Veritas CloudPoint Administrator's Guide

To configure AWS KMS in CloudPoint

1. Generate an authentication token for the CloudPoint administrator user account by using the following CloudPoint Identity Management API:

   POST /v2/idm/login

   On any system that can connect to the CloudPoint instance, type the following cURL command:

   # curl -k https://<cloudpointhostFQDN>/cloudpoint/api/v2/idm/login 
   -X 'POST' -H "Content-Type: application/json" 
   -d '{"email":"<username>", "password":"<password>"}'

   Replace the following parameters as per your environment:

   Parameter	Description
   <cloudpointhostFQDN>	Represents the Fully Qualified Domain Name (FQDN) that was specified while performing the initial CloudPoint configuration on the host.
   <username>	Represents the user name that was specified as the CloudPoint administrator user during initial configuration.
   <password>	Represents the password of the CloudPoint administrator user account.

2. Observe the API output on the command prompt. You will see an output that resembles the following:

   {
       "accessToken": "eyJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJWZXJpdGFzIiwidXN",
       "applicationId": "",
       "applicationPath": "",
       "errorCode": ""
   }

   The alphanumeric entry that appears as the accessToken represents the token that is used to authorize all CloudPoint API requests on the host. Copy the token, it is required in the subsequent steps.

   Note:

   The alphanumeric authentication token displayed here is for representation purpose only. Use the actual token that is generated when you run this command in your environment.

3. Create a new AWS KMS configuration using the CloudPoint Key Management Service API POST /v3/kms.

   Enter the following cURL command on the same command prompt:

   # curl -k "https://<cloudpointhostFQDN>/cloudpoint/api/v3/kms" 
   -X 'POST' -H  "Content-Type: application/json" 
   -H  "Authorization: Bearer <authtoken>"
   -d "{"platform":"aws", "masterKeyId":"<cmk_keyid>", 
   "credentials":{"type":"iamrole", "regionname":"<cmk_regionname>"}}"

   Replace the following parameters as per your environment:

   Parameter	Description
   <cloudpointhostFQDN>	Represents the Fully Qualified Domain Name (FQDN) that was specified while performing the initial CloudPoint configuration on the host.
   <authtoken>	Represents the alpha numeric authentication token that you generated in the earlier step.
   <cmk_keyid>	Represents the AWS customer managed Customer Master Keys (CMK) key ID that you created for CloudPoint.
   <cmk_regionname>	Represents the CMK region where the CloudPoint instance is deployed.

4. Observe the API output on the command prompt and wait for the task to complete.
5. You can quickly verify if the AWS KMS is configured successfully by using the CloudPoint API GET /v3/kms.

   Run the following cURL command:

   # curl -k -X GET "https://<cloudpointhostFQDN>/cloudpoint/api/v3/kms" 
   -H  "accept: application/json" 
   -H  "Authorization: Bearer <authtoken>"

   Replace the following parameters as per your environment:

   Parameter	Description
   <cloudpointhostFQDN>	Represents the Fully Qualified Domain Name (FQDN) that was specified while performing the initial CloudPoint configuration on the host.
   <authtoken>	Represents the alpha numeric authentication token that you generated in step 2 earlier.

   An HTTP 200 status indicates that the configuration was performed successfully.

6. You must now configure the CloudPoint plug-ins or the agentless feature.

   See Configuring an off-host plug-in.

   See About the agentless feature.