Veritas Information Map Installation and Administration Guide

To create an AWS IAM policy

1. Log in to the AWS management console using your AWS account credentials.
   
2. In the left-hand pane of the Identity and Access Management (IAM) console, click Policies.
   
3. Click Create Policy to allow the Veritas Cloud Agent to scan the buckets associated with the Amazon S3 account.
   
4. On the Create Policy page, enter AllowS3BucketScan in the Policy Name field.
   
5. Use the policy document as shown below:

   {
   
       "Version": "2012-10-17",
   
       "Statement": [
   
           {
   
               "Effect": "Allow",
   
               "Action": [
   
                   "s3:ListAllMyBuckets",
   
                   "s3:GetBucketLocation",
   
                   "s3:ListBucket"
   
               ],
   
               "Resource": [
   
                   "arn:aws:s3:::*"
   
               ]
   
           }
   
      ]
   
   }
   

   

   The policy document must include ListAllMyBuckets and GetBucketLocation permissions to enable discovery of the buckets. However, you can restrict the permissions to specific buckets within the policy, if required.

   Following is an example of a restricted policy:

   {
   
       "Version": "2012-10-17",
   
       "Statement": [
   
           {
   
               "Effect": "Allow",
   
               "Action": [
   
                   "s3:ListAllMyBuckets",
   
                   "s3:GetBucketLocation"
   
               ],
   
               "Resource": [
   
                   "arn:aws:s3:::*"
   
               ]
   
           },
   
           {
   
               "Effect": "Allow",
   
               "Action": [
   
                   "s3:ListBucket"            
   
       ],
   
               "Resource": [
   
                   "arn:aws:s3:::kwaws-b*",
   
                   "arn:aws:s3:::kwaws-specificbucket"
   
               ]
   
           }
   
      ]
   
   }
   

6. Validate and create the policy.
   

To create a new IAM role

1. In the left-hand pane of the IAM console, click Roles.
   
2. On the Create role page, select the Role for cross-account access and select Provide access between your AWS account and a 3rd party AWS account.
   
3. Establish trust between the two endpoints by entering the Account ID and External ID provided by Veritas. The Veritas account ID is 071997631119.

   Note:

   Ensure that the External ID used when configuring a role is unique and matches with the ID used in Information Map. The External ID is case-sensitive and should be complex such that it cannot be easily guessed.

   Do not select Require MFA.

   
4. Attach the IAM policy created earlier to the newly created role.
   
5. Set the role name as VeritasInformationMapS3Connector, and review the attached policy.
   
6. Navigate to IAM > Roles. In the Summary section, make a note of the Role ARN (Amazon Resource Names) and the external ID. This information is required when configuring access to the Amazon S3 buckets from Information Map.