> CommCell Console > Storage > Libraries > Cloud Storage > Customizing Cloud Storage for an Environment

Configure EC2 IAM role details for AWS STS Assume Role

Configure the EC2 IAM role before you configure a cloud storage library that uses the AWS STS Assume Role with IAM Role Policy authentication method.

For information about configuring the storage library, see AWS STS Assume Role with IAM Role Policy.

Cross-account architecture

In a cross-account configuration:

  • Account A hosts the EC2 instance where the Commvault MediaAgent runs.

  • Account B owns the Amazon S3 bucket.

The EC2 IAM role in Account A assumes an IAM role in Account B. AWS Security Token Service (STS) returns temporary security credentials that the MediaAgent uses to access the Amazon S3 bucket.

Procedure

  1. Create an EC2 IAM role in Account A.

    For example, create DemoEC2Role.

    Attach a policy that allows the role to call sts:AssumeRole on the S3 access role in Account B.

    For an example policy, see the sample JSON file.

  2. Attach the EC2 IAM role to the EC2 instance that hosts the MediaAgent.

  3. Create an S3 access IAM role in Account B.

For example, create DemoS3Role.

Assign the Amazon S3 permissions that are required for your backup and restore operations.

For an example policy, see the sample JSON file.

  1. Configure the trust relationship for the S3 access role.

Edit the trust policy for the S3 role so that it trusts the EC2 IAM role from Account A.

For an example trust policy, see the sample JSON file.

  1. Copy the ARN of the S3 access role.

For example:

arn:aws:iam::222222222222:role/DemoS3Role

  1. Configure the storage library in Commvault.

  2. Select AWS STS Assume Role with IAM Role Policy as the authentication method.

  3. Enter the ARN of the S3 access role.

Authentication flow

The authentication process works as follows:

  1. The MediaAgent runs on an EC2 instance with the EC2 IAM role attached.

  2. The MediaAgent calls AWS STS AssumeRole to request temporary credentials for the S3 access role.

  3. AWS verifies the following:

  4. The EC2 IAM role has permission to call sts:AssumeRole on the S3 access role.

  5. The S3 access role trusts the EC2 IAM role through its trust policy.

  6. AWS STS returns temporary security credentials.

  7. The MediaAgent uses the temporary credentials to perform backup and restore operations on the Amazon S3 bucket.

For links to the sample JSON files, see IAM Policies for Protecting AWS Services.

×

Loading...