Overview of support for Amazon Web Services

Amazon EC2 (Elastic Cloud Computing) instances, similar to virtual servers, that can run applications. Instances are created from an Amazon AMI.

A template that contains a software configuration, including an operating system, which defines your operating environment. You can use generic public AMIs or you can customize a public AMI.

Availability Zone

A distinct location within an AWS geographic Region. A Region can contain multiple Availability Zones. An Availability Zone is designed to be isolated so that a failure in another Availability Zone does not impact its instances. A subnet resides in only one Availability Zone.

The BMC Cloud Lifecycle Management pod is mapped to an Availability Zone. Consequently, Availability Zones are onboarded as pods.

Virtual Private Cloud (VPC)

A virtual network dedicated to your AWS account that is logically isolated from other virtual networks in the AWS cloud. A VPC creates a separate section of the AWS cloud with its own virtual network topology. You can create multiple VPCs in the AWS cloud.

A VPC is contained with an AWS geographic Region, and it can span multiple Availability Zones.

Security Group

A firewall policy that is applied to provisioned virtual machines. A security group consists of rules that control inbound and outbound network traffic. You can assign virtual machine instances to multiple security groups.

SSH key pair

A public/private key pair that enables remote access to your virtual machine instances. Use this key to gain SSH access to Linux instances and Remote Desktop access to Windows instances.

BMC Server Automation Agent

A software package that you can install on an AMI instance to enable the BMC Server Automation use cases on virtual machine instances.

A generic construct that absorbs the key artifacts of any isolated network topology.

The logical data center references Logical Distributed Firewalls, Logical Perimeter Firewalls, Logical Data Stores, and Logical Load Balancers.

A Logical Load Balancer represents an Elastic Load Balancer. The Logical Load Balancer has IPV4 and IPV6 DNS names to accomodate IPV6 clients. The cloud administrator has the ability to decide the probing protocol and the probing path. For example, a webserver instance listening to traffic on port 80 would have a probing path similar to xxxxx:80/index.html.

A construct within the Logical Data Center that provides security at the perimeter of the data center, even though the physical layout is not exposed. Packets coming in from the internet must traverse
through these firewalls before they can enter the Logical Data Center. These firewalls typically provide subnet level security.

A construct within the Logical Data Center that provides security between VLANs. These firewalls are additive to the logical perimeter firewalls and are usually tightly integrated at the hypervisor layer. These firewalls can be associated with elastic load balancers.

A construct within the Logical Data Center that provides a virtual data store.

Availability Zone

Logical Hosting Environment

Amazon Machine Image

Template for a provisioning instance

Virtual Private Cloud subnet

Logical Network

Elastic Load Balancers

Security Groups

Network ACL

Elastic Block Storage

Load Balancer and Firewall management is not supported for Availability Zone-based LDCs.

IPAM is also not supported for an onboarded Availability Zone (which is onboarded as an LDC).

In an AWS environment, some Availability Zones do not support an AMI with a type General Purpose (SSD) volume for provisioning. This behavior is as designed by AWS.

If this occurs, BMC Cloud Lifecycle Management displays the following error when trying to provision an instance in the Availability Zone.

To work around this issue, provision the AWS instance in a different Availability Zone.

The BMC Cloud Management console does not support LHE Offboard. Therefore, all of the VPC-based LHEs are deleted from both the Cloud database and AWS when you select Decommission in the BMC Cloud Management console, including the onboarded VPC-based LHEs where the VPCs were created in AWS.

LHE Offboard is supported only using the API.

• Firewalls: Outbound rules for a Distributed Firewall cannot be viewed or created through the Firewall management UI. To view an outbound firewall rule, use the API.
• Network paths: The Create: Deny Network Paths are only valid between two networks (external or internal). If an endpoint is a Resource Set, the Network Path is invalid.
• Firewall and network paths: 
  • The only valid protocols for firewall rules and network paths are TCP or UDP.
  • If you have multiple network paths, deleting a network path or SOI with a shared firewall rule deletes the rule. This situation might result in failures for other SOIs that also use the shared firewall rule. In the event of a failure, you must re-create the network path to re-instantiate the firewall rule.

• Distributed firewall: 

  Best practice

  To enroll the BMC Server Automation server, install the software, and run compliance successfully, BMC recommends that you perform the following actions:

  * (When the distributed firewall is enabled): Define the required port including the RSCD port (4750) in the service blueprint

  * (When the distributed firewall is disabled): Define the required port including the RSCD port (4750) in a VPC-level default security group or in the service blueprint