AWS Security Token Service Support

24 October 2021

Cohesity can secure AWS S3 External Targets with AWS Security Token Service (STS).

Supported S3 AWS Targets

Cohesity supports the following AWS S3 External Targets with AWS STS:

S3 Intelligent-Tiering
S3 One Zone-IA
S3-Standard
S3-GOV
S3-C2S
S3-IA-Standard
S3-IA-C2S

Configure AWS STS Vault

You can configure the AWS STS vault by using the Cohesity CLI command.

Prerequisites

Before configuring the AWS STS vault, deploy a credentials service by ensuring the following:

The HTTP endpoint is reachable by the Cohesity cluster.
The HTTP endpoint accepts POST API requests.
The HTTP endpoint validates the request body of a POST request and responds with a valid AWS STS token.

The response from the endpoint must generate the JSON output that matches the following syntax:

{
    "Version": 1,
    "AccessKeyId": "an AWS access key",
    "SecretAccessKey": "your AWS secret access key",
    "SessionToken": "the AWS session token for temporary credentials", 
    "Expiration": "ISO8601 timestamp for when the credentials expire"
}

To configure the AWS STS vault:

iris_cli vault create name=<name> vault-type=Amazon usage-type=archival compression-enabled=<true|false> encryption-enabled=<true|false> bucket-name=<name> aws-region=<region> tier-type=Amazon-S3-Standard incremental-enabled=true aws-credential-endpoint=<credential endpoint URL> aws-credential-blob=<path to local file>

To edit the AWS STS vault:

iris_cli vault edit id=<vault ID> aws-credential-endpoint=<credential endpoint URL> aws-credential-blob=<path to local file>

The following table provides the description of the parameters used for creating the AWS STS vault:

Parameter	Type	Description
`name`	string	Name of the vault.
`vault-type`	string	Type of the vault (Amazon).
`usage-type`	string	Usage purpose of the vault (Archival).
`compression-enabled`	bool	Flag to enable or disable the compression.
`encryption-enabled`	bool	Flag to enable or disable the encryption.
`bucket-name`	string	Name of the bucket or container inside the target vault.
`aws-region`	string	AWS region (e.g. us-east-1, us-west-1 etc.) for AWS service account.
`tier-type`	string	Tier of the vault. For the list of supported tier types, see Supported S3 AWS Targets.
`incremental-enabled`	bool	Support incremental archive for archival vaults.
`aws-credential-endpoint`	URL	The endpoint of the credentials service.
`aws-credential-blob`	path	The absolute path of a local file containing the authentication string to send to the credential endpoint.

Dataprotect Documentation