Create role
Create a role in your AWS console. See AWS documentation for the details:
Your policy should look like this with the required parameters filled out.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"rolesanywhere.amazonaws.com"
]
},
"Action": [
"sts:AssumeRole",
"sts:TagSession",
"sts:SetSourceIdentity"
],
"Condition": {
"ArnEquals": {
"aws:SourceArn": [
"arn:aws:rolesanywhere:<REGION>:<ACCOUNT NUMBER>:trust-anchor/<TRUST ANCHOR ID>"
]
},
"StringEquals": {
"<PRINCIPAL TAG CHECK>"
}
}
}
]
}NetBackup does not require the ArnEquals and the Principal Tag StringEquals checks, but they are suggested security constraints.