Creating cross account access in AWS
If you have multiple AWS accounts in your environment, and NetBackup deployed in one account, can protect data in other accounts as well. You need to configure cross account data access in AWS portal, before selecting as your access method. NetBackup only needs the access key, secret key, and role ARN.
Follow the guidelines in AWS documentation for creating cross account access. Briefly, you need to perform the following steps.
To configure AWS cross accounts:
- Log on to the AWS provider portal.
- Create a new IAM role in the target AWS account, which you want to protect.
- Create a new policy for the IAM role and ensure that it has required permissions to access the bucket and objects in that target AWS account. See Permissions required for Amazon S3 cloud provider user.
- Establish a trust relationship between the source and the target AWS accounts.
- In the source AWS account, create a policy that allows the IAM role in the source AWS account, to assume the IAM role in the target AWS account.
- Attach the policy to the source account user, whose access key and secret access key you use for the assume role.