Add an S3 Account Using IAM Role

This chapter covers the following topic: how to add an Amazon S3 account to Managed Backup using IAM roles.

To start backing up your data, you need to specify cloud storage your data will be backed up to. One of the most popular storage providers is AWS S3. You can add an S3 account in Management Console using the following authentication modes:

• Using the AWS IAM role (recommended). You can use Managed backup wizard or do this manually.
• Using Secret & Access keys (legacy)

However, AWS recommends users use IAM roles for security purposes. IAM roles allow flexible custom settings for available features. Thus, for example, you can create a policy for a user that can back up only to S3 or restore image-based backups to EC2.

To add an S3 account using the IAM role, proceed as follows:

1. Open the Management Console.
2. Open the Backup > Storage Accounts page.

3. Click + to launch the Create a new Backup Destination wizard.

4. On the Storage type step select Amazon S3 & Glacier. Click Next.
5. On the Storage account step, select an existing storage account or create a new one. By default, existing storage accounts are displayed. To add a new storage account, click Create a new storage account, enter a name, and select Amazon S3 & Glacier or Amazon S3 & Glacier (AWS China).

6. In the Authentication type select IAM Role (Manual, best practice). Alternatively, select IAM role (MBS wizard) for step-by-step instructions. You can also use Access Key / Secret key (Legacy) option.

7. The Provider ID will be added automatically. You can click the Copy to clipboard icon to copy the Provider ID.

8. Enter Role ARN. Refer to the Add Amazon S3 Account via AWS IAM roles for details.

9. Click Next. Now you can set the backup destination.

10. On the Storage type step select Amazon S3 & Glacier. Click Next.

11. On the Storage account step, select an existing storage account or create a new one. By default, existing storage accounts are displayed. To add a new storage account, click Create a new storage account, enter a name, and select Amazon S3 & Glacier or Amazon S3 & Glacier (AWS China).

12. Specify the bucket. In the Destination display name field, specify the bucket name which will be displayed as a backup destination, then select whether you will use an existing bucket or create a new one:
    • Select the Create New option to create a new bucket. Name the bucket. Select the region to create the new bucket.
    • Select the Select Existing option to use the existing bucket, then select it in the drop-down list. Also you can select an external bucket you have access to.
    • For the buckets with Object Lock turned on, you can enable Default Object Lock features.
    • Enable Object Lock for GFS backups feature. Otherwise this functionality might be permanently disabled. Disable it if this functionality is not needed.

13. Select the companies or users to assign to the storage account.

14. Click Next.
15. View the storage account summary, then click Save.

Added storage account appears in the grid.

7. Now you can set the backup destination.