Veritas CloudPoint Administrator's Guide
- Getting started with CloudPoint
- Section I. Installing and configuring CloudPoint
- Preparing for installation
- About the deployment approach
- Deciding where to run CloudPoint
- Meeting system requirements
- CloudPoint host sizing recommendations
- Creating an instance or preparing the physical host to install CloudPoint
- Installing Docker
- Creating and mounting a volume to store CloudPoint data
- Verifying that specific ports are open on the instance or physical host
- Deploying CloudPoint
- Deploying CloudPoint in the AWS cloud
- Using plug-ins to discover assets
- Configuring off-host plug-ins
- AWS plug-in configuration notes
- Google Cloud Platform plug-in configuration notes
- Microsoft Azure plug-in configuration notes
- Dell EMC Unity array plug-in configuration notes
- Pure Storage FlashArray plug-in configuration notes
- HPE RMC plug-in configuration notes
- NetApp plug-in configuration notes
- Hitachi plug-in configuration notes
- InfiniBox plug-in configuration notes
- Configuring an off-host plug-in
- About CloudPoint plug-ins and assets discovery
- Configuring the on-host agents and plug-ins
- About agents
- Oracle plug-in configuration notes
- MongoDB plug-in configuration notes
- Microsoft SQL plug-in configuration notes
- About the installation and configuration process
- Preparing to install the Linux-based on-host agent
- Preparing to install the Windows-based on-host agent
- Downloading and installing the on-host agent
- Configuring the Linux-based on-host agent
- Configuring the Windows-based on-host agent
- Configuring the on-host plug-in
- Configuring VSS to store shadow copies on the originating drive
- Protecting assets with CloudPoint's agentless feature
- Preparing for installation
- Section II. Configuring users
- Section III. Protecting and managing data
- User interface basics
- Indexing and classifying your assets
- Protecting your assets with policies
- Tag-based asset protection
- Replicating snapshots for added protection
- About snapshot replication
- About cross-account snapshot replication in the AWS cloud
- Requirements for replicating snapshots
- Cross-account snapshot replication support matrix
- Cross-account snapshot replication limitations
- Configuring replication rules
- Editing a replication rule
- Deleting a replication rule
- Managing your assets
- Creating a snapshot manually
- Displaying asset snapshots
- Replicating a snapshot manually
- About snapshot restore
- About single file restore (granular restore)
- Single file restore requirements and limitations
- Restoring a snapshot
- Additional steps required after restoring disk-level snapshots
- Additional steps required after a SQL Server snapshot restore
- Additional steps required after an Oracle snapshot restore
- Additional steps required after a MongoDB snapshot restore
- Additional steps required after restoring an AWS RDS database instance
- Restoring individual files within a snapshot
- Deleting a snapshot
- Monitoring activities with notifications and the job log
- Protection and disaster recovery
- Section IV. Maintaining CloudPoint
- CloudPoint logging
- Troubleshooting CloudPoint
- Restarting CloudPoint
- Docker may fail to start due to a lack of space
- CloudPoint installation fails if rootfs is not mounted in a shared mode
- Some CloudPoint features do not appear in the user interface
- Off-host plug-in deletion does not automatically remove file system and application assets
- Disk-level snapshot restore fails if the original disk is detached from the instance
- Snapshot restore for encrypted AWS assets may fail
- Error while adding users to CloudPoint
- CloudPoint fails to revert restored snapshots if indexing, classification, or restore operations fail
- SQL snapshot or restore and SFR operations fail if the Windows instance loses connectivity with the CloudPoint host
- Troubleshooting CloudPoint logging
- Swagger UI-based authorization for CloudPoint REST API calls may fail
- Policy retention count is not honored for file system and application assets if there is an issue with the CloudPoint plug-in
- Working with your CloudPoint license
- Managing CloudPoint agents and plug-ins
- Upgrading CloudPoint
- Uninstalling CloudPoint
- Section V. Reference
Snapshot restore for encrypted AWS assets may fail
If the AWS assets that you wish to protect using CloudPoint are encrypted using AWS KMS Customer Managed Keys (CMK), then the CloudPoint restore operations may fail due to access permission errors. The AWS instances that are spawned may go in to a terminated state.
You may see the following error messages in the AWS CloudTrail logs:
"errorCode": "AccessDenied", with the following error message: User: arn:aws:sts::<ID>:assumed-role/<iamrole>/<awsinstance> is not authorized to perform: kms:ReEncryptFrom on resource: <resourcename>"
Waiter InstanceRunning failed: Waiter encountered a terminal failure state
This error occurs because CloudPoint is unable to perform encrypt and decrypt operations on the AWS assets. This happens because the IAM user or role that is provided to CloudPoint does not have the requisite permissions to use the CMKs.
Workaround:
To resolve this issue, do the following:
If using an IAM user for CloudPoint plug-in configuration, ensure that the IAM user is added as a key user of the CMK.
For source account configuration, ensure that the IAM role that is attached to the CloudPoint instance is added as a key user of the CMK.
For cross account configuration, ensure that the IAM role that is assigned to the other AWS account (cross account) is added as a key user of the CMK.
Adding these IAM roles and users as the CMK key users allows them to use the AWS KMS CMK key directly for cryptographic operations on the assets. Refer to the AWS documentation for more details: