Skip to main content

Create a mirror relationship for a new bucket (remote cluster)

Contributors netapp-forry netapp-aherbin netapp-barbe netapp-aaron-holt netapp-lenida netapp-ahibbard
PDFs

When you create new S3 buckets, you can protect them immediately to an SnapMirror S3 destination on a remote cluster.

About this task

You will need to perform tasks on both source and destination systems.

Before you begin

  • Requirements for ONTAP versions, licensing, and S3 server configuration have been completed.

  • A peering relationship exists between source and destination clusters, and a peering relationship exists between source and destination storage VMs.

  • CA Certificates are needed for the source and destination VMs. You can use self-signed CA certificates or certificates signed by an external CA vendor.

System Manager

  1. If this is the first SnapMirror S3 relationship for this storage VM, verify that root user keys exist for both source and destination storage VMs and regenerate them if they do not:

    1. Click Storage > Storage VMs and then select the storage VM.

    2. In the Settings tab, click Edit icon in the S3 tile.

    3. In the Users tab, verify that there is an access key for the root user.

    4. If there is not, click Menu options icon next to root, then click Regenerate Key.
      Do not regenerate the key if one already exists.

  2. Edit the storage VM to add users, and to add users to groups, in both the source and destination storage VMs:

    Click Storage > storage VMs, click the storage VM, click Settings and then click Edit icon under S3.

    See Add S3 users and groups for more information.

  3. On the source cluster, create an SnapMirror S3 policy if you don’t have an existing one and you don’t want to use the default policy:

    1. Click Protection > Overview, and then click Local Policy Settings.

    2. Click Arrow icon next to Protection Policies, then click Add.

      • Enter the policy name and description.

      • Select the policy scope, cluster or SVM

      • Select Continuous for SnapMirror S3 relationships.

      • Enter your Throttle and Recovery Point Objective values.

  4. Create a bucket with SnapMirror protection:

    1. Click Storage > Buckets, then click Add. Verifying permissions is optional but recommended.

    2. Enter a name, select the storage VM, enter a size, then click More Options.

    3. Under Permissions, click Add.

      • Principal and Effect - select values corresponding to your user group settings or accept the defaults.

      • Actions- make sure the following values are shown:

        GetObject,PutObject,DeleteObject,ListBucket,GetBucketAcl,GetObjectAcl,ListBucketMultipartUploads,ListMultipartUploadParts

      • Resources - use the defaults (bucketname, bucketname/*) or other values you need.

        See Manage user access to buckets for more information about these fields.

    4. Under Protection, check Enable SnapMirror (ONTAP or Cloud). Then enter the following values:

      • Destination

        • TARGET: ONTAP System

        • CLUSTER: Select the remote cluster.

        • STORAGE VM: Select a storage VM on the remote cluster.

        • S3 SERVER CA CERTIFICATE: Copy and paste the contents of the source certificate.

      • Source

        • S3 SERVER CA CERTIFICATE: Copy and paste the contents of the destination certificate.

  5. Check Use the same certificate on the destination if you are using a certificate signed by an external CA vendor.

  6. If you click Destination Settings, you can also enter your own values in place of the defaults for bucket name, capacity, and performance service level.

  7. Click Save. A new bucket is created in the source storage VM, and it is mirrored to a new bucket that is created the destination storage VM.

Back up locked buckets

Beginning with ONTAP 9.14.1, you can back up locked S3 buckets and restore them as required.

When defining the protection settings for a new or existing bucket, you can enable object locking on destination buckets, provided that the source and destination clusters run ONTAP 9.14.1 or later, and that object locking is enabled on the source bucket. The object locking mode and lock retention tenure of the source bucket become applicable for the replicated objects on the destination bucket. You can also define a different lock retention period for the destination bucket in the Destination Settings section. This retention period is also applied to any non-locked objects replicated from the source bucket and S3 interfaces.

For information about how to enable object locking on a bucket, see Create a bucket.