Copying and Sharing Amazon EC2 Snapshots in the AWS Console

You can configure replication of AWS-encrypted snapshots of Amazon EC2 instances from the AWS Console.

For default-encrypted volumes, Commvault automatically converts such snapshots to custom-encrypted snapshots, and shares the snapshots with the destination account. If the cvlt keys or tags are not configured in the target region, then the snapshots of default-encrypted volumes cannot be shared with the destination account.

Procedure

1. Log on to the AWS Console as a user associated with the access key and secret key or the IAM role that is configured for the Amazon EC2 client from which you will be sharing the snapshots.

2. In the ribbon, click Services.

3. Click IAM.

4. Click Users.

5. Select the required user, and then add the kms:ListResourceTags permission to the permission policy.

   For IAM role authentication, the security policy associated with the IAM role must be updated with kms:ListResourceTags permission.

6. In the ribbon, click Services.

7. Click Key Management Service.

8. Select the region to replicate the snapshots to.

9. To use a key, do one of the following:

   • To use an existing key, add either cvlt-ec2 or cvlt-master as a tag to the key.

     When you tag a key with cvlt-ec2, Commvault uses it for all EC2 specific snapshot replication of volumes. If however, such a key does not exist, then any key tagged with cvlt-master will be used for encryption.

     If there is no key tagged with cvlt-master, then the replicated volume snapshot will be encrypted using the default encryption method of Amazon.

   • To create a new key, click Create a key, and follow the instructions to create a key.

     Specify the alias as cvlt-ec2 or cvlt-master.

     The precedence of keys is as follows: A key with the alias cvlt-ec2 has the highest precedence, followed by a key with the alias cvlt-master, followed by the key associated with the tag cvlt-ec2, with the key associated with cvlt-master having the lowest precedence. If none of the keys are found, then the replicated volume snapshot is encrypted using default encryption method of Amazon Web Services.

10. If you used a key, verify that the key is associated with the user whose permissions were updated.