurationsVPC endpoints configurationVPC interface endpo -This section provides a detailed description of the most restrictive scenario, where all communication occurs over the private channel only, and includes a detailed explanation of the requirements and corresponding components to be built for each area. - -This section describes the configuration for the most restrictive scenario (replication over private networks only), as shown in the [first diagram](./restrictive.html#fig1), based on the considerations discussed earlier. You can configure both hybrid scenarios by skipping parts of the most restrictive configuration: +This section describes the configuration for the most restrictive scenario (replication over private networks only), as shown in the first diagram, based on the considerations discussed earlier. You can configure both hybrid scenarios by skipping parts of the most restrictive configuration: @@ -22 +20 @@ This section describes the configuration for the most restrictive scenario (repl -The following sections assume that the initial MGN configuration is already complete, as described in the blog posts [Accelerate your Migration with AWS Transform MGN](https://aws.amazon.com/blogs/mt/accelerate-your-migration-with-aws-application-migration-service/) and [How to Use the New AWS Transform MGN for Lift-and-Shift Migrations](https://aws.amazon.com/blogs/aws/how-to-use-the-new-aws-application-migration-service-for-lift-and-shift-migrations/)). This discussion focuses on components that are specific to the restrictive scenario, and assumes a private staging subnet that has no connectivity to the internet. +The following sections assume that the initial AWS Transform MGN configuration is already complete, as described in the blog posts [Accelerate your Migration with AWS Transform MGN](https://aws.amazon.com/blogs/mt/accelerate-your-migration-with-aws-application-migration-service/) and [How to Use the New AWS Transform MGN for Lift-and-Shift Migrations](https://aws.amazon.com/blogs/aws/how-to-use-the-new-aws-application-migration-service-for-lift-and-shift-migrations/)). This discussion focuses on components that are specific to the restrictive scenario, and assumes a private staging subnet that has no connectivity to the internet. @@ -26 +24 @@ The following sections assume that the initial MGN configuration is already comp -For the restrictive scenario, you configure the required AWS resources in the private subnet of a staging VPC. This subnet has no connectivity to the internet (there's no internet gateway attached to the routing table as a default route). Instead, it uses either a virtual gateway associated with an [AWS Site-to-Site VPN](https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html) gateway (connected through an IPsec tunnel to an on-premises gateway), or it's connected to a transfer gateway or to Direct Connect services to provide private interconnectivity to the on-premises data centers. +For the restrictive scenario, you configure the required AWS resources in the private subnet of a staging VPC. This subnet has no connectivity to the internet (there's no internet gateway attached to the routing table as a default route). Instead, it uses either a virtual gateway associated with an [AWS Site-to-Site VPN](https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html) gateway (connected through an IPsec tunnel to an on-premises gateway), or it's connected to a transfer gateway or to AWS Direct Connect services to provide private interconnectivity to the on-premises data centers. @@ -28 +26 @@ For the restrictive scenario, you configure the required AWS resources in the pr -You will use that private subnet as a staging subnet for replication-related resources managed by Application Migration Service, and you'll configure all required network access through this subnet by using VPC endpoints, as discussed in the next section. +You will use that private subnet as a staging subnet for replication-related resources managed by MGN, and you'll configure all required network access through this subnet by using VPC endpoints, as discussed in the next section. @@ -50 +48 @@ AWS service | VPC endpoint type | Private DNS | Related subnet -**MGN** | Interface | Enabled | Staging private subnet +**AWS Transform MGN**| Interface| Enabled| Staging private subnet @@ -54 +52 @@ AWS service | VPC endpoint type | Private DNS | Related subnet -You can create optional VPC endpoints to enable access to EC2 instances on private isolated subnets through AWS Systems Manager, as discussed in [Creating VPC endpoints](https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-create-vpc.html#sysman-setting-up-vpc-create) in the Systems Manager documentation. +You can create optional VPC endpoints to enable access to Amazon EC2 instances on private isolated subnets through AWS Systems Manager, as discussed in [Creating VPC endpoints](https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-create-vpc.html#sysman-setting-up-vpc-create) in the Systems Manager documentation. @@ -66 +64 @@ AWS service | VPC endpoint type | Private DNS | Related subnet -Creating an interface endpoint also creates a specific elastic network interface for each subnet that the given interface endpoint is provisioned for. For example, the Application Migration Service interface endpoint is provisioned in a private subnet in the staging VPC with an elastic network interface that is associated with the IP address inside that subnet, and it also has three DNS names resolvable from the subnet to this IP address: +Creating an interface endpoint also creates a specific elastic network interface for each subnet that the given interface endpoint is provisioned for. For example, the MGN interface endpoint is provisioned in a private subnet in the staging VPC with an elastic network interface that is associated with the IP address inside that subnet, and it also has three DNS names resolvable from the subnet to this IP address: @@ -88 +86 @@ That fixes connectivity for any instances running in the staging subnet (such as -For services such as Amazon S3, no fixed DNS name can be provisioned because each bucket has its own DNS name. For this scenario you will use VPC gateway endpoints. +For services such as Amazon S3 there's no fixed DNS name that can be provisioned, because each bucket has its own DNS name. For this scenario you will use VPC gateway endpoints. @@ -90 +88 @@ For services such as Amazon S3, no fixed DNS name can be provisioned because eac -Creating an Amazon S3 gateway endpoint also creates a specific prefix list object with a list of subnet destinations (in CIDR notation), which can be added in the subnet route table. Thus, DNS names of S3 buckets resolved to IP addresses included in this list would be accessible through internal connectivity. +Creating an Amazon S3 gateway endpoint also creates a specific prefix list object with a list of subnet destinations (in CIDR notation), which can be added in the subnet route table. Thus, DNS names of Amazon S3 buckets resolved to IP addresses included in this list would be accessible through internal connectivity. @@ -104 +102 @@ The configuration described in the previous section is sufficient for instances -To prevent this, you need to configure source servers or their default DNS servers to use [Amazon Route 53 Resolver](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html) for resolution of these specific DNS names or a subdomain zone (that is, the full `*.<region>.amazonaws.com` zone) . This can be configured by creating a [Route 53 Resolver inbound endpoint](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-DSN-queries-to-vpc.html), which, like a VPC interface endpoint, has a dedicated elastic network interface created in the dedicated private subnet on AWS, and is thus able to forward DNS requests to Amazon Route 53 Resolver. +To prevent this, you need to configure source servers or their default DNS servers to use [Amazon Route 53 Resolver](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html) for resolution of these specific DNS names or a subdomain zone (that is, the full `*.<region>.amazonaws.com` zone) . This can be configured by creating a [Route 53 Resolver inbound endpoint](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html#resolver-overview-forward-network-to-vpc), which, like a VPC interface endpoint, has a dedicated elastic network interface created in the dedicated private subnet on AWS, and is thus able to forward DNS requests to Amazon Route 53 Resolver. @@ -114 +112 @@ To install MGN Agent on source servers, you need to supply the DNS names of the -For the MGN endpoint, you can use any of the DNS names associated with it—a private DNS field (`mgn.<region>.amazonaws.com`) or a VPC-specific DNS name (`vpce-<VPC-id>-<suffix>.mgn.<region>.vpce.amazonaws.com`)—and supply an argument: `--endpoint <FQDN>`. In fact, if you skip this argument, the Agent uses the specified AWS Region to reconstruct the default DNS FQDN (`mgn.<region>.amazonaws.com`) and uses the FQDN to access the Application Migration Service control plane. In most cases, that default behavior should suffice, as long as that FQDN resolves from the source server correctly to the private IP address of the elastic network interface for the MGN VPC endpoint created in the staging subnet. +For the MGN endpoint, you can use any of the DNS names associated with it―a "Private DNS" field (`mgn.<region>.amazonaws.com`) or a VPC-specific DNS name (`vpce-<VPC-id>-<suffix>.mgn.<region>.vpce.amazonaws.com`)―and supply an argument: `--endpoint <FQDN>`. In fact, if you skip this argument, the Agent uses the specified AWS Region to reconstruct the default DNS FQDN (`mgn.<region>.amazonaws.com`) and uses the FQDN to access the MGN control plane. In most cases, that default behavior should suffice, as long as that FQDN resolves from the source server correctly to the private IP address of the elastic network interface for the MGN VPC endpoint created in the staging subnet. @@ -116 +114 @@ For the MGN endpoint, you can use any of the DNS names associated with it—a pr -The Amazon S3 interface endpoint won't have a single private DNS name (because each S3 bucket will have its own), so that option isn't supported. However, an Amazon S3 interface endpoint still has an elastic network interface associated with it. It also has a specific private IP and wildcard DNS names (in the format `.vpce-<VPC-ID>-<suffix>.s3.<region>.vpce.amazonaws.com` or Region-specific .`vpce-<VPC-ID>-<suffix>-<region>.s3.<region>.vpce.amazonaws.com`) that are resolvable to this private IP. +The Amazon S3 interface endpoint won't have a single private DNS name (because each bucket will have its own), so that option isn't supported. However, an Amazon S3 interface endpoint still has an elastic network interface associated with it. It also has a specific private IP and wildcard DNS names (in the format `.vpce-<VPC-ID>-<suffix>.s3.<region>.vpce.amazonaws.com` or Region-specific .`vpce-<VPC-ID>-<suffix>-<region>.s3.<region>.vpce.amazonaws.com`) that are resolvable to this private IP. @@ -121 +119 @@ That wildcard DNS name can be used for the `--s3-endpoint` argument, as in the f - aws-replication-installer-init.py --region <region> --aws-access-key-id <MGN_IAM_ACCESS_KEY> --aws-secret-access-key <MGN_IAM_SECRET> --no-prompt \ + aws-replication-installer-init.py --region <region> --aws-access-key-id <MGN_IAM_ACCESS_KEY> --aws-secret-access-key <MGN_IAM_SECRET> --no-prompt \