Connect to Application Migration Service data and control planes over a private network

The source data center and staging area VPC connect privately to the Application Migration Service control plane through the interface endpoint that you create in the target staging area VPC. To create the endpoint:

For more information, see Interface VPC endpoints in the Amazon VPC documentation.

The staging area VPC connects privately to the Amazon EC2 API through the interface endpoint that you create in the target staging area VPC. To create the endpoint, follow the instructions provided in the previous story.

The source data center and staging area VPC connect privately to the Amazon S3 API through the interface endpoint that you create in the target staging area VPC. To create the endpoint, follow the instructions provided in the first story.

Note: You use an interface endpoint because gateway endpoint connections cannot be extended out of a VPC. (For details, see the Amazon VPC documentation.)

During the configuration phase, the replication server has to connect to an S3 bucket to download the AWS Replication Server’s software updates. However, Amazon S3 interface endpoints do not support private DNS names, and there is no way to supply an Amazon S3 endpoint DNS name to a replication server. 

To mitigate this issue, you create an Amazon S3 gateway endpoint in the VPC that the staging area subnet belongs to, and update the staging subnet’s route tables with the relevant routes. For more information, see Create a gateway endpoint in the AWS PrivateLink documentation.

The interface endpoints for Application Migration Service and Amazon EC2 have private DNS names that can be resolved in the VPC. However, you also need to configure on-premises servers to resolve private DNS names for these interface endpoints.

There are multiple ways to configure these servers. In this pattern, we tested this functionality by forwarding on-premises DNS queries to the Amazon Route 53 Resolver inbound endpoint in the staging area VPC. For more information, see Resolving DNS queries between VPCs and your network in the Route 53 documentation.

Here’s an example for Linux:

1. Download the Agent by using the command:

wget -O ./aws-replication-installer-init.py \ 
https://aws-application-migration-service-<aws_region>.bucket.<s3-endpoint-DNS-name>/latest/linux/aws-replication-installer-init.py

Note: bucket is a static keyword that you must add before the Amazon S3 interface endpoint DNS name. For more information, see the Amazon S3 documentation.

For example, if the DNS name of the Amazon S3 interface endpoint is vpce-009c8b07adb052a11-qgf8q50y.s3.us-west-1.vpce.amazonaws.com and the AWS Region is us-west-1, you would use the command:

wget -O ./aws-replication-installer-init.py \
https://aws-application-migration-service-us-west-1.bucket.vpce-009c8b07adb052a11-qgf8q50y.s3.us-west-1.vpce.amazonaws.com/latest/linux/aws-replication-installer-init.py

2. Install the Agent:

     sudo python3 aws-replication-installer-init.py \
     --region <aws_region> \
     --aws-access-key-id <access-key> \
     --aws-secret-access-key <secret-key> \
     --no-prompt \
     --s3-endpoint <s3-endpoint-DNS-name>

     sudo python3 aws-replication-installer-init.py \
     --region <aws_region> \
     --aws-access-key-id <access-key> \
     --aws-secret-access-key <secret-key> \
     --no-prompt \
     --s3-endpoint <s3-endpoint-DNS-name> \
     --endpoint <mgn-endpoint-DNS-name>

For more information, see AWS Replication Agent installation instructions in the Application Migration Service documentation.

After you have established your connection with Application Migration Service and installed the AWS Replication Agent, follow the instructions in the Application Migration Service documentation to migrate your source servers to your target VPC and subnet.