# Configuring Backups for Amazon Redshift Intances with Access Key and Secret Key Authentication

You can configure backups for Amazon Redshift instances using access key/secret key authentication for dev/test or proof-of-concept environments.

Important

As a best practice, AWS recommends using IAM roles instead of access keys. For more information, see Security best practices in IAM in the AWS documentation.

## Start the Configuration Wizard

1. From the Command Center navigation pane, go to Protect > Databases.

   The database overview page appears.

2. In the upper-right area of the page, click Add instance > Cloud database service.

   The Add Cloud DB Instance dialog box appears.

3. Select Amazon Web Services and then click Next.

   The Configure Amazon Database dialog box appears.

4. Select Redshift and then click Next.

   The Configure Permissions page appears.

## Configure Permissions

1. Select Use your access nodes for backups.

2. From the Authentication method list, select Access keys for IAM users (not recommended).

3. Verify an existing CommvaultUserGroup IAM user group or create a new CommvaultUserGroup IAM user group:

   - If the CommvaultUserGroup IAM user group was previously created for another AWS workload, do the following:

     1. Verify that the IAM policies for the AWS workload are still attached to the CommvaultUserGroup IAM user group.

   - If the CommvaultUserGroup IAM user group does not exist yet, create it in AWS.

     Steps to create CommvaultUserGroup IAM user group

     1. Click the Launch CloudFormation Stack link to open the AWS console.

        Important

        If you do not have permission to create a role in the AWS account, copy the Launch CloudFormation Stack link and share it with your AWS IAM administrator.

     2. Log on to the AWS console.

        The Quick create stack page appears.

     3. Under Capabilities, read the information about the template, and then select the acknowledgment check box.

     4. Click Create stack.

        Wait for the CloudFormation Stack to finish creating the CommvaultUserGroup IAM user group. The CloudFormation Stack creates IAM policies for all supported AWS workloads, and then attaches the policies to CommvaultUserGroup.

     5. Go to the IAM dashboard.

        The IAM dashboard page appears.

     6. Select Users, and then click Add users.

        The Add user page appears.

     7. Enter a name for the user (for example, CommvaultCloudSvcUser).

     8. Select the Access key - Programmatic access check box.

        Commvault does not need AWS Console Access.

        This setting creates an access key for each new user.

     9. Click Next to set permissions.

     10. Select Add user to group, and then select the CommvaultUserGroup IAM user group.

     11. Optionally, you can set IAM tags which are key-value pairs you can add to your user.

     12. Click Review to display the user details.

     13. Click Create user.

         A message confirms that the user is created successfully. From here, you can download the .csv file and view details about the access and secret key for the new user.

     14. Verify that the IAM policies for the AWS workload are still attached to the CommvaultUserGroup IAM user group.

4. Under Configure Credential, from the Credentials list, select CommvaultUserGroup credential.

5. Click Next.

   The Access Node page of the configuration wizard appears.

## Access Node

An access node is required to back up instances without egress charges.

### Considerations

- If AWS EBS encryption is enabled for your region in your AWS account, the user who uses the access node template must be a key user for the default encryption key. To see if EBS encryption is enabled, in your AWS account, go to EC2 > EC2 Dashboard > Settings > EBS encryption. To see a list of key users for the default encryption key, in your AWS account, go to Key Management Service > Customer managed keys. If you do not have the correct level of access to use the template, you can copy the Launch Cloud Formation Stack link and share it with someone who has the correct level of access, such as your security administrator.

- Determine the region of your AWS S3 storage. The access node must reside in the same region as the primary storage.

### Procedure

1. Select an existing access node or create a new access node.

   Steps to create an access node

   1. Click the add button .

      The Add a new access node dialog box appears.

   2. For Platform, select the operating system for the access node.

   3. From the Region list, select the region that the instances reside in.

      Only the regions where Commvault Cloud access nodes are present are available to select.

   4. Click Generate link.

      An AWS CloudFormation template is created based on the region and the operating system that you selected.

   5. Click the Launch CloudFormation Template link to open the AWS console.

      Note

      If AWS EBS encryption is enabled for your region in your AWS account, to use the template, you must be a key user for the default encryption key. If you are not a key user for the default encryption key, copy the Launch Cloud Formation Template link and share it with someone who is a key user, such as your security administrator.

   6. Log on to the AWS console.

      The Quick create stack page appears.

   7. Under Parameters, enter the following information:

      1. From the EC2 Instance Type list, select the type of EC2 instance to use for the access node.

      2. From the EC2 Key Pair list, select a key pair to use to access the Commvault access node.

      3. From the VPC ID list, select an Amazon Virtual Private Cloud (VPC).

      4. From the Subnet ID list, select a subnet.

      5. From the VPC CIDR list, select a VPC CIDR.

      Note

      Port 8403 opens on access nodes only when the request comes from the IP ranges that are listed in the VPC CIDR field.

   8. Click Create stack.

      Wait for the Commvault access node to be created.

   9. Return to the Commvault configuration wizard.

   10. Refresh the list of access nodes, and then select the access node that you created.

2. Click Next.

   The Plan page of the configuration wizard appears.

## Plan

A backup plan specifies the storage to back up the data to and other settings such as recovery point objective (RPO) settings.

Note

For export-based backups, select a plan that uses Air Gap Protect AWS S3 storage. The storage and the Redshift cluster must be in the same AWS region.

Commvault software

1. Select an existing backup plan or create a new backup plan.

   Steps to create a backup plan

   1. Click the add button .

      The Add plan dialog box appears.

   2. In the Plan name box, enter a descriptive name for the backup plan.

   3. If you have your own storage, move the Bring your own storage toggle key to the right, and then add any of the following storages:

      - Air Gap Protect

      - Cloud

   4. For the backup plan settings, select pre-defined settings or create custom settings:

      - To select pre-defined settings, under Retention rules, select one of the following:

        - Select 1 month retention plan to retain the incremental backups for 1 month.

        - Select 1 year retention plan to retain the incremental backups for 1 year.

        - Select 3 year retention plan to retain the incremental backups for 3 years.

      - To create custom settings, select Custom plan, and then specify the following:

        - For Retention, specify the amount of time to retain the backup jobs.

        - For Backups run every, specify how often to run backups.

   5. To create a plan with all the advanced options, click the Advanced options click here link, and then create a new plan.

   6. Click Done.

2. Click Next.

   The Cloud Account page of the configuration wizard appears.

Commvault SaaS

1. Select an existing backup plan or create a new backup plan.

   Steps to create a backup plan

   1. Click the add button .

      The Add plan dialog box appears.

   2. In the Plan name box, enter a descriptive name for the backup plan.

   3. If you have your own storage, move the Bring your own storage toggle key to the right, and then add any of the following storages:

      - Air Gap Protect

      - Cloud

   4. For the backup plan settings, select pre-defined settings or create custom settings:

      - To select pre-defined settings, under Retention rules, select one of the following:

        - Select Standard retention to retain the incremental backups for 1 month.

      - To create custom settings, select Custom plan, and then specify the following:

        - For Retention, specify the amount of time to retain the backup jobs.

        - For Backups run every, specify how often to run backups.

   5. Click Done.

2. Click Next.

   The Cloud Account page of the configuration wizard appears.

## Cloud Account

The cloud account is used to access the databases for discovery, backups, and other operations.

1. Select an existing cloud account or create a new cloud account.

   Steps to create a cloud account

   1. Select Add cloud account.

   2. In Name, enter a descriptive name for the account.

   3. Under Advanced options, from the Regional endpoints list, select a region for the endpoint.

   4. Click Save.

2. Click Next.

   The Backup Content page of the configuration wizard appears.

## Backup Content

1. Review the data that will be protected.

2. To enable export-based backups, do the following:

   Note

   After you enable export-based backups, you can't disable them.

   - Move the Enable export based backups toggle key to the right.

   - In Number of data streams, enter the number of data streams to use for backups.

   - From the Database user credentials list, select an existing credential or create a new credential. The user must have access to all entities across all databases in the cluster.

3. Click Next.

   The Summary page appears.

## Summary

1. Review the summary.

2. Click Finish.

×

Loading...