Creating a Connector in AWS from Cloud Manager

Contributors netapp-bcammett juliantap

An Account Admin needs to deploy a Connector before you can use most Cloud Manager features. Learn when a Connector is required. The Connector enables Cloud Manager to manage resources and processes within your public cloud environment.

This page describes how to create a Connector in AWS directly from Cloud Manager. Learn about other ways to deploy a Connector.

These steps must be completed by a user who has the Account Admin role. A Workspace Admin can’t create a Connector.

Tip When you create your first Cloud Volumes ONTAP working environment, Cloud Manager will prompt you to create a Connector if you don’t have one yet.

Setting up AWS permissions to create a Connector

Before you can deploy a Connector from Cloud Manager, you need to ensure that your AWS account has the correct permissions.

  1. Download the Connector IAM policy from the following location:

    Tip For IAM user permissions for Amazon FSx for ONTAP, see Create an FSx for ONTAP working environment.
  2. From the AWS IAM console, create your own policy by copying and pasting the text from the Connector IAM policy.

  3. Attach the policy that you created in the previous step to the IAM user who will create the Connector from Cloud Manager.


The AWS user now has the permissions required to create the Connector from Cloud Manager. You’ll need to specify AWS access keys for this user when you’re prompted by Cloud Manager.

Creating a Connector in AWS

Cloud Manager enables you to create a Connector in AWS directly from its user interface.

What you’ll need
  • An AWS access key and secret key for an IAM user who has the required permissions to create a Connector.

  • A VPC, subnet, and keypair in your AWS region of choice.

  • If you don’t want Cloud Manager to automatically create an IAM role for the Connector, then you’ll need to create your own using this policy.

    These permissions are for the Connector instance. It’s a different set of permissions than what’s provided in the first bullet above.

  1. If you’re creating your first Working Environment, click Add Working Environment and follow the prompts. Otherwise, click the Connector drop-down and select Add Connector.

    A screenshot that shows the Connector icon in the header and the Add Connector action.

  2. Choose Amazon Web Services as your cloud provider and click Continue.

    Remember that the Connector must have a network connection to the type of working environment that you’re creating and the services that you’re planning to enable.

  3. Follow the steps in the wizard to create the Connector:

    • Get Ready: Review what you’ll need.

    • AWS Credentials: Specify the AWS access key and secret key that meet permissions requirements and then select your region.

    • Details: Provide details about the Connector.

      • Enter a name for the instance.

      • Add custom tags (metadata) to the instance.

      • Choose whether you want Cloud Manager to create a new role that has the required permissions, or if you want to select an existing role that you set up with the required permissions.

      • Choose whether you want to encrypt the Connector’s EBS disks. You have the option to use the default encryption key or to use a custom key.

    • Network: Specify a VPC, subnet, and key pair for the instance, choose whether to enable a public IP address, and optionally specify a proxy configuration.

    • Security Group: Choose whether to create a new security group or whether to select an existing security group that allows inbound HTTP, HTTPS, and SSH access.

      Note There’s no incoming traffic to the Connector, unless you initiate it. HTTP and HTTPS provide access to the local UI, which you’ll use in rare circumstances. SSH is only needed if you need to connect to the host for troubleshooting.
    • Review: Review your selections to verify that your set up is correct.

  4. Click Add.

    The instance should be ready in about 7 minutes. You should stay on the page until the process is complete.

After you finish

You need to associate a Connector with workspaces so Workspace Admins can use those Connectors to create Cloud Volumes ONTAP systems. If you only have Account Admins, then associating the Connector with workspaces isn’t required. Account Admins have the ability to access all workspaces in Cloud Manager by default. Learn more.