To add or change credentials

1. On the left, click Workloads > Cloud.

   In the PaaS tab, the assets that are available to you are displayed. The RDS assets are displayed in the Applications tab.

2. Select the database in the table, then click Manage credentials.
3. Select a Validation host. The validation host must be a RHEL media server having connectivity with the PaaS workload, or a NetBackup Snapshot Manager. If you use a NetBackup Snapshot Manager, a datamover container is added to the Snapshot Manager host.

   You can add existing credentials or create new credentials for the database:

   • To select any existing credentials for the account, select the Select from existing credentials option, select the required credential from the table below, and click Next.

   • To add a new credential for the account, select Add credentials, and click Next. Enter a Credential name, Tag, and Description for the new credential. Under Service credentials:

     • Select Role based database authentication (Applicable for supported database service) to use AWS IAM, Azure System Managed and User Managed authentication.

       • Select IAM database authentication (Applicable for Amazon RDS only) for Amazon RDS assets only, and specify a Database user name.

         See Creating an IAM database username.

         Note:

         If the Snapshot manager is deployed in the cloud with an attached IAM role having the required permission, you must also deploy the media server in the same cloud environment and attach the same IAM role. Otherwise, the backup jobs for the AWS assets fail.

         Note:

         If the media server or NetBackup Snapshot Manager instance has instance metadata service (IMDsv2) enabled, then ensure that the HttpPutResponseHopLimit parameter is set to 2 on the hosting VM. If the value of the HttpPutResponseHopLimit parameter is not set to 2, then the AWS calls to retrieve the metadata from the media server or the NetBackup Snapshot Manager containers created on the VM fail. For more information on the IMDsv2 service, refer to Use IMDSv2 in Amazon documentation.

       • Select Azure System Managed Identity authentication or Azure User Managed Identity authentication as required. Enter the username of the database, and click Next.

         To perform backup and restore operations utilizing managed identity authentication, you must configure AAD admin to the source and target database servers.

         See Creating a system or user-managed identity username.

         Note:

         If the snapshot manager is deployed in the cloud with an attached Managed Identity having the required permissions, attach the same identity to the media server. For AKS and EKS deployments attach the same Managed identity to the VM scale set.

     • Select Password authentication and specify the username and the password for the database server.

       If you are using AWS RDS Oracle, the username must be in the format username@tenantdatabasename for AWS RDS Oracle Multitenant deployment architecture.

       If you are using Azure Cosmos DB for NoSQL:

       • Username is the Account URI that you can find on the Azure portal, at Settings > Keys > URI.

       • Password is the Primary Key or Secondary Key that you can find on the Azure portal, at Settings > Keys > PRIMARY KEY or SECONDARY KEY.

       • Read keys can only take backup. It is recommended to use read-write keys to restore databases.

       If you are using Azure Cosmos DB for MongoDB:

       • Username is the same as the account name that you can find on the Azure portal, at Settings > Connection Strings > USERNAME.

       • Password is the Primary Key or Secondary Key that you can find on the Azure portal, at Settings > Keys > PRIMARY KEY or SECONDARY KEY.

       • Read keys can only take backup. It is recommended to use read-write keys to restore databases.

       Click Next.

   • Add a role that you want to have access to the credential. To add new permissions to a role:

     • Click Add.

     • Select a role.

     • Select the credential permissions that you want the role to have.

     • Click Save.

4. Click Next to finish creating the credential.