NetBackup™ Web UI Cloud Administrator's Guide

Installing the Amazon RDS for Oracle client utility

Amazon RDS for Oracle client utility recommended version is 21.11.0.0.0-1.el8.

You need to configure the Amazon Elastic File System (EFS) before you can perform any backup.

NetBackup required permissions in AWS to perform backup and restore. To configure the permissions, create an AWS IAM role and assign the permissions required by NetBackup to the role. For more information on how to create an IAM role, see this link in AWS documentation:

https://docs.aws.amazon.com/iam/index.html

Required permissions:

efsdescribemounttarget:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "elasticfilesystem:DescribeMountTargets",
                "elasticfilesystem:DescribeFileSystems",
            ],
            "Resource": [
                "arn:aws:elasticfilesystem:*:*:access-point/*",
                "arn:aws:elasticfilesystem:*:*:file-system/*"
            ]
        }
    ]
}

rdsdescribeoptiongroup
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "rds:CreateOptionGroup",
                "rds:ModifyDBInstance",
                "rds:ModifyOptionGroup",
                "s3:*"
            ],
            "Resource": "*"
        }
    ]
}

AmazonRDSReadOnlyAccess:(AWS Managed)
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds:Describe*",
                "rds:ListTagsForResource",
                "ec2:DescribeAccountAttributes",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcAttribute",
                "ec2:DescribeVpcs"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cloudwatch:GetMetricStatistics",
                "cloudwatch:ListMetrics",
                "cloudwatch:GetMetricData",
                "logs:DescribeLogStreams",
                "logs:GetLogEvents",
                "devops-guru:GetResourceCollection"
            ],
            "Resource": "*"
        },
        {
            "Action": [
                "devops-guru:SearchInsights",
                "devops-guru:ListAnomaliesForInsight"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Condition": {
                "ForAllValues:StringEquals": {
                    "devops-guru:ServiceNames": [
                        "RDS"
                    ]
                },
                "Null": {
                    "devops-guru:ServiceNames": "false"
                }
            }
        }
    ]
}

The following permissions are required for Redshift snapshot and trust relationships:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "redshift:ListDatabases",
                "redshift:DescribeClusters",
                "redshift:CreateTags",
                "redshift:CreateClusterSnapshot",
                "redshift:DescribeClusterSnapshots",
                "redshift:DeleteClusterSnapshot",
                "redshift:DescribeClusterSubnetGroups",
                "redshift:RestoreFromClusterSnapshot",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeAddresses",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeVpcs",
                "ec2:DescribeAccountAttributes",
                "ec2:DescribeSubnets",
                "ec2:DescribeSecurityGroups",
                "iam:GetRole"
            ],
            "Resource": "*"
        }
    ]
}

Minimum trust relationship entities:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "redshift.amazonaws.com",
                    "ec2.amazonaws.com"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}