Amazon S3 - AWS IAM Role Policy

Name

The name of the Cloud library.

Device Name

A unique device name generated by the system when the library is added.

Type

Select Amazon S3 from the list.

MediaAgent

The name of the MediaAgent to which the device is attached. Select a MediaAgent from the list to add to the cloud storage device. The list contains the names of all the MediaAgents configured in the CommCell.

For AWS IAM Role Policy the selected MediaAgent must reside in the EC2 instance and an IAM Role must be associated with the EC2 instance. Make sure to select the specific MediaAgent from the drop-down list during library configuration. (For more information about installing the MediaAgent on the EC2 instance, see MediaAgent Installations.)

Access Information

Add the credentials and other details required to access the cloud storage space.

Authentication

Select AWS IAM Role Policy.

AWS Identity and Access Management (IAM) role policies are used to avoid the effort associated with rotating access keys and secret keys within an organization. An AWS IAM role permitting activity on your AWS resources (EC2, S3) is created and associated with your AWS-based MediaAgent. No credentials are stored within the Commvault system. You can create the AWS IAM Role Policy using the IAM Console. For more information about creating AWS IAM Role Policy, see http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html.

Create the IAM role with the following permissions.

Sample json file with these permissions.

"s3:CreateBucket",
"s3:GetBucketLocation",
"s3:GetObject",
"s3:PutObject",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:ListBucket",
"s3:ListAllMyBuckets",
"s3:DeleteObject",
"s3:DeleteObjectVersion",
"s3:ListBucketVersions",
"s3:PutBucketObjectLockConfiguration",
"s3:PutBucketVersioning",
"s3:GetBucketVersioning",
"s3:GetBucketObjectLockConfiguration"

• The CreateBucket permission is required only when the bucket must be created by the MediaAgent while configuring the cloud storage. (This permission can be skipped if an existing bucket is used for configuring the cloud storage.)

• The ListAllMyBuckets permissions request is required for the Detect button to work.

• For a bucket with versioning enabled, the user must have DeleteObjectVersion and ListBucketVersions permissions to delete a versioned objects when a pruning request is sent to delete the objects.

• To recall data from Amazon Glacier Glacier/Deep Archive or Combined Tier Storage Classes, make sure that the user associated with the bucket has the RestoreObject permission. For more information on POST Object restore, see https://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPOSTrestore.html.

• The PutBucketVersioning permission is required to enable versioning on the bucket. Object lock can be enabled only on versioning enabled bucket.

• The GetBucketVersioning permission is required to infer whether versioning is enabled on a bucket or not.

• The GetBucketObjectLockConfiguration permission is required to infer whether object lock is enabled on a bucket or not.

Service Host

A valid endpoint name for the Amazon S3 region provided by the agency. (Commvault transfers data using HTTPS protocol to the service host.)

Default: s3.[region].amazonaws.com. For example, s3.us-west-1.amazonaws.com.

• For more information about Amazon Access Points, see https://docs.aws.amazon.com/AmazonS3/latest/dev/access-points.html.

  For more information about AWS PrivateLink for Amazon S3, see https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html.

• For Amazon S3 Transfer Acceleration, provide the service host provider name as s3-accelerate.amazonaws.com.

• For AWS PrivateLink for Amazon S3, provide the service host provider name as [VPC-endpoint-ID].[region].vpce.amazonaws.com. For example, vpce-1a2b3c4d-5e6f.s3.us-east-1.vpce.amazonaws.com.

• For Amazon S3 Access Points, provide the service host provider name as s3-accesspoint.[region].amazonaws.com.

• For Access Point with AWS PrivateLink, provide the service host provider name as accesspoint.[VPC-endpoint-ID].[region].vpce.amazonaws.com. For example, accesspoint.vpce-1a2b3c4d-5e6f.s3.us-east-1.vpce.amazonaws.com.

• To connect to the VPC STS endpoint, provide the service host provider name as vpce-1234567f12345678-123456e2hf.s3.us-east-1.vpce.amazonaws.com.

• Do not add the bucket name as the service host.

• Multiple hosts can be added in the Service Host field using commas to separate them. For example servicehost1, servicehost2, servicehost3. (For local cloud servers with multiple IP addresses, the list of IP addresses can be added. For example, 192.xxx.0.100,192.xxx.0.101, 192.xxx.0.102. )

  Note

  All the hosts (or IP addresses) in the list must point to the same storage. Adding a host or IP address to a different storage will result in data loss.

Bucket

Click the Detect button to detect an existing bucket.

Sometimes, existing bucket list may not get populated while detecting the buckets, as some vendors may not support this operation, or if there are no permissions to complete the operation. In such cases, type the name of the existing bucket that you want to use. The system will automatically use the existing bucket if it is available.

Storage Class

The following Amazon S3 storage classes are supported for Commvault Cloud Storage libraries:

• S3 Standard

• S3 Intelligent-Tiering

• S3 Standard-Infrequent Access

• S3 One Zone - Infrequent Access

• S3 Glacier Instant Retrieval

• S3 Glacier Flexible Retrieval

• S3 Glacier Deep Archive

• S3 Reduced Redundancy Storage

Reference https://aws.amazon.com/s3/storage-classes/ for more information.

Use Combined Tier

Enable the option to use a combine storage tier, with S3 Glacier Instant Retrieval, S3 Glacier Flexible Retrieval, or S3 Glacier Deep Archive Storage Classes.

This option will be enabled when S3 Glacier Instant Retrieval, S3 Glacier Flexible Retrieval, or S3 Glacier Deep Archive Storage Class is selected.

Combined Storage Class

The following combined Storage options are available for the Glacier Flexible and Glacier Deep Archive storage classes:

• Intelligent Tiering

• One Zone - Infrequent Access

• Standard

• Standard- Infrequent Access