> CommCell Console > Backup and Restore Agents > Virtualization > Virtual Server Agent > Amazon EC2 > Deployment > JSON Templates for IAM Role Definition and User Permissions

Creating a Role with Restricted Access

To restrict access to AWS resources for Commvault operations, you can create a policy that restricts access to resources that are created and used by Commvault.

You can associate the policy with an Amazon EC2 hypervisor (Commvault virtualization client) using one of the following methods:

  • Create an IAM role that uses the policy, and attach the role to an Amazon EC2 instance that is configured as an access node for the hypervisor. With this method, choose the IAM Role option for authentication when you configure the hypervisor in Commvault, and specify access nodes that have the IAM role attached.

  • Attach the restricted policy to users or user groups. With this method, choose the Access and Secret Key option for authentication when you configure the hypervisor in Commvault, and then enter the access key and secret key associated with a user who has the restricted policy attached.

  • Create an STS role that uses the restricted policy. With this method, choose the STS assume role with IAM role option for authentication when you configure the hypervisor in Commvault, specify access nodes that have the IAM role attached, and then enter the STS assume role associated with the restricted policy attached.

You can use this restricted role for operations performed from the Command Center or from the CommCell Console.

You can perform the following operations using a role with restricted access:

  • Streaming backups

  • All supported restore operations from streaming backups

  • IntelliSnap backups

  • All supported restore operations from IntelliSnap backups

  • Operations that are performed by a tenant user in a managed services environment, using resources that are configured in a separate Admin account

  • Cross-hypervisor restores (VM conversion) and auto recovery from VMware to Amazon EC2

  • Auto recovery from Amazon EC2 to Amazon EC2

The primary policy restricts deletion of EBS volumes and snapshots, and detachment of EBS volumes, to resources with the _GX_BACKUP_ tag. Instance termination is permitted for instances with either the _GX_BACKUP_ tag or the CV_Integrity_Snap tag. These restrictions do not apply to every action in the policy.

The TagDeletion statement permits deletion of the following tag keys: CV_Integrity_Snap, CV_Retain_Snap, Description, Name, _GX_AMI_, _GX_BACKUP_, commvault:vendor, and commvault:createdBy.

During a backup operation, the tags on the source volumes are inherited by the intermediate resources such as volumes and snapshots.

The restrictions apply to the following Amazon EC2 operations:

  • DeleteVolume

  • DeleteSnapshot

  • TerminateInstances

  • DeleteTags

  • DetachVolume

Procedure

  1. Download the aws-ec2-policy.json policy file.

    For JSON files for other AWS services, see IAM Policies for Protecting AWS Services.

  2. Assign the policy to an IAM user or IAM role that is used for authentication of the Amazon hypervisor (Commvault virtualization client).

    If your features require additional permissions, attach aws-ec2-policy-extended.json as a separate IAM policy to the same identity.

For more information about IAM policies, see Policies and permissions in IAM on the AWS documentation site.

Page contents

×

Loading...