Configuring Backups for Amazon EC2 Instances for a Single AWS Account with Access Key and Secret Key Authentication

You can configure backups for Amazon EC2 instances for a single AWS account using access key/secret key authentication for dev/test or proof-of-concept environments.

Important

As a best practice, AWS recommends using IAM roles instead of access keys. For more information, see Security best practices in IAM in the AWS documentation.

Start the Configuration Wizard

From the Command Center navigation pane, go to Protect > Virtual machines.

The Virtual machines page appears.
In the upper-right area of the page, click Add Hypervisors.

The Configure Hypervisor page appears.
Select Amazon Web Services.
Click Next.

The Configure permissions page of the Configure Amazon Web Services Account wizard appears.

Configure permissions

Select Use your access nodes for backups.
From the Authentication method list, select Access keys for IAM users (not recommended).
Verify an existing CommvaultUserGroup IAM user group or create a new CommvaultUserGroup IAM user group:
- If the CommvaultUserGroup IAM user group was previously created for another AWS workload, do the following:
  1. Verify that the IAM policies for the AWS workload are still attached to the CommvaultUserGroup IAM user group.
- If the CommvaultUserGroup IAM user group does not exist yet, create it in AWS.
  Steps to create CommvaultUserGroup IAM user group
  1. Click the Launch CloudFormation Stack link to open the AWS console.
    
    Important
    
    If you do not have permission to create a role in the AWS account, copy the Launch CloudFormation Stack link and share it with your AWS IAM administrator.
  2. Log on to the AWS console.
    
    The Quick create stack page appears.
  3. Under Capabilities, read the information about the template, and then select the acknowledgment check box.
  4. Click Create stack.
    
    Wait for the CloudFormation Stack to finish creating the CommvaultUserGroup IAM user group. The CloudFormation Stack creates IAM policies for all supported AWS workloads, and then attaches the policies to CommvaultUserGroup.
  5. Go to the IAM dashboard.
    
    The IAM dashboard page appears.
  6. Select Users, and then click Add users.
    
    The Add user page appears.
  7. Enter a name for the user (for example, CommvaultSvcUser).
  8. Select the Access key - Programmatic access check box.
    
    Commvault does not need AWS Console Access.
    
    This setting creates an access key for each new user.
  9. Click Next to set permissions.
  10. Select Add user to group, and then select the CommvaultUserGroup IAM user group.
  11. Optionally, you can set IAM tags which are key-value pairs you can add to your user.
  12. Click Review to display the user details.
  13. Click Create user.
    
    A message confirms that the user is created successfully. From here, you can download the .csv file and view details about the access and secret key for the new user.
  14. Verify that the IAM policies for the AWS workload are still attached to the CommvaultUserGroup IAM user group.
Click Next.

The Access Nodes page of the configuration wizard appears.

Access Nodes

An access node is required to back up instances without egress charges.

Considerations

If AWS EBS encryption is enabled for your region in your AWS account, the user who uses the access node template must be a key user for the default encryption key. To see if EBS encryption is enabled, in your AWS account, go to EC2 > EC2 Dashboard > Settings > EBS encryption. To see a list of key users for the default encryption key, in your AWS account, go to Key Management Service > Customer managed keys. If you do not have the correct level of access to use the template, you can copy the Launch Cloud Formation Stack link and share it with someone who has the correct level of access, such as your security administrator.
Determine the region of your AWS S3 storage. The access node must reside in the same region as the primary storage.

Commvault software

Important

Enable Authcode on the CommCell or Company where the access node is to be deployed.
If the client is unable to connect to the CommServe, configure a network gateway (firewall proxy) and specify it in the CloudFormationTemplate to deploy the access node.

Commvault SaaS

Not required

Procedure

Select an existing access node or create a new access node.
Steps to create a access node
1. Click the add button .
  
  The Add access node dialog box appears.
2. For Platform, select the OS for the backup gateway.
3. Click Generate link.
  
  An AWS CloudFormation template is created based on the region and the operating system that you selected.
4. Click the Launch CloudFormation Template link to open the AWS console.
  
  Note
  
  If AWS EBS encryption is enabled for your region in your AWS account, to use the template, you must be a key user for the default encryption key. If you are not a key user for the default encryption key, copy the Launch Cloud Formation Template link and share it with someone who is a key user, such as your security administrator.
5. Log on to the AWS console.
  
  The Quick create stack page appears.
6. Under Parameters, specify the following information:
  1. For EC2 Instance Type, select the type of EC2 instance to use for the access node.
  2. For EC2 Key Pair, select a key pair to use to access the Commvault access node.
  3. For VPC ID, select an Amazon Virtual Private Cloud (VPC).
  4. For Subnet ID, select a subnet.
  5. For VPC CIDR, select a VPC CIDR.
  Note
  
  Port 8403 opens on backup gateways only when the request comes from the IP ranges that are listed in the VPC CIDR.
7. Click Create stack.
  
  Wait for the Commvault access node to be created.
8. Return to the Commvault configuration wizard.
9. Refresh the list of access nodes, and then select the access node that you created.
Click Next.

The Add Account page of the configuration wizard appears.

Add Account

In the Name box, enter the hypervisor name.
Under Advanced options, select the specific regional endpoints to protect all the instances in that region. By default, All Public regions is selected.
Click Next.

The Add VM Group page of the configuration wizard appears.

Add VM Group

A VM group is a set of VMs that you want to back up with the same settings. By default, the VM group is associated with all unprotected VMs that are discovered.

You can add content to the VM group by using rules that auto-discover content, by selecting specific instances, and by other ways. When you first create the VM group, you can add an instance that is relatively small, and then later you can update the VM group by adding more content.

In Name, enter a descriptive name for the VM group.
To create rules that auto-discover and select instances to back up, do the following:
1. Click Add, and then select Rule.
  
  The Add rule dialog box appears.
2. From the list, select the type of rule to create, and then specify the rule:
  - Browse: Select specific instances. (Selecting this option changes the Add rule dialog box to the Add content dialog box.)
  - Guest DNS hostname: Select instances based on a hostname or a domain. For example, to select hosts on the "mycompany.com" domain, enter Guest DNS hostname | Ends with | mycompany.com.
  - Guest OS: Select instances based on operating system. For example, to select instances that are not Windows, enter Guest OS | Does not contain | Windows.
  - Instance name or pattern: Select instances based on their names. For example, to select instances that have a name that includes "east", enter Instance name or pattern | Contains | east.
  - Instance type: Select instances based on their type, such as t2.micro or c5.large.
  - Power state: Select instances based on a power status of Running or Stopped.
  - Region: Select instances based on the region that they reside in.
  - Tag name: Select instances based on the names of tags that are assigned to them. Enter the tag name in the region\tag_name format. For example, to select instances in the eastern US region that are for a department, enter Tag name | Equals | us-east-1\department.
  - Tag value: Select instances based on the values of tags that are assigned to them. Enter the tag value in the region\tag_name\tag_value format. For example, to select instances in the eastern US region for the human resources department, enter Tag value | Equals | us-east-1\department\HR.
  - Zone: Select instances based on the zone that they reside in. For example, to select instances that reside in any eastern US zone, enter Zone | Contains | us-east. You can enter the zone value by typing or browsing to select.
3. Click Save.
To select instances in other ways, do the following:
1. Click Add, and then select Content.
  
  The Add content dialog box appears.
2. From the Browse and select VMs list, select one of the following:
  - By region: Select instances based on the region that they reside in.
  - By zone: Select instances based on the zone that they reside in.
  - By tags: Select instances based on tags that are assigned to them.
  - By instance type: Select instances based on their type, such as t2.micro or c5.large.
3. Select the instances to add to the VM group.
4. Click Save.
To see the instances that are selected for the VM group, click the Preview button.
Click Next.

The Plan page of the configuration wizard appears.

Plan

Select an existing backup plan or create a new backup plan. A backup plan specifies the storage to back up the data to and other settings such as recovery point objective (RPO) settings.

To create a backup plan, do the following:

Click the add button .

The Create backup plan dialog box appears.
In Plan name box, enter a descriptive name for the backup plan.
If you have your own storage, move the Bring your own storage toggle key to the right, and then add any of the following storages:
- Air Gap Protect
- Cloud
For Retention rules, select pre-defined settings or create custom settings, and then click Done.
- To select pre-defined settings, under Retention rules, select Standard retention to retain the incremental backups for 1 month.
- To create custom settings, move the Custom plan toggle key to the right, and then specify the following:
  1. For Retention, specify the amount of time to retain the backups.
  2. For Backups run every, specify how often to run backups.
Click Next.

The Summary page of the configuration wizard appears.

Summary

Review the summary.
Click Close.