Configuring Backups for Amazon DynamoDB Instances with STS Assume Role Authentication

You can configure backups for Amazon DynamoDB using STS assume role authentication. First, configure the AWS admin account in Metallic. Then, configure the AWS tenant accounts.

Configure the AWS Admin Account

Start the Configuration Wizard

1. From the Command Center navigation pane, go to Protect > Databases.

   The Instances page appears.

2. In the upper-right area of the page, click Add instance, and then select Cloud database service.

   The Add Cloud DB Instance page appears.

3. Select Amazon Web Services.

4. Click Next.

   The Configure Amazon Database page appears.

5. Select DynamoDB.

6. Click Next.

   The Backup Method page appears.

7. Review the information.

8. Click Next.

   The IAM Role page of the configuration wizard appears.

IAM Role

1. From the Authentication method list, select STS assume role with IAM policy.

2. Verify an existing MetallicAdminRole IAM role or create a new MetallicAdminRole IAM role in the AWS admin account:

   • If the MetallicAdminRole IAM role was previously created for another AWS workload, do the following:

     1. Verify that the MetallicAdminRole-STSAssumePolicy IAM policy for the AWS workload is attached to the MetallicAdminRole IAM role.

     2. At the bottom of the page, select the confirmation check box.

     3. Click Next.

        The Region page of the configuration wizard appears.

   • If the MetallicAdminRole IAM role does not exist yet, create it in AWS.

     Steps to create MetallicAdminRole IAM role

     1. Click the Launch CloudFormation Stack link to open the AWS console for the AWS admin account.

        Important: If you do not have permission to create a role in the AWS account, copy the Launch CloudFormation Stack link and share it with your AWS IAM administrator.

     2. Log on to the AWS console.

        The Quick create stack page appears.

     3. Under Capabilities, read the information about the template, and then select the acknowledgment check box.

     4. Click Create stack.

        Wait for the CloudFormation Stack to finish creating the MetallicAdminRole IAM role. The CloudFormation Stack creates an IAM policy called MetallicAdminRole-STSAssumePolicy for STS Assume Role authentication, and then attaches the policy to MetallicAdminRole.

     5. Return to the Metallic configuration wizard.

3. From the Authentication method list, select IAM role.

4. Verify an existing MetallicRole IAM role or create a new MetallicRole IAM role:

   • If the MetallicRole IAM role was previously created for another AWS workload, do the following:

     1. Verify that the IAM policies for the AWS workload are still attached to the MetallicRole IAM role.

     2. At the bottom of the page, select the confirmation check box.

     3. Click Next.

        The Region page of the configuration wizard appears.

   • If the MetallicRole IAM role does not exist yet, create it in AWS.

     Steps to create MetallicRole IAM role

     1. Click the Launch CloudFormation Stack link to open the AWS console for the AWS tenant account.

        Important: If you do not have permission to create a role in the AWS account, copy the Launch CloudFormation Stack link and share it with your AWS IAM administrator.

     2. Log on to the AWS console.

        The Quick create stack page appears.

     3. Under Capabilities, read the information about the template, and then select the acknowledgment check box.

     4. Click Create stack.

        Wait for the CloudFormation Stack to finish creating the MetallicRole IAM Role. The CloudFormation Stack creates IAM policies for all supported AWS workloads, and then attaches the policies to MetallicRole.

     5. Go to IAM, select the IAM Role, and then edit the Trust relationship.

     6. Add the ARN of the MetallicAdminRole in the AWS admin account.

         {
        
            "Version": "2012-10-17",
        
            "Statement": [
        
                {
        
                    "Effect": "Allow",
        
                    "Principal": {
        
                        "AWS": "arn:aws:iam::111111111111:role/Metallic/MetallicAdminRole",
        
                        "Service": "ec2.amazonaws.com"
        
                    },
        
                    "Action": "sts:AssumeRole"
        
                }
        
            ]}

     7. Return to the Metallic configuration wizard.

     8. From the Authentication method list, select STS assume role with IAM policy.

     9. At the bottom of the page, select the confirmation check box.

     10. Click Next.

         The Region page of the configuration wizard appears.

Region

1. Select the region that the databases reside in.

   MSP admins and MSP tenants must be in the same region.

2. Click Next.

   The Backup Gateway page of the configuration wizard appears.

Backup Gateway

Because this is a cross-account environment, if you create a new backup gateway, install it in an AWS admin account.

• If AWS EBS encryption is enabled for your region in your AWS account, the user who uses the backup gateway template must be a key user for the default encryption key. To see if EBS encryption is enabled, in your AWS account, go to EC2 > EC2 Dashboard > Settings > EBS encryption. To see a list of key users for the default encryption key, in your AWS account, go to Key Management Service > Customer managed keys. If you do not have the correct level of access to use the template, you can copy the Launch Cloud Formation Stack link and share it with someone who has the correct level of access, such as your security administrator.

• Determine the region of your AWS S3 storage. The backup gateway must reside in the same region as the primary storage.

1. Select an existing backup gateway or create a new backup gateway.

   Steps to create a backup gateway

   1. Click the add button .

      The Add a new backup gateway dialog box appears.

   2. For Platform, select the OS for the backup gateway.

   3. Click Generate link.

      An AWS CloudFormation template is created based on the region and the operating system that you selected.

   4. Click the Launch CloudFormation Template link to open the AWS console.

      Note: If AWS EBS encryption is enabled for your region in your AWS account, to use the template, you must be a key user for the default encryption key. If you are not a key user for the default encryption key, copy the Launch Cloud Formation Template link and share it with someone who is a key user, such as your security administrator.

   5. Log on to the AWS console.

      The Quick create stack page appears.

   6. Under Parameters, enter the following information:

      1. From the EC2 Instance Type list, select the type of EC2 instance to use for the backup gateway.

      1. From the EC2 Key Pair list, select a key pair to use to access the Metallic backup gateway.

      1. From the VPC ID list, select an Amazon Virtual Private Cloud (VPC).

      1. From the Subnet ID list, select a subnet.

      1. From the VPC CIDR list, select a VPC CIDR.

      Note: Port 8403 opens on backup gateways only when the request comes from the IP ranges that are listed in the VPC CIDR field.

   7. Click Create stack.

      Wait for the Metallic backup gateway to be created.

   8. Return to the Metallic configuration wizard.

   9. Refresh the list of backup gateways, and then select the backup gateway that you created.

2. Click Next.

   The Cloud Storage page of the configuration wizard appears.

Cloud Storage

To review the supported combinations of primary and secondary storage, see Metallic Storage Options.

Primary Copy

1. For the primary copy of the backup data, select an existing S3 storage bucket or create a new S3 storage bucket.

   Steps to create an S3 storage bucket

   1. Click the add button .

      The Add cloud storage dialog box appears.

   2. In Name, enter a descriptive name for the cloud storage.

   3. For Authentication, select the authentication type that you want to use.

      Access keys and secret keys: Enter the access key ID and the secret access key.

      STS assume role with IAM role: Enter the ARN of the MetallicRole.

   4. In Bucket, enter the Amazon S3 bucket name.

   5. For Storage Class, select the storage class for the type of access that you want to have for the data.

   6. Click Save.

2. Click Next.

Secondary Copy

1. Decide whether to store a secondary copy of the backup data for long-term retention.

   Steps to create a secondary copy

   1. Move the Secondary copy toggle key to the right.

   2. For Storage location, select an existing storage location or create a new storage location.

      To create a storage location, do the following:

      1. Click the add button .

         The Add cloud storage dialog box appears.

      2. From Type, select the storage provider, and then enter the necessary values.

         Storage provider	Values
         Metallic Recovery Reserve	Cloud storage provider: Select Azure Blob Storage or OCI Object Storage. Storage class: Select the storage class for the type of access that you want to have for the data. Region: Select the region for the cloud storage.
         Amazon S3	Name: Enter a descriptive name for the cloud storage. Region: Select the region for the cloud storage. Authentication: Select the authentication type that you want to use. - Access keys and secret keys: Enter the access key ID and the secret access key. - STS assume role with IAM role: Enter the ARN of MetallicRole. Bucket: Enter the name of the bucket. Storage class: Select the storage class for the type of access that you want to have for the data.

      3. Click Save.

2. Click Next.

   The Plan page of the configuration wizard appears.

Plan

A plan specifies the storage to back up the data to and other settings such as recovery point objective (RPO) settings.

1. Select an existing plan or create a new plan.

   Steps to create a plan

   1. Click the add button .

      The Add plan dialog box appears.

   2. In the Plan name box, enter a descriptive name for the plan.

   3. For the plan settings, select pre-defined settings or create custom settings:

      • To select pre-defined settings, under Retention rules, select one if the following:

        • Select Standard retention to retain the incremental backups for 1 month.

        • Select Extended retention for optimized storage where the incremental backups of primary and secondary copies are retained for 1 month, and extended retention for monthly and yearly full backups.

          Note: The Extended retention option is available only when the secondary copy backup is selected.

      • To create custom settings, select Custom plan, and then specify the following:

        • For Snapshot retention, specify the number of snapshots to retain for IntelliSnap backups.

        • For Retention, specify the amount of time to retain the backups.

        • For Backups run every, specify how often to run backups.

   4. Click Done.

2. Click Next.

   The Cloud Account page of the configuration wizard appears.

Cloud Account

The cloud account is used to access the instances for discovery, backups, and other operations.

1. Create a cloud account.

   Steps to create a cloud account

   1. Select Add a new cloud account.

   2. In Cloud account name, enter a descriptive name for the account.

   3. Select or create credentials that have the ARN of MetallicRole in the AWS tenant account.

      To create credentials, do the following:

      1. Click the add button .

      The Add credential dialog box appears.

      1. In Credential name, enter a descriptive name for the credentials.

      1. In Role ARN, enter the ARN of MetallicRole in the tenant AWS account.

      1. In Description, enter a description of the credentials.

      2. Click Save.

2. Click Next.

   The Add VM Group page of the configuration wizard appears.

Backup Content

• Click Next.

  The Summary page of the configuration wizard appears.

Summary

1. Review the summary.

2. Click Finish.

Configure the AWS Tenant Account

Start the Configuration Wizard

1. From the Command Center navigation pane, go to Protect > Databases.

   The Instances page appears.

2. In the upper-right area of the page, click Add instance, and then select Cloud database service.

   The Add Cloud DB Instance page appears.

3. Select Amazon Web Services.

4. Click Next.

   The Configure Amazon Database page appears.

5. Select DynamoDB.

6. Click Next.

   The Backup Method page appears.

7. Review the information.

8. Click Next.

   The IAM Role page of the configuration wizard appears.

IAM Role

1. From the Authentication method list, select IAM Role.

2. Verify an existing MetallicRole IAM role or create a new MetallicRole IAM role in the AWS tenant account:

   • If the MetallicRole IAM role was previously created for another AWS workload, do the following:

     1. Verify that the IAM policies for the AWS workload is attached to the MetallicRole IAM role.

     2. Verify that the trust relationship is set with the MetallicAdminRole IAM Role in the AWS admin account.

     3. At the bottom of the page, select the confirmation check box.

     4. Click Next.

        The Region page of the configuration wizard appears.

   • If the MetallicRole IAM role does not exist yet, create it in AWS.

     Steps to create MetallicRole IAM role

     1. Click the Launch CloudFormation Stack link to open the AWS console for the AWS tenant account.

        Important: If you do not have permission to create a role in the AWS account, copy the Launch CloudFormation Stack link and share it with your AWS IAM administrator.

     2. Log on to the AWS console.

        The Quick create stack page appears.

     3. Under Capabilities, read the information about the template, and then select the acknowledgment check box.

     4. Click Create stack.

        Wait for the CloudFormation Stack to finish creating the MetallicRole IAM Role. The CloudFormation Stack creates IAM policies for all supported AWS workloads, and then attaches the policies to MetallicRole.

     5. Go to IAM, select the IAM Role, and then edit the Trust relationship.

     6. Add the ARN of the MetallicAdminRole in the AWS admin account.

         {
        
            "Version": "2012-10-17",
        
            "Statement": [
        
                {
        
                    "Effect": "Allow",
        
                    "Principal": {
        
                        "AWS": "arn:aws:iam::111111111111:role/Metallic/MetallicAdminRole",
        
                        "Service": "ec2.amazonaws.com"
        
                    },
        
                    "Action": "sts:AssumeRole"
        
                }
        
            ]}

     7. Return to the Metallic configuration wizard.

     8. From the Authentication method list, select STS assume role with IAM policy.

     9. At the bottom of the page, select the confirmation check box.

     10. Click Next.

         The Region page of the configuration wizard appears.

Region

1. Select the region that the databases reside in.

   MSP admins and MSP tenants must be in the same region.

2. Click Next.

   The Backup Gateway page of the configuration wizard appears.

Backup Gateway

1. Select the backup gateway that was created when the AWS admin account was configured.

2. Click Next.

   The Cloud Storage page of the configuration wizard appears.

Cloud Storage

1. Select the Amazon S3 storage bucket that was created when the AWS admin account was configured.

2. Click Next.

   The Plan page of the configuration wizard appears.

Plan

1. Select the plan that was created when the AWS admin account was configured.

2. Click Next.

   The Cloud Account page of the configuration wizard appears.

Cloud Account

1. Create a new cloud account.

   Steps to create a cloud account

   1. Click the add button .

      The Add cloud account dialog box appears.

   2. In Cloud account name, enter a descriptive name for the account.

   3. Click Save.

2. Click Next.

   The Backup Content page of the configuration wizard appears.

Backup Content

1. Review the list of instances that will be protected.

2. Click Next.

   The Summary page of the configuration wizard appears.

Summary

1. Review the summary.

2. Click Finish.