Dell PowerProtect Cyber Recovery 19.14 AWS Deployment Guide

Create an AWS account

To deploy Cyber Recovery to AWS, you must have an AWS account. To set up an account, go to Getting Started with AWS.

Identity and access management

AWS recommends that you create an identity and access management (IAM) user or role for authenticating with AWS. Never use root credentials to deploy a CloudFormation template. The IAM user must be allowed to perform AWS CloudFormation actions.

The following links provide more information about AWS best practices:

• Creating an IAM User in Your AWS Account
• Using IAM Roles
• What is AWS CloudFormation?

Security and operational best practices

Consider the following best practices:

• Amazon recommends that you enable AWS CloudTrail logs to enable governance, compliance, and operational and risk auditing of your AWS account. AWS CloudTrail enables you to do the following:
  • View the event history of your AWS account activity, including AWS Management Console actions, AWS SDKs, CLI, and other AWS services. This event history helps to simplify security analysis, resource change tracking, and troubleshooting.
  • Identify the initiator of actions, resources involved, and event timing.

  The following links provide more information:

  • Working with CloudTrail
  • Turn on CloudTrail across all regions and support for Multiple Trails

• Amazon recommends that you enable S3 server access logging, which provides detailed records for requests that are made to an Amazon S3 bucket. Server access logs are useful for many applications. For example, access log information is useful for security and access audits.

  For more information, see the following links:

  • https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html
  • https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-s3-access-logs-to-identify-requests.html
• Ensure that server-side encryption has not been disabled. For more information, see Protecting data with encryption.
• Use VPC Flow logs for information about the IP traffic between the network interfaces in your VPC. For more information, see Logging IP traffic using VPC Flow Logs.

AWS service limits and restrictions

The following links provide more information about AWS service limits and restrictions:

• Bucket Restrictions and Limitations
• IAM and STS Limits
• How do I manage my AWS service limits?
• AWS Service Quotas

Additional links

The following additional links provide more information about the AWS features that are used with a Cyber Recovery deployment:

• Working with the AWS Management Console
• AWS Cloud Formation
• AWS Identity and Access Management (IAM)
• Amazon Virtual Private Cloud
• Amazon Elastic Compute Cloud Documentation