About using Amazon IAM roles with NetBackup
An AWS IAM role is an Amazon Web Services (AWS) identity with the permission policy that determine what tasks an identity is authorized to perform. You can use roles to delegate access to users, applications, or the services that normally don't have access to AWS resources. A role is intended to be assumable by anyone who needs it. If a user assumes a role, temporary security credentials are created dynamically and provided to the user.
For example, an application running on the AWS Elastic Compute Cloud (EC2) instances requires the credentials to access the other AWS services like S3 service. With the traditional approach, you provide the fixed credentials access key and secret access key. With IAM roles, temporary credentials are used to connect to the other AWS services.
NetBackup supports the AWS IAM Roles for stream-based backup operations, wherein:
NetBackup uses AWS IAM Role that is attached to the AWS EC2 instances on which media server is configured for all S3 storage communications.
NetBackup fetches the role name and temporary credentials by connecting to the AWS EC2 metadata.
NetBackup master server can be deployed on AWS EC2 instance or on-premises. You must do the required network settings for communication between the master and media server(s).
The NetBackup media server or the CloudCatalyst media server that uses the IAM role to backup data to cloud must be deployed on the AWS EC2 instance.
AWS IAM Role with required permissions must be attached to the NetBackup media server running on the AWS EC2 instance. See Permissions required for Amazon S3 cloud provider user.
Backup data is stored in S3 storage of the same AWS account where the AWS IAM role is created.
NetBackup supports the AWS IAM Role-based authentication for both Amazon and Amazon Gov cloud providers.
You can modify existing cloud storage server (alias) to use AWS IAM role for authentication only using csconfig command.
Use the AWS Management Console to perform IAM Role allocation, modification, and revocation operations. NetBackup does not store any role-specific information.
Ensure that the AWS EC2 instance metadata service is accessible to NetBackup media server. You verify using AWS commands. For example,
To get the role name, run:
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
To get the credentials, run:
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name
For IPv6 only deployments, AWS IAM Role cannot be used because AWS EC2 instance metadata service is supported only for IPv4.
AWS IAM Role is also supported with CloudCatalyst storage server.
The following diagram illustrates the deployment:
As illustrated in the diagram, to use AWS IAM role with NetBackup:
NetBackup master server can be deployed on-premises or in the cloud.
Backup data is stored in S3 storage of the same AWS account where the AWS IAM role is created.
AWS IAM role is attached to AWS EC2 instance on which CloudCatalyst media server is installed.
Note:
When role is attached to AWS EC2 instance that has access to S3 storage, NetBackup user doesn't need to provide any credentials.
Tip: You get better performance, if the NetBackup clients are deployed in cloud.