NetBackup™ Web UI Cloud Administrator's Guide

Replicating unencrypted snapshots

Ensure that the source and target accounts/regions are configured using the AWS cloud provider from NetBackup Snapshot Manager. There are no additional requirements for replicating unencrypted snapshots.

Replicating encrypted snapshots using AWS KMS

Ensure that the source and target accounts/regions are configured using the AWS cloud provider from NetBackup Snapshot Manager.

Additionally, to replicate encrypted snapshots to a cross-account, the encryption CMK key from the original location needs to be shared with the target account. (This shared KMS key is implicitly used while copying the snapshot in the target account, and the copied snapshot can be replicated by a different key).

Both the source and target locations should have encryption key (KMS key) with the same name; that is, they should have the same key alias (in terms of AWS).

If encryption key with the same name is not present at the target, then the replicated snapshot is encrypted using the default KMS key in the target location.

Permissions for cross-account replication

In case of replication to a different region in a different AWS account, the source region (where the VM to be protected exists) must be enabled in the target AWS accounts.

For cross-account replication, the AWS IAM user or role associated with the snapshot source region's AWS account (source AWS account) must have the following permissions:

For cross-account replication, the AWS IAM user or role associated with the snapshot replication target region's AWS account (target AWS account) must have the following permissions:

Maintain a copy of cloud assets at a different destination for long-term retention and auditing requirements.

Recover cloud assets from the replicated copies from another region in case there is a region outage.

Recover cloud assets from the replicated copies from another account in case the user account is compromised.

You can configure snapshot replication when you create a protection plan. See the NetBackup™ Web UI Administrator's Guide.

For cross-account replication, you need to establish a trust relationship between the source and the target account. For more details, refer to the Across AWS Accounts Using IAM Roles related information in the Amazon Web Services documentation.

Even if multiple schedules are configured, the replication destination region that is configured is applied to all the schedules.

Cloud snapshot replication is supported only for Amazon cloud providers.

Assets must be added to a protection plan that replicates snapshots to a different region.

For example, assets residing in region 'aws_account_1-us-east-1' cannot be subscribed to a protection plan replicating to the same region 'aws_account_1-us-east-1'.

Assets can be replicated to a different account in the same region.

For example, assets residing in region 'aws_account_1-us-east-1' can be subscribed to a protection plan replicating inside the same region, but a different account 'aws_account_2-us-east-1'.

Assets that are discovered by a Snapshot Manager must be replicated to the region that is discovered by the same Snapshot Manager.

For example, assets that are discovered by Snapshot Manager 'CP1' cannot be subscribed to a protection plan replicating to a region that is discovered by Snapshot Manager 'CP2'.

Only Amazon assets can be subscribed to a protection plan that is configured for cloud snapshot replication.