Deploy the Connector from BlueXP

The user who creates a Connector from BlueXP needs specific permissions to deploy the instance in AWS.

Set up AWS permissions

Provide permissions for the Connector

When BlueXP launches the Connector, it attaches a policy to the instance that provides the permissions required to manage resources and processes in your AWS account.

You need to set up the policy yourself if you launch a Connector from the AWS Marketplace, if you manually install the Connector, or if you add more AWS credentials to a Connector.

You also need to ensure that the policy is up to date as new permissions are added in subsequent releases.

AWS permissions for the Connector

Back up on-premises ONTAP clusters to Amazon S3

When activating backups on your ONTAP volumes, BlueXP backup and recovery prompts you to enter an access key and secret for an IAM user that has specific permissions.

Set up S3 permissions for backups

Provide permissions for Cloud Volumes ONTAP nodes

An IAM role must be attached to each Cloud Volumes ONTAP node in AWS. The same is true for the HA mediator. The default option is to let BlueXP create the IAM roles for you, but you can use your own when creating the working environment.

Learn how to set up the IAM roles yourself

Deploy the data broker in AWS

The AWS user account that you use to deploy the data broker must have specific permissions.

Permissions required to deploy the data broker in AWS

Provide permissions for the data broker

When BlueXP copy and sync deploys the data broker, it creates an IAM role for the data broker instance. You can deploy the data broker using your own IAM role, if you prefer.

Requirements to use your own IAM role with the AWS data broker

Enable AWS access for a manually installed data broker

If you use the data broker with a sync relationship that includes an S3 bucket, then you should prepare the Linux host for AWS access. When you install the data broker, you'll need to provide AWS keys for an IAM user that has programmatic access and specific permissions.

Enabling access to AWS

Create and manage FSx for ONTAP

To create or manage an Amazon FSx for NetApp ONTAP working environment, you need to add AWS credentials to BlueXP by providing the ARN of an IAM role that gives BlueXP the permissions needed to create the working environment.

Learn how to set up AWS credentials for FSx

Tier on-premises ONTAP clusters to Amazon S3

When you enable BlueXP tiering to AWS, the wizard prompts you to enter an access key and secret key. These credentials are passed to the ONTAP cluster so that ONTAP can tier data to the S3 bucket.

Set up S3 permissions for tiering

Deploy the Connector from BlueXP

When you deploy a Connector from BlueXP, you need to use an Azure account or service principal that has permissions to deploy the Connector VM in Azure.

Set up Azure permissions

Provide permissions for the Connector

Deploy the data broker in Azure

The Azure user account that you use to deploy the data broker must have the required permissions.

Permissions required to deploy the data broker in Azure

Deploy the Connector from BlueXP

The Google Cloud user who deploys a Connector from BlueXP needs specific permissions to deploy the Connector in Google Cloud.

Set up permissions to create the Connector

Provide permissions for the Connector

The service account for the Connector VM instance must have specific permissions for day-to-day operations. You need to associate the service account with the Connector during deployment.

You also need to ensure that the policy is up to date as new permissions are added in subsequent releases.

Set up permissions for the Connector

Back up Cloud Volumes ONTAP to Google Cloud

Back up on-premises ONTAP clusters to Google Cloud

When using BlueXP backup and recovery to back up on-prem ONTAP clusters, you need to add permissions to the Connector in order to use the "Search & Restore" functionality.

Permissions for Search & Restore functionality

Discover Cloud Volumes Service for Google Cloud

BlueXP needs access to the Cloud Volumes Service API and the right permissions through a Google Cloud service account.

Set up a service account

Deploy the data broker in Google Cloud

Ensure that the Google Cloud user who deploys the data broker has the required permissions.

Permissions required to deploy the data broker in Google Cloud

Enable Google Cloud access for a manually installed data broker

If you plan to use the data broker with a sync relationship that includes a Google Cloud Storage bucket, then you should prepare the Linux host for Google Cloud access. When you install the data broker, you'll need to provide a key for a service account that has specific permissions.

Enabling access to Google Cloud

Back up on-premises ONTAP clusters to StorageGRID

When you prepare StorageGRID as a backup target for ONTAP clusters, BlueXP backup and recovery prompts you to enter an access key and secret for an IAM user that has specific permissions.

Prepare StorageGRID as your backup target

Tier on-premises ONTAP clusters to StorageGRID

When you set up BlueXP tiering to StorageGRID, you need to provide BlueXP tiering with an S3 access key and secret key. BlueXP tiering uses the keys to access your buckets.

Prepare tiering to StorageGRID