Resources automatically created in your AWS or Commvault account for cleanroom recovery

When you use certain cleanroom options, resources are automatically created in your AWS and/or Commvault account.

Create new options for cleanroom sites

Resources deployed in your cleanroom recovery AWS account

VPC

• Created in the region that's specified in the runbook
• Name: [runbook]-[region]-VPC
• Default VPC CIDR: 10.0.0.0/16 (unless overridden in the runbook configuration)

Subnets

The following subnets are created in the VPC:

Security groups

The following security groups are created in the VPC:

• Workload security group: [runbook]-[region]-Workload-SG
• Endpoint security group: [runbook]-[region]-Endpoint-SG

Workload security group

The following inbound and outbound rules are applied to the workload security group. These rules control traffic within the VPC and allow secure communication between the workload subnet and the endpoint subnet.

Endpoint security group

The following inbound and outbound rules are applied to the endpoint security group. These rules control traffic within the VPC and allow secure communication between the workload subnet and the endpoint subnet.

Endpoints

Endpoints associated with the VPC, endpoint subnet, workload endpoint/gateway endpoint, and endpoint security group are deployed. These endpoints are used for SSM access to workload instances and for log uploads.

Workload route table

• Name: [runbook]-[region]-Workload-Route-Table
• Destination: pl-63a5400a (AWS-managed prefix list), Target: vpce-010ae917bd7b7c164 (VPC endpoint)
• Destination: 10.0.0.0/16 (VPC CIDR block), Target: local

S3 bucket

• Name: [runbook]-[region]-Bucket

IAM role for the recovered resources (workload role)

• Role name: [runbook]-Workload-Role
• Associated with recovered EC2 instances
• Attached permission policy: AmazonSSMManagedInstanceCore
• Trust policy allows the role to be assumed by the EC2 service (ec2.amazonaws.com).
• Post-recovery access: Connect to recovered EC2 instances using AWS Systems Manager Session Manager in the AWS Console (no direct SSH required)

Created in Commvault control plane

The control plane components and supporting infrastructure are created in your Commvault subscription.

Default auto-scaling

When you use default auto-scaling in Commvault, which is recommended in most cases, the following resources are created.

IAM role and permission policies (only with secret access key authentication)

If you use secret access key authentication for a hypervisor, the following role is created in your cleanroom recovery AWS account:

• IAM role: [runbook]-Infra-Role

The role has the following permission policies:

• AmazonSSMManagedInstanceCore
• AmazonSSMPatchAssociation
• S3Policy

Subnets (environment dependent)

The following subnets are created in the VPC according to the environment type:

Route tables (environment dependent)

Route tables are created according to the environment configuration.

Infra route table

• Name: [runbook]-[region]-Infra-Route-Table
• Associated with the Infra subnet (explicit subnet association)
• Routes:
  • Destination: 0.0.0.0/0, Target: NAT gateway
  • Destination: 10.0.0.0/16 (VPC CIDR block), Target: local

Public route table

• Name: [runbook]-[region]-Public-Route-Table
• Routes:
  • Destination: 0.0.0.0/0, Target: Internet gateway
  • Destination: 10.0.0.0/16 (VPC CIDR block), Target: local

Internet gateway and NAT gateway

The following are created in the VPC when required by the environment:

• Internet gateway name: [runbook]-[region]-Infra-IGW
• NAT gateway name: [runbook]-[region]-Infra-NAT

The NAT gateway is created with public connectivity and associated with the Public subnet.

Infra security group (environment dependent)

The following security group is created in the VPC for Infra resources:

• Name: [runbook]-[region]-Infra-SG

Security group rules are created according to the environment type.

Security group rules for dev/test

Security group rules for Commvault SaaS / Gateway

Security group rules for recovered control plane