Configure AWS and Commvault for discovering resources

Complete the following configurations before connecting your AWS account.

AWS configuration

Complete the following configurations in your AWS account before creating a cloud connection.

Configure an access node

Configure an access node in your AWS hosted infrastructure account. For instructions, see Deploying an access node on Amazon EC2.

Important

Before you deploy the access node CloudFormation Stack, the CommvaultAdminRole IAM role must exist in the hosted infrastructure account.
The access node CloudFormation Stack deploys an EC2 instance as the Commvault access node and associates it with the CommvaultAdminRole IAM role.

If the CommvaultAdminRole IAM role does not exist, create it by using the CloudFormation Stack.

Create the CommvaultAdminRole IAM role

Click Launch CloudFormation Stack to deploy the CloudFormation template that creates the CommvaultAdminRole IAM role.

Important

If you do not have permission to create IAM roles, copy the Launch CloudFormation Stack link and provide it to your AWS IAM administrator.
Log on to the AWS console.

The Quick create stack page appears.
Under Capabilities, review the template information, and then select the acknowledgment check box.
Click Create stack.

Wait for the CloudFormation Stack to complete. The stack creates the CommvaultAdminRole IAM role, creates the CommvaultAdminRole-STSAssumePolicy IAM policy, and attaches the policy to the role.
Return to the Commvault configuration wizard.

Create an AWS IAM user for STS AssumeRole authentication

Create the CommvaultAssumeRoleUser IAM user in the hosted infrastructure account, which is the AWS account where the Commvault access node runs.

CommvaultAssumeRoleUser provides the AWS identity that Commvault uses to assume the IAM roles required to discover AWS resources. The user requires only the sts:AssumeRole permission and does not require permissions to access or manage AWS resources directly.

For discovery across an AWS Organization, create CommvaultAssumeRoleUser only in the hosted infrastructure account. Configure the IAM roles in the member accounts to trust the ARN of CommvaultAssumeRoleUser.

To create the IAM user with the sts:AssumeRole permission, do the following:

Open AWS CloudShell for the hosted infrastructure account.

Create the IAM user and attach an inline policy that grants the sts:AssumeRole permission.

aws iam create-user --user-name CommvaultAssumeRoleUser | jq -r '.User.Arn'

aws iam put-user-policy --user-name CommvaultAssumeRoleUser \
    --policy-name AssumeRolePolicy \
    --policy-document '{
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": "sts:AssumeRole",
                "Resource": "*"
            }
        ]
    }'

Create an access key ID and secret access key for the IAM user.
```
aws iam create-access-key --user-name CommvaultAssumeRoleUser | jq -r '.AccessKey'
```
Save the access key ID and secret access key. You use these values when creating AWS credentials in the Commvault Credential Vault.
Obtain the ARN of CommvaultAssumeRoleUser.
```
aws iam get-user --user-name CommvaultAssumeRoleUser | jq -r '.User.Arn'
```
Save the user ARN. You use this value when configuring the AWS Hosted Infrastructure User ARN additional setting.

Commvault configuration

Create credentials for the IAM user

Create credentials in the Credential Vault by using the access key ID and secret access key that you created for CommvaultAssumeRoleUser. For information about creating credentials in the Credential Vault, see Adding a Credential to a Built-in Credential Vault.

Use the following values:

Field	Value / Description
Account Type	Cloud account
Vendor Type	Amazon Web Services
Authentication Type	Access & Secret keys
Credential name	AWS IAM Assume Role TCO Assessment
Access Key ID	The access key ID associated with CommvaultAssumeRoleUser.
Secret Access Key	The secret access key associated with CommvaultAssumeRoleUser.
Description	Enter a description for the credential.

Configure the additional settings

Configure the following additional settings in the Command Center application:

AWS Hosted Infrastructure Role ARN: Specify the ARN of the IAM role associated with the new access node.
AWS Hosted Infrastructure User ARN: Specify the ARN of CommvaultAssumeRoleUser created in the hosted infrastructure account.

For instructions, see Adding a CommCell Setting.

Create a server group

Configure a server group with the access node that you created in the hosted infrastructure account.

For instructions, see Adding a Server Group by Using Manual Association.

Create a resource pool

Create a workload resource pool for the AWS cloud connection. For instructions, see Add a Workload Resource Pool.