Create the AWS resources required for cleanroom

For recovery to an AWS cleanroom site, you need a new AWS account, a new virtual network, a new security group, and other resources.

To create the required resources, do the following:

1. Create a new AWS account.

2. Create a new IAM policy using the JSON editor, and paste amazon_restricted_role_permissions.json in the editor.

3. Create a new AWS role and assign the new IAM policy to the new role.

4. Create a new AWS virtual private cloud (VPC) and subnet to logically isolate the recovered VMs/instances.

5. Create a new AWS security group to control access for inbound and outbound traffic for the recovered VMs/instances.

6. For the auto-scaled access nodes create another new virtual private cloud (VPC) and subnet with the following specifications:

   • Connectivity: Establish bidirectional connectivity with your recovered control plane.

   • Port configuration:

     • Open outbound ports 8400 and 8403 for connectivity with your recovered control plane.

     • Open outbound port 443 for Air Gap Protect.

7. Create a security group for the VPC and subnet created in a previous step for the access nodes, to isolate the auto-scaled access nodes.

8. To connect to the recovered instances in the isolated network, configure a bastion host.

   For information, see the following:

   • Access a bastion host by using Session Manager and Amazon EC2 Instance Connect

   • Tutorial: Configuring private network access using a Linux Bastion Host