Creating cross-account access in AWS
If you have multiple AWS accounts in your environment, and NetBackup is deployed in one of these accounts, you can protect your data in all your AWS accounts. You need to configure cross-account data access in the AWS portal, before you select or as your access method. NetBackup only needs the access key, secret key, and role ARN.
Follow the guidelines in AWS documentation for creating cross-account access. Briefly, you need to perform the following steps.
To configure AWS cross-accounts:
- Log on to the AWS provider portal.
- Create a new IAM role in the target AWS account that you want to protect.
- Create a new policy for the IAM role and ensure that it has the required permissions to access the bucket and objects in that target AWS account. See Permissions required for Amazon S3 cloud provider user.
- Establish a trust relationship between the source and the target AWS accounts.
- In the source AWS account, create a policy that allows the IAM role in the source AWS account to assume the IAM role in the target AWS account.
- Attach the policy to the source account user, whose access key and secret access key you use for the assume role.