AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
Configure DataSync for On-Premises File Replication to S3 When using Direct Connect
Greetings, Direct Connect is configured between our on-premises network and AWS. We are going to set up a test using DataSync to sync a large file repository from on-prem file servers to S3 storage. An IT team will be installing and configuring the on-premises Datasync agent. On the AWS side, we will be using terraform to configure the Agents/Tasks/Location/SG etc.
My question is regarding the best practice configuring the Datasync Agent securely in AWS.
Should I create a "VPC Endpoint for Datasync " and use "VPC endpoints using AWS PrivateLink" or with Direct Connect, could I simply choose "Public service endpoints"?
- 언어
- English
질문됨 일 년 전379회 조회
- 최신
- 최다 투표
- 가장 많은 댓글
When using AWS Direct Connect for DataSync transfers from on-premises to S3, the most secure approach is to create a VPC endpoint for DataSync rather than using public service endpoints.
Using a VPC endpoint with AWS PrivateLink offers several security advantages:
-
It keeps all DataSync traffic private within your VPC without traversing the public internet, which enhances security for your data transfers.
-
When you activate your DataSync agent using a VPC endpoint, you'll see a green "VPC Endpoint" banner in the console, indicating that all tasks performed via this agent will use private endpoints.
-
For this setup with Direct Connect, you'll need:
- A Direct Connect gateway associated with a virtual private gateway for your VPC
- A private virtual interface connecting your VPC to the Direct Connect gateway
- A VPC endpoint for DataSync in the VPC
When you create a task using this configuration, DataSync will create four elastic network interfaces (ENIs) in your specified VPC and subnet. These ENIs handle the data transfer traffic, and you'll need to ensure your agent can reach them via port 443.
While you could use public service endpoints with Direct Connect, the VPC endpoint approach provides better security by keeping all traffic private and not exposing your data transfer to the public internet. This aligns with security best practices, especially when you already have Direct Connect established.
Sources
DataSync architecture and routing examples with AWS Direct Connect - AWS DataSync
Connecting your network for AWS DataSync transfers - AWS DataSync
Transferring files from on premises to AWS and back without leaving your VPC using AWS DataSync | AWS Storage Blog
DataSync Agent behind corporate proxy | AWS re:Post
