About using Amazon IAM roles with NetBackup
An AWS IAM role is an Amazon Web Services (AWS) identity with the permission policy that determines what tasks an identity is authorized to perform. You can use roles to delegate access to users, applications, or the services that normally don't have access to AWS resources. A role is intended to be assumable by anyone who needs it. If a user assumes a role, temporary security credentials are created dynamically and provided to the user.
For example, an application running on the AWS Elastic Compute Cloud (EC2) instances requires the credentials to access the other AWS services like S3 service. With the traditional approach, you provide the fixed credentials access key and secret access key. With IAM roles, temporary credentials are used to connect to the other AWS services.
NetBackup supports the AWS IAM Roles for stream-based backup operations, wherein:
NetBackup uses AWS IAM Role that is attached to the AWS EC2 instances on which media server is configured for all S3 storage communications.
NetBackup fetches the role name and temporary credentials by connecting to the AWS EC2 metadata.
NetBackup primary server can be deployed on AWS EC2 instance or on-premises. You must do the required network settings for communication between the primary and the media servers.
TheNetBackup media server that uses the IAM role to backup data to cloud must be deployed on the AWS EC2 instance.
AWS IAM Role with required permissions must be attached to the NetBackup media server running on the AWS EC2 instance. See Permissions required for Amazon S3 cloud provider user.
Backup data is stored in S3 storage of the same AWS account where the AWS IAM role is created.
NetBackup supports the AWS IAM Role-based authentication for both Amazon and Amazon Gov cloud providers.
You can modify existing cloud storage server (alias) to use AWS IAM role for authentication only using the csconfig command.
Use the AWS Management Console to perform IAM Role allocation, modification, and revocation operations. NetBackup does not store any role-specific information.
Ensure that the AWS EC2 instance metadata service (IMDS) is accessible to NetBackup media server. You can verify it using the AWS commands.
You can access instance metadata from a running instance by using IMDSv1 or IMDSv2.
Note:
MSDP cloud storage supports IMDSv2. Amazon S3 cloud connector does not support IMDSv2.
IMDSv2 adds defense against open firewalls, reverse proxies, and SSRF vulnerabilities with enhancements to the EC2 instance metadata service. We recommend that you use IMDSv2. For more information see, AWS documentation.
To configure your instance using IMDSv2, see Configure the instance metadata options.
For example,
To get the role name, run:
TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` && curl -H "X-aws-ec2-metadata-token: $TOKEN" -v http://169.254.169.254/latest/meta-data/iam/security-credentials/
To get the credentials, run:
TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` && curl -H "X-aws-ec2-metadata-token: $TOKEN" -v http://169.254.169.254/latest/meta-data/iam/security-credentials/role-namerole-name
For IPv6 only deployments, AWS IAM Role cannot be used because AWS EC2 instance metadata service is supported only for IPv4.
AWS IAM Role is also supported with the MSDP direct cloud tiering storage server.
The following diagram illustrates the deployment:
As the diagram illustrates, to use AWS IAM role with NetBackup:
NetBackup primary server can be deployed on-premises or in the cloud.
Backup data is stored in S3 storage of the same AWS account where the AWS IAM role is created.
AWS IAM role is attached to AWS EC2 instance on which the media server is running.
Note:
When role is attached to AWS EC2 instance that has access to S3 storage, NetBackup user doesn't need to provide any credentials.
Tip: You get better performance, if the NetBackup clients are deployed in cloud.