PowerProtect Data Manager 19.15 Amazon Web Services Deployment Guide

Architecture overview

PowerProtect Data Manager is deployed with a private IP address. For access from an external site, configure a VPN gateway.

The following diagram represents the basic architecture of PowerProtect Data Manager on AWS. The diagram shows a single region, single virtual private cloud (VPC), and single availability zone (AZ).

Sensitive PowerProtect Data Manager data, such as passwords, is encrypted and stored in a lockbox. For more information about PowerProtect Data Manager security, see the PowerProtect Data Manager Security Configuration Guide at Customer Support. When deployed to AWS, the PowerProtect Data Manager lockbox is located in a secure Elastic Block Store (EBS) volume.

Backup data is stored in a Simple Storage Services (S3) bucket, and the backup metadata is stored on a DDVE EBS volume. For more information, see the PowerProtect DD Virtual Edition in Amazon Web Services Installation and Administration Guide at Customer Support.

DDVE and a single availability zone

To minimize data-transfer costs, application hosts and DDVE can be located in the same AZ.

DDVE and multiple availability zones

If application hosts are distributed across more than one AZ, you can minimize data-transfer costs by deploying a separate instance of DDVE in each AZ.

DDVE and multiple availability zones with only a single DDVE instance

If application hosts are distributed across more than one availability zone, but a DDVE instance exists in only one of the AZs, additional data-transfer costs will be incurred.