Connect to AWS Accounts
Appranix requires a way to be authenticated and authorized to connect to the customer AWS account to provide resilience for their cloud application environment.
Pre-requisites
For onboarding the AWS account in Appranix, a few roles and permissions in AWS should be enabled through an AWS stack. The onboarding user should have the below listed permissions in the AWS account to create a Role Stack for Appranix in AWS.
- AWSCloudFormationFullAccess
- IAMFullAccess
To add a new AWS Cloud Connection in Appranix, follow the below steps:
- Navigate to "Cloud Connections", click "Add Cloud Connection," and choose "AWS Cloud"
- Fill in the Name and Description for the Cloud Connection
- Select the operational regions where your protection and recovery operations need to be done
- Enable the services required and click next
- Select the "IAM permission" type for the Cloud Connection
- After choosing the IAM permission, launch the CloudFormation template in your AWS console
- After the execution, copy the ARN number from the output section of the CloudFormation screen
- Register the cloud and wait for the progress of the connection to see the discovered resources
If you have technical challenges in the above steps, you may have problems with one or more of the following items.
- Permission to launch CloudFormation
- You don't have permission to create an IAM role
- If the copied ARN from the output is not valid, it is possibly a copy-paste error
- The newly created role is removed or blocked before the discovery process
- There is a network outage or AWS response delay that causes the discovery to delay longer due to Exponential Backoff
Steps to share Cross-tenant Cloud Connection,
For cross-tenant recovery, Appranix requires two active Cloud Connections. One should point to the primary AWS account, and another should point to the recovery AWS account.
- Once the two Active Cloud Connections are created, open the primary AWS Cloud Connection
- Click the "ACTIONS" button and select "SHARED CLOUD CONNECTION"
- Click on "SHARE TO CLOUD CONNECTION" and select the recovery AWS account Cloud Connection from the drop-down list
- Save the shared connection and finish
AWS IAM Permissions
Appranix gets four sets of permissions during Cloud Connection creation.
- Discovery
- Protection
- Recovery
- Reset
NOTE: When a particular permission is revoked manually in the AWS portal, the set of operations associated with that role will fail.
EC2 Discovery Access
Action: - ec2:DescribeAddresses - ec2:DescribeInstances - ec2:DescribeInstanceAttribute - ec2:DescribeRegions - ec2:DescribeDhcpOptions - ec2:DescribeClientVpnConnections - ec2:DescribeVpcEndpointServices - ec2:DescribeSnapshots - ec2:DescribeAddressesAttribute - ec2:DescribeVpcAttribute - ec2:DescribeInternetGateways - ec2:DescribeNetworkInterfaces - ec2:DescribeAvailabilityZones - ec2:DescribeNetworkInterfaceAttribute - ec2:DescribeVolumes - ec2:DescribeNetworkInterfacePermissions - ec2:DescribeVpcEndpointConnections - ec2:DescribeNetworkAcls - ec2:DescribeRouteTables - ec2:DescribeClientVpnEndpoints - ec2:DescribeVpnConnections - ec2:DescribeSnapshotAttribute - ec2:DescribeTags - ec2:DescribeVpcPeeringConnections - ec2:DescribeNatGateways - ec2:DescribeCustomerGateways - ec2:DescribeVolumeAttribute - ec2:DescribeSecurityGroups - ec2:DescribeImages - ec2:DescribeSecurityGroupRules - ec2:DescribeVpcs - ec2:DescribeImageAttribute - ec2:DescribeInstanceTypes - ec2:DescribeVpcEndpoints - ec2:DescribeSubnets - ec2:DescribeVpnGateways
Loadbalancer Discovery Access
permissions: - elasticloadbalancing:DescribeSSLPolicies - elasticloadbalancing:DescribeTags - elasticloadbalancing:DescribeLoadBalancerPolicyTypes - elasticloadbalancing:DescribeLoadBalancerAttributes - elasticloadbalancing:DescribeLoadBalancers - elasticloadbalancing:DescribeTargetGroupAttributes - elasticloadbalancing:DescribeListeners - elasticloadbalancing:DescribeAccountLimits - elasticloadbalancing:DescribeLoadBalancerPolicies - elasticloadbalancing:DescribeTargetHealth - elasticloadbalancing:DescribeTargetGroups - elasticloadbalancing:DescribeListenerCertificates - elasticloadbalancing:DescribeRules - elasticloadbalancing:DescribeInstanceHealth
Loadbalancer V2 Discovery Access
permissions: - elasticloadbalancing:DescribeSSLPolicies - elasticloadbalancing:DescribeTags - elasticloadbalancing:DescribeLoadBalancerPolicyTypes - elasticloadbalancing:DescribeLoadBalancerAttributes - elasticloadbalancing:DescribeLoadBalancers - elasticloadbalancing:DescribeTargetGroupAttributes - elasticloadbalancing:DescribeListeners - elasticloadbalancing:DescribeAccountLimits - elasticloadbalancing:DescribeLoadBalancerPolicies - elasticloadbalancing:DescribeTargetHealth - elasticloadbalancing:DescribeTargetGroups - elasticloadbalancing:DescribeListenerCertificates - elasticloadbalancing:DescribeRules - elasticloadbalancing:DescribeInstanceHealthd
KMS Discovery Access
permissions: - kms:ListKeys - kms:ListAliases - kms:DescribeKey
ACM Discovery Access
permissions: - acm:DescribeCertificate - acm:ListCertificates - acm:ListTagsForCertificate
RDS Discovery Access
permissions: - rds:Describe* - rds:ListTagsForResource
EFS Discovery Access
permissions: - elasticfilesystem:DescribeBackupPolicy - elasticfilesystem:DescribeMountTargets - elasticfilesystem:DescribeTags - elasticfilesystem:ListTagsForResource - elasticfilesystem:DescribeLifecycleConfiguration - elasticfilesystem:DescribeFileSystemPolicy - elasticfilesystem:DescribeAccessPoints - elasticfilesystem:DescribeAccountPreferences - elasticfilesystem:DescribeFileSystems - elasticfilesystem:DescribeMountTargetSecurityGroup
EC2 Protection Access
permissions: - ec2:DescribeImages - ec2:CopySnapshot - ec2:CreateTags - ec2:CreateSnapshots - ec2:DescribeImageAttribute - ec2:RegisterImage - ec2:CreateSnapshot - ec2:ImportSnapshot - ec2:DescribeSnapshotAttribute - ec2:ModifySnapshotAttribute - ec2:CreateImage - ec2:CopyImage - ec2:ImportImage - ec2:DescribeSnapshots
Backup Service Access For Resource Protection
permissions: - backup:TagResource - backup:ListCopyJobs - backup:PutBackupVaultAccessPolicy - backup:ListTags - backup:ListBackupJobs - backup:StartBackupJob - backup:DescribeCopyJob - backup:DescribeBackupJob - backup:CopyIntoBackupVault - backup:GetBackupVaultAccessPolicy - backup:CreateBackupVault - backup:ListBackupVaults - backup:UpdateRecoveryPointLifecycle - backup:GetRecoveryPointRestoreMetadata - backup:DescribeRecoveryPoint - backup:DescribeBackupVault - backup:StopBackupJob - backup:UntagResource - backup:ListRecoveryPointsByBackupVault - backup:StartCopyJob
Backup Storage Access For Resource Protection
permissions: - backup-storage:Mount - backup-storage:MountCapsule
Pass Role For Backup Service Access
permissions: - iam:PassRole
KMS Access For Encrypted Resource Protection
permissions: - kms:ListKeys - kms:Decrypt - kms:Encrypt - kms:ListAliases - kms:ReEncryptTo - kms:DescribeKey - kms:RetireGrant - kms:CreateGrant - kms:ReEncryptFrom - kms:GenerateDataKey
RDS Protection Access
permissions: - rds:DescribeDBClusterSnapshotAttributes - rds:AddTagsToResource - rds:DescribeDBSnapshots - rds:CopyDBSnapshot - rds:CopyDBClusterSnapshot - rds:DescribeDBSnapshotAttributes - rds:ModifyDBSnapshot - rds:ListTagsForResource - rds:CreateDBSnapshot - rds:DescribeDBClusterSnapshots - rds:DescribeOptionGroupOptions - rds:CreateDBClusterSnapshot - rds:ModifyDBClusterSnapshotAttribute - rds:ModifyDBSnapshotAttribute - rds:DescribeOptionGroups
RDS Option Group Write Access
permissions: - rds:DeleteOptionGroup - rds:ModifyOptionGroup - rds:CreateOptionGroup
EFS Protection Access
permissions: - elasticfilesystem:DescribeFileSystems - elasticfilesystem:DescribeTags - elasticfilesystem:DescribeBackupPolicy - elasticfilesystem:Backup - elasticfilesystem:TagResource - elasticfilesystem:CreateTags
EC2 Retention Access
permissions: - ec2:DeregisterImage - ec2:DeleteSnapshot - ec2:DeleteTags - ec2:DescribeSnapshots - ec2:DescribeTags - ec2:DescribeSnapshotAttribute - ec2:DescribeImages - ec2:DescribeImageAttribute
Backup Service Access For Resource Retention
permissions: - backup:UntagResource - backup:ListRecoveryPointsByBackupVault - backup:ListTags - backup:ListBackupJobs - backup:DescribeBackupJob - backup:DeleteRecoveryPoint - backup:ListBackupVaults - backup:GetRecoveryPointRestoreMetadata - backup:DescribeBackupVault - backup:DescribeRecoveryPoint - backup:StopBackupJob - backup:ListRecoveryPointsByResource - backup:DeleteBackupVault - backup:DeleteBackupVaultAccessPolicy
RDS Retention Access
permissions: - rds:DescribeDBClusterSnapshotAttributes - rds:DescribeDBSnapshots - rds:DeleteDBSnapshot - rds:DescribeDBSnapshotAttributes - rds:DeleteDBClusterSnapshot - rds:ListTagsForResource - rds:DescribeDBClusterSnapshots - rds:RemoveTagsFromResource - rds:DeleteOptionGroup - rds:ModifyOptionGroup
EC2 Recovery Access
permissions: - ec2:Describe* - ec2:CreateDhcpOptions - ec2:AuthorizeSecurityGroupIngress - ec2:ModifyVolumeAttribute - ec2:AttachInternetGateway - ec2:StartInstances - ec2:CreateNetworkInterfacePermission - ec2:RevokeSecurityGroupEgress - ec2:CreateRoute - ec2:CreateInternetGateway - ec2:ModifyAddressAttribute - ec2:CreateTags - ec2:ModifyNetworkInterfaceAttribute - ec2:RunInstances - ec2:ModifySecurityGroupRules - ec2:StopInstances - ec2:AssignPrivateIpAddresses - ec2:CreateVolume - ec2:ReplaceNetworkAclAssociation - ec2:RevokeSecurityGroupIngress - ec2:CreateNetworkInterface - ec2:CreateDefaultVpc - ec2:CreateSubnet - ec2:ModifyVpcEndpoint - ec2:CreateVpnConnection - ec2:AttachVolume - ec2:ModifyVpcEndpointServicePermissions - ec2:CreateNatGateway - ec2:RunScheduledInstances - ec2:CreateVpc - ec2:ModifyImageAttribute - ec2:CreateSubnetCidrReservation - ec2:ModifySubnetAttribute - ec2:CreateDefaultSubnet - ec2:RebootInstances - ec2:AssociateDhcpOptions - ec2:AssignIpv6Addresses - ec2:ImportInstance - ec2:AttachVpnGateway - ec2:ImportSnapshot - ec2:CreateVpnConnectionRoute - ec2:AllocateHosts - ec2:CreateImage - ec2:CopyImage - ec2:AssociateVpcCidrBlock - ec2:ReplaceRoute - ec2:AssociateRouteTable - ec2:ReplaceNetworkAclEntry - ec2:CreateVpnGateway - ec2:ImportImage - ec2:CreateVpcPeeringConnection - ec2:ModifyVolume - ec2:UpdateSecurityGroupRuleDescriptionsEgress - ec2:RegisterImage - ec2:CreateRouteTable - ec2:AssociateSubnetCidrBlock - ec2:CreateEgressOnlyInternetGateway - ec2:AssociateAddress - ec2:DeleteNetworkInterfacePermission - ec2:CreateSecurityGroup - ec2:CreateNetworkAcl - ec2:ModifyVpcAttribute - ec2:ModifyInstanceAttribute - ec2:AuthorizeSecurityGroupEgress - ec2:AllocateAddress - ec2:CreateVpcEndpoint - ec2:AttachNetworkInterface - ec2:CreateNetworkAclEntry
Loadbalancer Recovery Access
permissions: - elasticloadbalancing:Describe - elasticloadbalancing:Set - elasticloadbalancing:AttachLoadBalancerToSubnets - elasticloadbalancing:ConfigureHealthCheck - elasticloadbalancing:AddTags - elasticloadbalancing:EnableAvailabilityZonesForLoadBalancer - elasticloadbalancing:Modify - elasticloadbalancing:Register - elasticloadbalancing:ApplySecurityGroupsToLoadBalancer - elasticloadbalancing:AddListenerCertificates - elasticloadbalancing:Create
Loadbalancer V2 Recovery Access
permissions: - elasticloadbalancing:Set - elasticloadbalancing:Modify - elasticloadbalancing:Register - elasticloadbalancing:Add - elasticloadbalancing:Create
ACM Discovery Access
permissions: - acm:DescribeCertificate - acm:ListCertificates - acm:ListTagsForCertificate
KMS Access For Encrypted Resource Recovery
permissions: - kms:ListKeys - kms:Decrypt - kms:Encrypt - kms:ListAliases - kms:ReEncryptTo - kms:DescribeKey* - kms:RetireGrant - kms:CreateGrant - kms:ReEncryptFrom - kms:GenerateDataKey*
Cloud Formation Stack Create And Update Access
permissions: - cloudformation:CreateUploadBucket - cloudformation:CancelUpdateStack - cloudformation:UpdateStackInstances - cloudformation:ListTypes - cloudformation:UpdateTerminationProtection - cloudformation:DescribeStackResource - cloudformation:UpdateStackSet - cloudformation:CreateChangeSet - cloudformation:ContinueUpdateRollback - cloudformation:EstimateTemplateCost - cloudformation:DescribeStackEvents - cloudformation:UpdateStack - cloudformation:DescribeChangeSet - cloudformation:ListStackResources - cloudformation:SetStackPolicy - cloudformation:ListStacks - cloudformation:DescribeType - cloudformation:DescribeStackResources - cloudformation:GetTemplateSummary - cloudformation:DescribeStacks - cloudformation:RollbackStack - cloudformation:CreateStack - cloudformation:GetTemplate - cloudformation:TagResource - cloudformation:ValidateTemplate - cloudformation:ListChangeSets - cloudformation:ListTypeVersions
RDS Recovery Access
permissions: - rds:AuthorizeDBSecurityGroupIngress - rds:StartDBCluster - rds:ModifyOptionGroup - rds:RestoreDBClusterFromSnapshot - rds:RemoveRoleFromDBCluster - rds:CreateOptionGroup - rds:CreateDBSubnetGroup - rds:StopDBInstanceAutomatedBackupsReplication - rds:ModifyCustomDBEngineVersion - rds:ModifyDBParameterGroup - rds:Describe* - rds:CreateDBInstance - rds:ModifyDBInstance - rds:ModifyDBClusterParameterGroup - rds:AddTagsToResource - rds:CreateDBClusterEndpoint - rds:StopDBCluster - rds:CreateDBParameterGroup - rds:StartDBInstanceAutomatedBackupsReplication - rds:StopDBInstance - rds:PromoteReadReplica - rds:StartDBInstance - rds:RebootDBCluster - rds:ModifyCertificates - rds:ListTagsForResource - rds:CreateDBSecurityGroup - rds:RestoreDBInstanceFromDBSnapshot - rds:RebootDBInstance - rds:CreateDBCluster - rds:ModifyDBClusterEndpoint - rds:ModifyDBCluster - rds:CreateDBClusterParameterGroup - rds:CreateDBInstanceReadReplica - rds:PromoteReadReplicaDBCluster - rds:RemoveRoleFromDBInstance - rds:ModifyDBSubnetGroup
EFS Recovery Access
permissions: - elasticfilesystem:ModifyMountTargetSecurityGroups - elasticfilesystem:Describe* - elasticfilesystem:Restore - elasticfilesystem:CreateFileSystem - elasticfilesystem:ListTagsForResource - elasticfilesystem:ClientWrite - elasticfilesystem:TagResource - elasticfilesystem:CreateTags - elasticfilesystem:CreateMountTarget - elasticfilesystem:ClientMount - elasticfilesystem:PutLifecycleConfiguration - elasticfilesystem:Backup - elasticfilesystem:PutBackupPolicy - elasticfilesystem:ClientRootAccess - elasticfilesystem:CreateAccessPoint - elasticfilesystem:PutFileSystemPolicy - elasticfilesystem:UpdateFileSystem
Backup Service Access For Resource Recovery
permissions: - backup:ListTags - backup:ListBackupJobs - backup:DescribeBackupJob - backup:DescribeRestoreJob - backup:ListRestoreJobs - backup:GetBackupVaultAccessPolicy - backup:ListBackupVaults - backup:GetRecoveryPointRestoreMetadata - backup:DescribeRecoveryPoint - backup:DescribeBackupVault - backup:ListRecoveryPointsByResource - backup:StartRestoreJob - backup:ListRecoveryPointsByBackupVault
Backup Storage Access For Resource Recovery
permissions: - backup-storage:Mount - backup-storage:MountCapsule
Pass Role For Resource recovery Access
permissions: - iam:PassRole
Cloud Formation Stack Delete Access
permissions: - cloudformation:ListStacks - cloudformation:CancelUpdateStack - cloudformation:RollbackStack - cloudformation:DescribeStackSet - cloudformation:DeleteStack - cloudformation:DescribeStackResource - cloudformation:UntagResource - cloudformation:DeleteChangeSet - cloudformation:ListChangeSets - cloudformation:ContinueUpdateRollback - cloudformation:DescribeStacks - cloudformation:ListStackResources
EC2 Reset Access
permissions: - ec2:Describe* - ec2:DeleteSubnet - ec2:UnmonitorInstances - ec2:DeleteClientVpnEndpoint - ec2:DeleteVpcPeeringConnection - ec2:DeleteVpcEndpoints - ec2:UpdateSecurityGroupRuleDescriptionsIngress - ec2:DeleteRouteTable - ec2:DisassociateVpcCidrBlock - ec2:DeleteVolume - ec2:DeleteVpnGateway - ec2:UnassignIpv6Addresses - ec2:DeleteInternetGateway - ec2:UnassignPrivateIpAddresses - ec2:DeleteVpnConnection - ec2:DisableImageDeprecation - ec2:DetachVolume - ec2:UpdateSecurityGroupRuleDescriptionsEgress - ec2:DeleteNetworkInterface - ec2:DeletePublicIpv4Pool - ec2:DetachInternetGateway - ec2:StopInstances - ec2:DisassociateRouteTable - ec2:DetachVpnGateway - ec2:DeleteTransitGatewayRoute - ec2:AssociateDhcpOptions - ec2:DeleteDhcpOptions - ec2:DeleteNatGateway - ec2:DeleteVpc - ec2:DeleteTransitGateway - ec2:DeleteKeyPair - ec2:DeleteNetworkAclEntry - ec2:DeleteQueuedReservedInstances - ec2:DeleteCarrierGateway - ec2:DisassociateAddress - ec2:DeregisterImage - ec2:DeleteSnapshot - ec2:DeleteNetworkAcl - ec2:ReplaceNetworkAclAssociation - ec2:ReleaseAddress - ec2:DeleteEgressOnlyInternetGateway - ec2:TerminateInstances - ec2:DetachNetworkInterface - ec2:DeletePlacementGroup - ec2:DeleteRoute - ec2:DeprovisionPublicIpv4PoolCidr - ec2:DisassociateSubnetCidrBlock - ec2:DeleteVpnConnectionRoute - ec2:DeleteCustomerGateway - ec2:DeleteClientVpnRoute - ec2:DeleteSecurityGroup - ec2:DeleteTransitGatewayConnect
Loadbalancer Reset Access
permissions: - elasticloadbalancing:Describe* - elasticloadbalancing:ModifyListener - elasticloadbalancing:DetachLoadBalancerFromSubnets - elasticloadbalancing:DeregisterTargets - elasticloadbalancing:RemoveListenerCertificates - elasticloadbalancing:DeleteTargetGroup - elasticloadbalancing:DeleteLoadBalancer - elasticloadbalancing:DeleteLoadBalancerPolicy - elasticloadbalancing:RemoveTags - elasticloadbalancing:ModifyRule - elasticloadbalancing:DeleteLoadBalancerListeners - elasticloadbalancing:DeregisterInstancesFromLoadBalancer - elasticloadbalancing:ModifyLoadBalancerAttributes - elasticloadbalancing:ModifyTargetGroupAttributes - elasticloadbalancing:DeleteRule - elasticloadbalancing:ModifyTargetGroup - elasticloadbalancing:DeleteListener - elasticloadbalancing:DisableAvailabilityZonesForLoadBalancer
Loadbalancer V2 Reset Access
permissions: - elasticloadbalancing:Describe* - elasticloadbalancing:ModifyListener - elasticloadbalancing:DetachLoadBalancerFromSubnets - elasticloadbalancing:DeregisterTargets - elasticloadbalancing:RemoveListenerCertificates - elasticloadbalancing:DeleteTargetGroup - elasticloadbalancing:DeleteLoadBalancer - elasticloadbalancing:DeleteLoadBalancerPolicy - elasticloadbalancing:RemoveTags - elasticloadbalancing:ModifyRule - elasticloadbalancing:DeleteLoadBalancerListeners - elasticloadbalancing:DeregisterInstancesFromLoadBalancer - elasticloadbalancing:ModifyLoadBalancerAttributes - elasticloadbalancing:ModifyTargetGroupAttributes - elasticloadbalancing:DeleteRule - elasticloadbalancing:ModifyTargetGroup - elasticloadbalancing:DeleteListener - elasticloadbalancing:DisableAvailabilityZonesForLoadBalancer
RDS Reset Access
permissions: - rds:Describe - rds:StopDBCluster - rds:RemoveRoleFromDBCluster - rds:DeleteDBSnapshot - rds:DeleteDBInstanceAutomatedBackup - rds:StopDBInstance - rds:DeleteDBSubnetGroup - rds:DeleteOptionGroup - rds:DeleteDBClusterSnapshot - rds:DeleteEventSubscription - rds:DeleteDBSecurityGroup - rds:DeleteDBClusterEndpoint - rds:DeleteDBParameterGroup - rds:DeleteDBClusterParameterGroup - rds:DeleteDBCluster - rds:RemoveRoleFromDBInstance - rds:DeleteDBInstance
EFS Reset Access
permissions: - elasticfilesystem:Describe - elasticfilesystem:DeleteAccessPoint - elasticfilesystem:UntagResource - elasticfilesystem:DeleteReplicationConfiguration - elasticfilesystem:DeleteMountTarget - elasticfilesystem:DeleteFileSystem - elasticfilesystem:DeleteFileSystemPolicy - elasticfilesystem:DeleteTags
NOTE: This list of permissions may increase as Appranix adds more services for protection.