Veritas CloudPoint Administrator's Guide
- Getting started with CloudPoint
- Section I. Installing and configuring CloudPoint
- Preparing for installation
- Deploying CloudPoint
- Deploying CloudPoint in the AWS cloud
- Using plug-ins to discover assets
- Configuring off-host plug-ins
- AWS plug-in configuration notes
- Google Cloud Platform plug-in configuration notes
- Microsoft Azure plug-in configuration notes
- HPE RMC plug-in configuration notes
- NetApp plug-in configuration notes
- About CloudPoint plug-ins and assets discovery
- Configuring the on-host agents and plug-ins
- Oracle plug-in configuration notes
- Protecting assets with CloudPoint's agentless feature
- Preparing for installation
- Section II. Configuring users
- Section III. Protecting and managing data
- User interface basics
- Indexing and classifying your assets
- Protecting your assets with policies
- Tag-based asset protection
- Replicating snapshots for added protection
- Managing your assets
- About snapshot restore
- Single file restore requirements and limitations
- Additional steps required after a SQL Server snapshot restore
- Monitoring activities with notifications and the job log
- Protection and disaster recovery
- Section IV. Maintaining CloudPoint
- CloudPoint logging
- Troubleshooting CloudPoint
- Working with your CloudPoint license
- Upgrading CloudPoint
- Uninstalling CloudPoint
- Section V. Reference
AWS plug-in configuration notes
The Amazon Web Services (AWS) plug-in lets you create, restore, and delete snapshots of the following assets in an Amazon cloud:
Elastic Compute Cloud (EC2) instances
Elastic Block Store (EBS) volumes
Amazon Relational Database Service (RDS) instances
Aurora clusters
Note:
Before you configure the AWS plug-in, make sure that you have configured the proper permissions so CloudPoint can work with your AWS assets.
The following information is required for configuring the CloudPoint plug-in for AWS:
If CloudPoint is deployed on a on-premise host or a virtual machine:
Table: AWS plug-in configuration parameters
CloudPoint configuration parameter | AWS equivalent term and description |
---|---|
Access key | The access key ID, when specified with the secret access key, authorizes CloudPoint to interact with the AWS APIs. |
Secret key | The secret access key. |
Regions | One or more AWS regions in which to discover cloud assets. |
Note:
CloudPoint encrypts credentials using AES-256 encryption.
If CloudPoint is deployed in the AWS cloud:
Table: AWS plug-in configuration parameters: cloud deployment
CloudPoint configuration parameter | Description |
---|---|
For Source Account configuration | |
Regions | One or more AWS regions associated with the AWS source account in which to discover cloud assets. Note: If you deploy CloudPoint using the CloudFormation template (CFT), then the source account is automatically configured as part of the template-based deployment workflow. |
For Cross Account configuration | |
Account ID | The account ID of the other AWS account (cross account) whose assets you wish to protect using the CloudPoint instance configured in the Source Account. |
Role Name | The IAM role that is attached to the other AWS account (cross account). |
Regions | One or more AWS regions associated with the AWS cross account in which to discover cloud assets. |
When CloudPoint connects to AWS, it uses the following endpoints. You can use this information to create a whitelist on your firewall.
ec2.*.amazonaws.com
sts.amazonaws.com
rds.*.amazonaws.com
kms. *.amazonaws.com
In addition, you must specify the following resources and actions:
ec2.SecurityGroup.*
ec2.Subnet.*
ec2.Vpc.*
ec2.createInstance
ec2.runInstances
Before you configure the plug-in, consider the following:
You cannot delete automated snapshots of RDS instances and Aurora clusters through CloudPoint.
You cannot take application-consistent snapshots of AWS RDS instances. Even though the CloudPoint UI allows you to create an application-consistent snapshot for such an instance, the actual snapshot that gets created is not application-consistent.
This is a limitation from AWS and is currently outside the scope of CloudPoint.
All automated snapshot names start with the pattern
rds:
.CloudPoint does not support AWS Nitro-based instances that use EBS volumes that are exposed as non-volatile memory express (NVMe) devices. You will not be able to use CloudPoint to connect to and configure the AWS plug-in on such instances.
CloudPoint does not support cross-account replication for AWS RDS instances or clusters, if the snapshots are encrypted using the default RDS encryption key (aws/rds). You cannot share such encrypted snapshots between AWS accounts.
If you try to replicate such snapshots between AWS accounts, the operation fails with the following error:
Replication failed The source snapshot KMS key [<key>] does not exist, is not enabled or you do not have permissions to access it.
This is a limitation from AWS and is currently outside the scope of CloudPoint.
If a region is removed from the AWS plug-in configuration, then all the discovered assets from that region are also removed from the CloudPoint assets database. If there are any active snapshots that are associated with the assets that get removed, then you may not be able perform any operations on those snapshots.
Once you add that region back into the plug-in configuration, CloudPoint discovers all the assets again and you can resume operations on the associated snapshots.
If you are creating multiple configurations for the same plug-in, ensure that they manage different regions. Two or more plug-in configurations should not manage the same set of cloud assets simultaneously.
CloudPoint currently does not block you from creating such a configuration. If there is an overlap of cloud assets between plug-in configurations, you may have to resolve the configuration issue by deleting the plug-in configurations and adding them again, ensuring that there are no overlapping assets.
However, CloudPoint does not allow you to delete a plug-in configuration if there are any snapshots associated with the assets in that configuration.
More Information