How do I connect to AWS Backup?

Learn more about how to connect Bocada Cloud to resources protected by AWS Backup

1. Log into Bocada Cloud

• On the left navigation menu, click Connections, then +Add.  
• Click the AWS Backup tile

2. Add Connection Details

• Organization: this drop-down field will be visible if you have set up more than one organization in your Bocada Cloud account. Select the organization that should be associated with this connection to AWS Backup. 
• Connection Name: give this connection a name which will display in the Bocada Cloud UI and reports. 
• Access Key ID & Secret Access Key: these fields require data created in your AWS Backup application. See below to learn more.
• Collect Costs: select whether you would like to collect the costs of storing backups in AWS, which are displayed in the Cloud Backup Storage Costs report. 
  • Note: backup storage cost collection uses the AWS Cost Explorer API, which may incur additional charges to your AWS account. Click here to learn more about Cost Explorer API usage costs.

3. AWS Backup Access Keys

Bocada Cloud connects with an AWS account using read-only IAM User credentials (Access Key ID and Secret access key).

AWS IAM User Creation Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html

Required IAM User Permissions:

• AWS Backup

  • AWSBackupOperatorAccess

• AWS Native Snapshots

  • EC2 - AmazonEC2ReadOnlyAccess
  • RDS – AmazonRDSReadOnlyAccess
  • DynamoDB – AmazonDynamoDBReadOnlyAccess
  • Redshift – AmazonRedshiftReadOnlyAccess
  • FSx – AmazonFSxReadOnlyAccess

• AWS S3 Buckets

  • AmazonS3ReadOnlyAccess (this policy needs the following permissions                   "s3:Get*","s3:List*","s3-object-lambda:Get*","s3-object-lambda:List*")

• Extra Logging for all backups

  • AWSCloudTrail_ReadOnlyAccess

• AWS Cost Explorer

  • GetCostAndUsageWithResources
  • Cost collection requires enabling "Resource-Level Data at Daily Granularity" for the Cost Explorer. Learn more here. 

4. Enter AWS Backup Access Keys into Bocada Cloud

• Enter the AWS Access Key ID & Secret Access key into the Add Connection page in Bocada Cloud
• Then, click the Next button to test the connection. 

If the connection is successful, you will be asked to select how many days in the past (up to the past 8 days) of backup data you want to collect to initially populate reports and your Dashboard. Then, your connector will run data collections every hour after that point.  

 If the connection is unsuccessful, you will be able to click the “Previous” button to edit your connection details and try again.