Configure EC2 IAM role details for AWS STS Assume Role

Configure the EC2 IAM role before you configure a cloud storage library that uses the AWS STS Assume Role with IAM Role Policy authentication method.

For information about configuring the storage library, see AWS STS Assume Role with IAM Role Policy.

Cross-account architecture

In a cross-account configuration:

Account A hosts the EC2 instance where the Commvault MediaAgent runs.
Account B owns the Amazon S3 bucket.

The EC2 instance in Account A uses its attached IAM role to assume an IAM role in Account B. AWS Security Token Service (STS) returns temporary security credentials that the MediaAgent uses to access the Amazon S3 bucket.

The examples in this procedure use the following values:

Item	Example
Account A	`111111111111`
Account B	`222222222222`
EC2 IAM role	`DemoEC2Role`
S3 access IAM role	`DemoS3Role`

Configure the IAM roles

Create the EC2 IAM role in Account A

Create an IAM role in Account A.

For example, create DemoEC2Role.

Attach a permissions policy that allows the EC2 IAM role to call sts:AssumeRole on the S3 access role in Account B.

For example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::222222222222:role/DemoS3Role"
    }
  ]
}

Attach the EC2 IAM role to the EC2 instance that hosts the MediaAgent.

Create the S3 access role in Account B

Create an IAM role in Account B.

For example, create DemoS3Role.

Assign the Amazon S3 permissions required for your backup and restore operations.

The following example allows the role to list the bucket and create, retrieve, and delete objects:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::demo-backup-bucket"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::demo-backup-bucket/*"
    }
  ]
}

Adjust the permissions for your backup and restore operations.

Configure the trust relationship in Account B

Edit the trust policy for the S3 access role so that it trusts the EC2 IAM role in Account A.

For example, configure the following trust policy for DemoS3Role:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:role/DemoEC2Role"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

This trust relationship allows DemoEC2Role in Account A to assume DemoS3Role in Account B.

Configure the storage library

Copy the ARN of the S3 access role in Account B.

For example:

arn:aws:iam::222222222222:role/DemoS3Role

When you configure the storage library in Commvault, select AWS STS Assume Role with IAM Role Policy as the authentication method.
Enter the ARN of the S3 access role.

The MediaAgent uses its attached EC2 IAM role to call AWS STS AssumeRole, obtains temporary credentials for the S3 access role, and uses those credentials to access the Amazon S3 bucket.

Authentication flow

The authentication process works as follows:

The MediaAgent runs on an EC2 instance with the EC2 IAM role attached.
The MediaAgent calls AWS STS AssumeRole to request temporary credentials for the S3 access role.
AWS verifies that:
The EC2 IAM role has permission to call sts:AssumeRole on the S3 access role.
The S3 access role trusts the EC2 IAM role through its trust policy.
AWS STS returns temporary security credentials.
The MediaAgent uses the temporary credentials to perform backup and restore operations on the Amazon S3 bucket in Account B.

For additional IAM policy information, see IAM Policies for Protecting AWS Services.