Dell EMC PowerProtect DDVE on Amazon Web Services 7.9 Installation and Administration Guide

Set up role-based access to the AWS object store

Object store in AWS uses role-based access for S3 access. To access the S3 bucket, create and attach the Identity and Access Management (IAM) role to DDVE.

"iam:AddRoleToInstanceProfile",
                "iam:AttachRolePolicy",
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:DeleteRolePolicy",
                "iam:DetachRolePolicy",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "iam:ListRolePolicies",
                "iam:ListRoles",
                "iam:PassRole",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:UpdateRolePolicy",
                "iam:CreateInstanceProfile",
                "iam:PutRolePolicy",
                "iam:DeleteInstanceProfile"

1. Create the policy to attach with the IAM role:
   1. Sign in to the AWS Management Console and open the IAM Service Console.
   2. In the navigation pane of the IAM console, select Policies > Create policy.
   3. Do one of the following:
      • Create a policy for AWS Standard Cloud:

        In the Create policy web page, select the JSON tab. Replace the text under the JSON tab with the following content. Replace my-bucket-name with the name of the bucket that you created in Create an S3 bucket.

        {
            "Version": "2012-10-17",
            "Statement": [
               {
                    "Effect": "Allow",
                    "Action": [
                        "s3:ListBucket",
                        "s3:GetObject",
                        "s3:PutObject",
                        "s3:DeleteObject"
                    ],
                    "Resource": [
                        "arn:aws:s3:::my-bucket-name",
                        "arn:aws:s3:::my-bucket-name/*"
                    ]
               }
            ]
        } 
        

      • Create a policy for AWS Gov Cloud:

        In the Create policy web page, select the JSON tab. Replace the text under the JSON tab with the following content. Replace my-bucket-name with the name of the bucket that you created in Create an S3 bucket. For the resource tag below, use arn:aws-us-gov:s3:::my-bucket-name for AWS Gov clouds.

        {
            "Version": "2012-10-17",
            "Statement": [
               {
                    "Effect": "Allow",
                    "Action": [
                        "s3:ListBucket",
                        "s3:GetObject",
                        "s3:PutObject",
                        "s3:DeleteObject"
                    ],
                    "Resource": [
                        "arn:aws-us-gov:s3:::my-bucket-name",
                        "arn:aws-us-gov:s3:::my-bucket-name/*"
                    ]
               }
            ]
        }  
        

   4. Verify this information, and then click Review policy.
   5. Provide a name and description for the policy, and click Create policy.
      

      NOTE Make a note of the policy name. It will be used to attach the policy to the role in the next step.
2. Create the role for S3 bucket access:
   1. In the navigation pane of the IAM console, select Roles > Create role.
   2. On the Create role page:
      1. For Select type of trusted entity, select AWS service.
      2. For Choose the service that will use this role, select EC2, and then click Next Permissions.
   3. On the Attach permissions policies page, select the policy that you created in the previous step. Select Next Tags to create a tag for the role.

      

   4. Click Next:Review. In the Review section, provide a name for the role and click Create role.