> Software > Secure > Cleanroom recovery > Cloud-based cleanrooms > Get started > AWS cleanroom sites

Configure an AWS cleanroom site

Configure an AWS cleanroom site to recover to.

Create an AWS account for cleanroom

To configure a cleanroom site, you must create a new AWS account that's only for cleanroom recovery.

Start the add cleanroom site wizard

  1. In the Command Center navigation pane, go to Secure > Cleanroom recovery.

  2. On the Cleanroom sites tab, click Add cleanroom site.

  3. Select Amazon Web Services.

  4. Click Next.

Select deployment type

  1. Choose how to deploy:

    • Use Commvault-provided resources, which provide optimized settings

    • Use your own resources

General page

  1. Enter a name for the cleanroom site.

  2. Select the Availability Zone to recover VMs to.

  3. For Destination hypervisor, leave Create new selected.

  4. If you're a Commvault software customer, select the authentication method to use.

  5. Click the Launch CloudFormation Stack link to open your AWS cleanroom recovery account in the AWS Management Console.

    Note

    If you don't have permission to create a role in the AWS account, copy the Launch CloudFormation Stack link and share it with your AWS IAM administrator.

  6. Log on to the AWS Management Console.

    The Quick create stack page appears.

  7. Under Capabilities, read the information about the template, and then select the acknowledgment check box.

  8. Click Create stack.

    The wizard provides an AWS CloudFormation stack that creates the IAM roles, groups, and related permissions required for cleanroom recovery. Wait for the CloudFormation stack to finish creating the AWS permissions required for cleanroom recovery in your cleanroom AWS account.

    For information about the AWS permission definitions used for cleanroom recovery, see AWS permission files for cleanroom recovery.

  9. After the stack is created, on the Outputs tab in the AWS Management Console, copy the values for ExternalID and IAMRole.

    Return to Commvault, and then create new credentials by using the ExternalID and IAMRole values.

  10. Return to Commvault.

  11. For Credentials, create new credentials using the ExternalID and IAMRole key values.

  12. If you're a Commvault software customer, select an access node.

  13. Acknowledge that you are subscribed to the AWS Marketplace AMIs for deploying access nodes and the application gateway.

  14. Click Next.

Recovery options page

Modify the settings as needed.

  • Instance type: The EC2 instance size used for recovered workloads. When set to Automatic, Commvault selects an instance type based on source configuration and availability.

  • Key pair: The EC2 key pair associated with recovered instances for secure SSH access. If none is selected, no key-based login is configured.

  • IAM role for Amazon EC2: The IAM role attached to recovered EC2 instances, granting permissions to access AWS services such as S3 or CloudWatch.

  • S3 bucket: Storage for scripts and script logs.

  • Network: The virtual private cloud (VPC) into which recovered instances are deployed. You can have Commvault create a new network or select an existing VPC.

  • Security groups: The firewall rules applied to recovered instances, controlling inbound and outbound traffic.

  • Volume type: The Amazon EBS volume type used for attached disks (for example, general purpose SSD). When set to Automatic, Commvault selects the volume type based on source or recommended settings.

  • KMS key: The AWS Key Management Service (KMS) key used to encrypt EBS volumes attached to recovered instances.

  • Tenancy: Specifices whether instances run on shared hardware (default tenancy) or dedicated hardware, based on AWS tenancy settings.

Infrastructure page

Modify the settings as needed.

  • Max access nodes per workload type in a recovery group: The upper limit on the number of access nodes that can be automatically created (scaled) for each workload type in the recovery group.

  • Network: The VPC configuration for new access nodes.

  • Security groups: The security groups attached to new access nodes.

  • Create public IP address: Specifies whether new access nodes are assigned a public IP address.

  • Workload server group: The server group that recovered workload instances are assigned to.

  • Infrastructure server group: The server group for infrastructure components such as access nodes or proxy servers.

  • IAM role for Amazon EC2: The IAM role for new access nodes.

  • Default instance type: The default EC2 instance type of new access nodes.

Advanced options page

Modify the settings as needed.

  • Virtual private cloud: The overall VPC CIDR block for the cleanroom site.

  • Resource: The subnet CIDR range for recovered workload resources.

  • Infrastructure: The subnet CIDR range for infrastructure components such as access nodes.

  • Endpoint subnet: The subnet CIDR range used for VPC endpoints.

  • NAT subnet: The subnet CIDR range used for Network Address Translation (NAT) resources to enable outbound internet access.

  • Security group rules

    • Type: The protocol or traffic type (for example, SSH, HTTPS, custom TCP).

    • Direction: The direction of traffic (inbound or outbound) the rule applies to.

    • Name: The identifier for the security group rule.

    • Source IP range: The allowed source CIDR range for inbound traffic.

    • Destination port range: The port or range of ports allowed by the rule.

Summary page

  1. Review the configuration.

  2. Click Finish.

×

Loading...