> Software > Manage > Storage > Air Gap Protect > Configure private connectivity

Configure AWS PrivateLink for Air Gap Protect storage

Use AWS PrivateLink to enable private connectivity between your environment and an Amazon S3 bucket used for Air Gap Protect.

Requirements and considerations

Network connectivity

  • Your on-premises environment must be connected to AWS using Direct Connect.

  • The connection must support expected backup and restore throughput.

  • Routing must allow access to the VPC where the interface endpoint is deployed.

DNS configuration

  • Configure DNS so that Amazon S3 endpoints resolve to the private IP address of the interface VPC endpoint.

  • Verify that $[bucketname].s3.$[region].amazonaws.com resolves using your private DNS configuration.

Important

If you use an AWS VPC Interface Endpoint (AWS PrivateLink), update the host entry so that the Amazon S3 public endpoint resolves to the VPC interface endpoint. Otherwise, requests are routed to the public endpoint instead of the private endpoint.

VPC endpoint configuration

  • Create an interface VPC endpoint for the S3 service (com.amazonaws.$[region].s3).

  • The endpoint must:

    • Be associated with subnets reachable from your on-premises network

    • Have private DNS enabled

  • The security group associated with the endpoint must allow inbound HTTPS (port 443) traffic from your on-premises network.

Access and permissions

  • The S3 bucket and access point must allow access from:

    • Your AWS account

    • The Commvault-managed account used by Commvault

  • Don't restrict access only to service principals within your AWS account.

Cross-account considerations

  • Air Gap Protect uses a cross-account access model.

  • You must provide your AWS account ID and, optionally, VPC endpoint IDs to Commvault.

Cost considerations

AWS may charge for:

  • Interface VPC endpoint usage

  • Data processing through PrivateLink

  • Data transfer through Direct Connect

Create an interface VPC endpoint

Create an interface VPC endpoint for the S3 service (com.amazonaws.$[region].s3) in the target VPC.

For information about creating VPC endpoints, see the AWS documentation.

Provide account information to Commvault

  1. Log on to https://support.commvault.com and create a support request that includes:

    • AWS account ID

    • VPC endpoint IDs (optional, if you want to restrict access)

Validate connectivity

After Commvault confirms configuration:

  1. Launch an EC2 instance in the VPC that contains the interface endpoint.

  2. Verify DNS resolution by validating that the S3 endpoint resolves to a private IP address.

  3. Access the S3 bucket using the access point.

  4. Confirm the following:

    • Data transfer succeeds (read and write operations)

    • Traffic flows through the VPC endpoint

    • No traffic routes through the public internet

×

Loading...