You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/storage-mover/cloud-to-cloud-private-network-configs.md
+8-7Lines changed: 8 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -83,7 +83,7 @@ For a detailed walkthrough of multi-tunnel BGP between Azure VPN Gateway and AWS
83
83
84
84
Example custom IPsec/IKE settings (validate against your device compatibility): **GCMAES256** for IPsec encryption/integrity, **SHA256** for IKE integrity, **DHGroup14**, **PFS2048**.
85
85
86
-
:::image type="content" source="./media/cloud-to-cloud-networking/ipsec-policy.png" alt-text="Screenshot of the Project Explorer page with the Create a Project pane's fields visible." lightbox="./media/cloud-to-cloud-networking/ipsec-policy.png":::
86
+
:::image type="content" source="./media/cloud-to-cloud-networking/ipsec-policy.png" alt-text="Screenshot of ipsec policy." lightbox="./media/cloud-to-cloud-networking/ipsec-policy.png":::
@@ -161,11 +161,11 @@ An AWS VPC endpoint (VPCE) for S3 lets your VPC reach S3 privately. For this des
161
161
2. Create an **interface** VPCE for **Amazon S3** in the target VPC and subnets, and enable **private DNS**.
162
162
3. Configure VPCE and bucket policies to allow only required S3 actions and (optionally) restrict access to the specific endpoint using **aws:SourceVpce**.
163
163
164
-
:::image type="content" source="./media/cloud-to-cloud-networking/vpce-policy.png" alt-text="Screenshot of the Project Explorer page with the Create a Project pane's fields visible." lightbox="./media/cloud-to-cloud-networking/vpce-policy.png":::
164
+
:::image type="content" source="./media/cloud-to-cloud-networking/vpce-policy.png" alt-text="Screenshot of vpce policy." lightbox="./media/cloud-to-cloud-networking/vpce-policy.png":::
165
165
166
166
Example: S3 bucket policy restricted to a specific VPCE.
167
167
168
-
:::image type="content" source="./media/cloud-to-cloud-networking/s3-bucket-policy.png" alt-text="Screenshot of the Project Explorer page with the Create a Project pane's fields visible." lightbox="./media/cloud-to-cloud-networking/s3-bucket-policy.png":::
168
+
:::image type="content" source="./media/cloud-to-cloud-networking/s3-bucket-policy.png" alt-text="Screenshot of bucket policy." lightbox="./media/cloud-to-cloud-networking/s3-bucket-policy.png":::
169
169
170
170
**Note:** Record the VPCE private IP address; it is used as the destination IP for Azure Private Link Service Direct Connect.
171
171
@@ -210,13 +210,13 @@ After creating the Direct Connect resource, create a private connection in Stora
:::image type="content" source="./media/cloud-to-cloud-networking/private-network-architcture.png" alt-text="Image of Network Architecture" lightbox="./media/cloud-to-cloud-networking/private-network-architcture.png":::
213
+
:::image type="content" source="./media/cloud-to-cloud-networking/private-network-architcture.png" alt-text="Image of private network architecture" lightbox="./media/cloud-to-cloud-networking/private-network-architecture.png":::
214
214
215
215
*Note: Above diagram shown with private networking to AWS but same applies for other private networking scenarios.*
216
216
217
217
### Cloud-to-cloud migration flow (public S3 bucket to Blob)
218
218
219
-
:::image type="content" source="./media/cloud-to-cloud-networking/publics3-to-blob-architcture.png" alt-text="Image of Network Architecture" lightbox="./media/cloud-to-cloud-networking/publics3-to-blob-architcture.png":::
219
+
:::image type="content" source="./media/cloud-to-cloud-networking/publics3-to-blob-architcture.png" alt-text="Image of public blob network architecture" lightbox="./media/cloud-to-cloud-networking/publics3-to-blob-architecture.png":::
220
220
221
221
222
222
## Troubleshooting
@@ -233,14 +233,14 @@ After creating the Direct Connect resource, create a private connection in Stora
233
233
***Audit Action Permissions:** Ensure the `Action` element in the VPCE policy permits necessary operations. At a minimum, `s3:Get*` and `s3:List*` are required for reading and browsing data.
234
234
***Policy Logic:** If using a custom policy, ensure there are no "Deny" statements that inadvertently override the "Allow" statements for the Azure-sourced traffic.<br>
235
235
236
-
:::image type="content" source="./media/cloud-to-cloud-networking/vpce-policy.png" alt-text="Screenshot of the Project Explorer page with the Create a Project pane's fields visible." lightbox="./media/cloud-to-cloud-networking/vpce-policy.png":::
236
+
:::image type="content" source="./media/cloud-to-cloud-networking/vpce-policy.png" alt-text="Screenshot of vpce policy." lightbox="./media/cloud-to-cloud-networking/vpce-policy.png":::
237
237
238
238
### S3 bucket policy constraints
239
239
240
240
***VPCE allow listing:** Check the S3 Bucket Policy for a `Condition` block. If the bucket restricts access, it must explicitly allow the `aws:SourceVpce` corresponding to the VPC Endpoint being used.
241
241
***Principal Access:** Ensure the IAM identity or the anonymous access (if applicable via VPCE) is not blocked by the bucket's Access Control List (ACL) or Public Access Block settings.
242
242
243
-
:::image type="content" source="./media/cloud-to-cloud-networking/s3-bucket-policy.png" alt-text="Screenshot of the Project Explorer page with the Create a Project pane's fields visible." lightbox="./media/cloud-to-cloud-networking/s3-bucket-policy.png":::
243
+
:::image type="content" source="./media/cloud-to-cloud-networking/s3-bucket-policy.png" alt-text="Screenshot of bucket policy" lightbox="./media/cloud-to-cloud-networking/s3-bucket-policy.png":::
244
244
245
245
### Regional alignment
246
246
@@ -281,3 +281,4 @@ For BGP between Azure and AWS, follow: [Tutorial - Configure a BGP-enabled conne
0 commit comments