NetBackup™ Marketplace Deployment on AWS

Last Published:
Product(s): NetBackup & Alta Data Protection (10.2)
  1. NetBackup marketplace deployment on AWS
    1.  
      About Veritas NetBackup Marketplace Deployment on AWS
    2.  
      Before you begin the deployment
    3.  
      Network configuration
  2. Deploying NetBackup on AWS Cloud using the marketplace offer
    1.  
      Deploying NetBackup on AWS Cloud using the marketplace offer
  3. Deployment options (Delivery methods) for NetBackup on AWS cloud
    1.  
      Deployment options (Delivery methods) for NetBackup on AWS cloud
    2.  
      Option 1: Primary server only
    3.  
      Option 2: Media server only
    4.  
      Option 3: Primary and Media servers
    5. Option 4: Snapshot Manager server only
      1. Prerequisites for using the Snapshot Manager template
        1.  
          Configuring AWS permissions for Snapshot Manager
      2.  
        Resources created by the Snapshot Manager template
      3.  
        Snapshot Manager EC2 instance configuration details
      4.  
        Instance failures and Auto Scaling Group behavior
    6.  
      Option 5: Primary, Media, and Snapshot Manager servers
    7.  
      Option 6: Cloud Recovery server only
    8.  
      Option 7: Malware Scanner Only
  4. NetBackup configuration parameters
    1.  
      NetBackup configuration parameters
    2.  
      Instance configuration parameters
    3.  
      VPC and Subnet details for deployment in existing VPC
    4.  
      VPC and Subnet configuration for deployment in new VPC
    5. NetBackup installation parameters for the primary server
      1.  
        IAM role required for the primary server
    6.  
      NetBackup installation parameters for Media server
    7. NetBackup installation parameters for Snapshot Manager Server
      1.  
        IAM role required for Snapshot Manager instance
      2.  
        AWS endpoints used by Snapshot Manager
    8. NetBackup installation parameters for Cloud Recovery Server
      1.  
        IAM role required for Cloud Recovery Server
  5. Encryption enabled NetBackup primary server
    1.  
      Additional steps on CRS if encryption is enabled NetBackup primary server
  6. Accessing the NetBackup servers
    1.  
      How to access the NetBackup servers
  7. Upgrade NetBackup Snapshot Manager from AWS Marketplace
    1.  
      Upgrade NetBackup Snapshot Manager from AWS Marketplace
    2.  
      Perform the following steps to upgrade a Snapshot Manager deployment using a new AWS CloudFormation stack
  8. Troubleshooting section
    1.  
      Troubleshooting
    2.  
      Deployment Logs

IAM role required for Snapshot Manager instance

Table: IAM roles for Snapshot Manager instance

SID

Effect

Action

Resource

EC2AutoScaling

Allow

  • autoscaling:UpdateAutoScalingGroup

  • autoscaling:AttachInstances

*

KMS

Allow

  • kms:ListKeys

  • kms:Encrypt

  • kms:Decrypt

  • kms:ReEncryptTo

  • kms:DescribeKey

  • kms:ListAliases

  • kms:GenerateDataKey

  • kms:GenerateDataKeyWithoutPlaintext

  • kms:ReEncryptFrom

  • kms:CreateGrant

*

RDSBackup

Allow

  • rds:DescribeDBSnapshots

  • rds:DescribeDBClusters

  • rds:DescribeDBClusterSnapshots

  • rds:DeleteDBSnapshot

  • rds:CreateDBSnapshot

  • rds:CreateDBClusterSnapshot

  • rds:ModifyDBSnapshotAttribute

  • rds:DescribeDBSubnetGroups

  • rds:DescribeDBInstances

  • rds:CopyDBSnapshot

  • rds:CopyDBClusterSnapshot

  • rds:DescribeDBSnapshotAttributes

  • rds:DeleteDBClusterSnapshot

  • rds:ListTagsForResource

  • rds:AddTagsToResource

  • rds:DescribeDBClusterParameterGroups

*

RDSRecovery

Allow

  • rds:ModifyDBInstance'

  • rds:ModifyDBClusterSnapshotAttribute'

  • rds:RestoreDBInstanceFromDBSnapshot'

  • rds:ModifyDBCluster

  • rds:RestoreDBClusterFromSnapshot

  • rds:CreateDBInstance

  • rds:RestoreDBClusterToPointInTime'

  • rds:CreateDBSecurityGroup

  • ds:CreateDBCluster

  • rds:RestoreDBInstanceToPointInTime

*

EC2Backup

Allow

  • sts:GetCallerIdentity

  • ec2:CreateSnapshot

  • ec2:DescribeInstances'

  • ec2:DescribeInstanceStatus

  • ec2:ModifySnapshotAttribute

  • ec2:CreateImage

  • ec2:CopyImage

  • ec2:CopySnapshot'

  • ec2:DescribeSnapshots

  • ec2:DescribeVolumeStatus

  • ec2:DescribeVolumes

  • ec2:RegisterImage

  • ec2:DescribeVolumeAttribute

  • ec2:DescribeSubnets

  • ec2:DescribeVpcs

  • ec2:DeregisterImage

  • ec2:DeleteSnapshot

  • ec2:DescribeInstanceAttribute

  • ec2:DescribeRegions

  • ec2:ModifyImageAttribute

  • ec2:DescribeAvailabilityZones

  • ec2:ResetSnapshotAttribute

  • ec2:DescribeHosts

  • ec2:DescribeImages

  • ec2:AssociateAddress

  • ec2:DescribeNetworkInterfaces

  • ec2:DescribeSecurityGroups

  • ec2:AuthorizeSecurityGroupEgress

  • ec2:AuthorizeSecurityGroupIngress

  • ec2:CreateSnapshots

  • ec2:GetEbsEncryptionByDefault

  • ec2:DescribeKeyPairs

  • secretsmanager:GetResourcePolicy

  • secretsmanager:GetSecretValue

  • secretsmanager:DescribeSecret

  • secretsmanager:RestoreSecret

  • secretsmanager:PutSecretValue

  • secretsmanager:DeleteSecret

  • secretsmanager:UpdateSecret

*

EC2Recovery

Allows

  • ec2:RunInstances

  • ec2:AttachNetworkInterface

  • ec2:DetachVolume

  • ec2:AttachVolume

  • ec2:DeleteTags

  • ec2:CreateTags

  • ec2:StartInstances

  • ec2:StopInstances

  • ec2:TerminateInstances

  • ec2:CreateVolume

  • ec2:DeleteVolume

  • ec2:DescribeIamInstanceProfileAssociations

  • ec2:AssociateIamInstanceProfile

  • ec2:DescribeInstanceTypeOfferings

*

SNS

Allow

  • sns:Publish

  • sns:GetTopicAttributes

*

IAM

Allow

  • iam:SimulatePrincipalPolicy

  • iam:ListAccountAliases

*

EBS

Allow

  • ebs:ListSnapshotBlocks

  • ebs:StartSnapshot

*

Route53

Allow

  • route53:CreateHostedZone

  • route53:ListHostedZones

  • route53:GetHostedZone

  • route53:ListResourceRecordSets

  • route53:ChangeResourceRecordSets

  • route53:ListResourceRecordSets

  • route53:ListHostedZonesByName

*