Import to Amazon S3

Prerequisites

Before you can configure and submit your import plan, make sure to complete the following steps so that Lyve Import Service can securely access your specified Amazon S3 bucket to import your data.

Recommendations

Seagate strongly recommends the following best practices:

• Create a bucket dedicated to your Lyve Import project.
• Block all public access for your bucket.
• Ensure bucket versioning is disabled.
• Ensure server-side encryption is enabled.
• Create an IAM Permission Policy.
• Create an IAM Role trusting Lyve Import Service, attaching the IAM policy you created.
• Disable or delete the role after the cloud import project has ended.
• Disable or delete the policy after the cloud import project has ended.

Amazon IAM Permission Policy example

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
        { 
            "Sid": "LyveMobilePolicyTemplate", 
            "Effect": "Allow", 
            "Action": [ 
                "s3:PutObject", 
                "s3:GetObject", 
                "s3:ListBucketMultipartUploads", 
                "s3:AbortMultipartUpload", 
                "s3:GetObjectAttributes", 
                "s3:CreateBucket", 
                "s3:ListBucket", 
                "s3:GetAccelerateConfiguration",
                "s3:DeleteObject", 
                "s3:GetBucketLocation",
                "s3:ListMultipartUploadParts"  
            ], 
            "Resource": [ 
                "arn:aws:s3:::*", 
                "arn:aws:s3:::*/*"
             ]
         }   
     ]
 }        

Complete the prerequisites

Gather information

1. Click Import Plans in the navigation bar. In the Import Plans table, locate the project that you would like to configure the plan for and click the Configure Plan button in the Actions column. Note—If you requested a quote or submitted a deal, you will be able to configure the plan once your project is approved and active.



The plan confirguration wizard appears:



2. Copy the required information, taking note of Lyve’s S3 Account ID and the External ID. You will need these in the steps that follow. (If you need to update the import destination first, click on the Import Destination step and edit.)

Create an IAM Permission Policy on your bucket

1. Log in to your AWS Console.
2. Enter the IAM service.





3. Select Policies.





Click the Create policy button.



4. Click on the JSON tab.





5. Copy the provided JSON script below:

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
        { 
            "Sid": "LyveMobilePolicyTemplate", 
            "Effect": "Allow", 
            "Action": [ 
                "s3:PutObject", 
                "s3:GetObject", 
                "s3:ListBucketMultipartUploads", 
                "s3:AbortMultipartUpload", 
                "s3:GetObjectAttributes", 
                "s3:CreateBucket", 
                "s3:ListBucket", 
                "s3:GetAccelerateConfiguration",
                "s3:DeleteObject", 
                "s3:GetBucketLocation",
                "s3:ListMultipartUploadParts" 
            ], 
            "Resource": [ 
                "arn:aws:s3:::*", 
                "arn:aws:s3:::*/*"
             ]
         }   
     ]
 }        

6. Paste the copied text into the JSON editor.
7. Click the Next: Tags button.
8. Add tags (optional) and click the Next: Review button.
9. On the Review policy page, name the policy LyveMobileAccessPolicy.





10. .Click Create policy

Create an IAM role trusting Lyve Import Service

1. In the sidebar, click Roles. Click the Create role button.





2. On the Select trusted entity page, select Custom trust policy.





3. Copy the provided trust policy below:



{ 
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"AWS": "arn:aws:iam::{accountid}:root"
			},
			"Action": "sts:AssumeRole",
			"Condition": {
				"ForAnyValue:StringEqualsIfExists": {
					"sts:ExternalId": [
						"{externalid}"
					]
				}
			}
		}
	]
} 



4. Paste the copied text into the JSON editor.
5. Replace {accountid} with the value you copied for Lyve’s S3 Account ID. Replace {externalid} with the value you copied for External ID.
6. On the Add permissions page, add the LyveMobileAccessPolicy you created earlier and click Next.



If you have multiple import plans to configure, add the external ID for each plan separated with a comma (,). For example:

{ 
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"AWS": "arn:aws:iam::{accountid}:root"
			},
			"Action": "sts:AssumeRole",
			"Condition": {
				"ForAnyValue:StringEqualsIfExists": {
					"sts:ExternalId": [
						"{firstexternalid}",
    						"{secondexternalid}",
    						"{thirdexternalid}"
					]
				}
			}
		}
	]
}



7. Click Next to exit the JSON editor.
8. On the Add permissions page, add the LyveMobileAccessPolicy you created earlier and click Next.





9. On the Name, review, and create page, enter a Role name, for example, LyveMobileAccessRole.





10. Review the trusted entity and permissions information:

Ensure the following

1. “AWS” is paired with the value you copied for Lyve’s S3 Account ID.
2. “sts:ExternalID” is paired with the value you copied for External ID.
3. The Policy name is the LyveMobileAccessPolicy you created earlier.

Configure your import plan

After you’ve completed the prerequisites, continue to the next step to enter your access details.

Review access details

1. In Lyve Management Portal, click Import Plans. Click Configure Plan next to an Amazon S3 cloud destination.

2. Confirm that you’ve completed the prerequisites and click Next.

3. Enter access details:

1. Enter your AWS account ID.
2. Enter your bucket name. The name is case-sensitive and must match exactly.
3. Confirm the name of the IAM role you created in the prerequisite steps.
4. Confirm the External ID you created in the prerequisite steps.
5. (Optional) Enter a name for your folder.

4. Click Validate.

5. Click Next.

Review and submit your import plan

1. Review your import destination and access details. If you need to make any changes, click the Edit icon.
2. Check the box to confirm that you’ve read and understand the information in this reference guide.
3. Click Submit Plan.

Inviting another user to configure an import plan

If a different member of your organization needs to configure the import plan for a project, you can invite them to do so in Lyve Management Portal. See Invite Another User to Configure an Import Plan.

Naming guidelines

Best practices

See the following knowledge base articles:

• Best practices for managing AWS access keys
• Security Best Practices for Amazon S3
• Access control best practices
• Creating Amazon S3 backups
• Restoring S3 data

Troubleshooting

See the following knowledge base article:

• Troubleshooting