Import to Amazon S3

Prerequisites

Before you can configure and submit your import plan, make sure to complete the following steps so that Lyve Import Service can securely access your specified Amazon S3 bucket to import your data.

Recommendations

Seagate strongly recommends the following best practices:

• Create a bucket dedicated to your import plan.
• Block all public access for your bucket.
• Ensure bucket versioning is disabled.
• Ensure server-side encryption is enabled.
• Create an IAM Permission Policy.
• Create an IAM Role trusting Lyve Import Service, attaching the IAM policy you created.
• Disable or delete the role after the import plan has ended.
• Disable or delete the policy after the import plan has ended.

Amazon IAM Permission Policy example

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
        { 
            "Sid": "LyveMobilePolicyTemplate", 
            "Effect": "Allow", 
            "Action": [ 
                "s3:PutObject", 
                "s3:GetObject", 
                "s3:ListBucketMultipartUploads", 
                "s3:AbortMultipartUpload", 
                "s3:GetObjectAttributes", 
                "s3:CreateBucket", 
                "s3:ListBucket", 
                "s3:GetAccelerateConfiguration",
                "s3:DeleteObject", 
                "s3:GetBucketLocation",
                "s3:ListMultipartUploadParts"  
            ], 
            "Resource": [ 
                "arn:aws:s3:::{bucketname}", 
                "arn:aws:s3:::{bucketname}/*"
             ]
         }   
     ]
 }        

Complete the prerequisites

• All devices within a subscription must be imported to the same destination and region.
• You will be required to enter and validate your bucket credentials.

1. On your Home page, select Subscriptions from the sidebar.

2. Select a Lyve Mobile service subscription from the list that includes a Cloud Import plan.
3. Select Import Plans in the sidebar, or select the link at the top of the page:

4. Confirm the Cloud Destination and Region. Select Next.
5. Complete the steps below so that Lyve Import Service can securely access your AWS S3 destination.

 For helpful instructions related to each configuration step for your chosen cloud destination, select the Instructions link in Lyve Management Portal.

Create an IAM Permission Policy on your bucket

1. Log in to your AWS Console.
2. Enter the IAM service.





3. Select Policies.





Click the Create policy button.



4. Click on the JSON tab.





5. Copy the provided JSON script below:

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
        { 
            "Sid": "LyveMobilePolicyTemplate", 
            "Effect": "Allow", 
            "Action": [ 
                "s3:PutObject", 
                "s3:GetObject", 
                "s3:ListBucketMultipartUploads", 
                "s3:AbortMultipartUpload", 
                "s3:GetObjectAttributes", 
                "s3:CreateBucket", 
                "s3:ListBucket", 
                "s3:GetAccelerateConfiguration",
                "s3:DeleteObject", 
                "s3:GetBucketLocation",
                "s3:ListMultipartUploadParts" 
            ], 
            "Resource": [ 
                "arn:aws:s3:::{bucketname}", 
                "arn:aws:s3:::{bucketname}/*"
             ]
         }   
     ]
 }        

6. Paste the copied text into the JSON editor.
7. Replace {bucketname} with the name of the bucket you want to import your data to.
8. Click the Next: Tags button.
9. Add tags (optional) and click the Next: Review button.
10. On the Review policy page, name the policy LyveMobileAccessPolicy.





11. .Click Create policy

Create an IAM role trusting Lyve Import Service

1. In the sidebar, click Roles. Click the Create role button.





2. On the Select trusted entity page, select Custom trust policy.





3. Copy the provided trust policy below:



{ 
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"AWS": "arn:aws:iam::{accountid}:root"
			},
			"Action": "sts:AssumeRole",
			"Condition": {
				"ForAnyValue:StringEqualsIfExists": {
					"sts:ExternalId": [
						"{externalid}"
					]
				}
			}
		}
	]
} 



4. Paste the copied text into the JSON editor.
5. Replace {accountid} with the value you copied for Lyve’s S3 Account ID. Replace {externalid} with the value you copied for External ID.
6. On the Add permissions page, add the LyveMobileAccessPolicy you created earlier and click Next.



If you have multiple import plans to configure, add the external ID for each plan separated with a comma (,). For example:

{ 
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"AWS": "arn:aws:iam::{accountid}:root"
			},
			"Action": "sts:AssumeRole",
			"Condition": {
				"ForAnyValue:StringEqualsIfExists": {
					"sts:ExternalId": [
						"{firstexternalid}",
    						"{secondexternalid}",
    						"{thirdexternalid}"
					]
				}
			}
		}
	]
}



7. Click Next to exit the JSON editor.
8. On the Add permissions page, add the LyveMobileAccessPolicy you created earlier and click Next.





9. On the Name, review, and create page, enter a Role name, for example, LyveMobileAccessRole.





10. Review the trusted entity and permissions information:

Ensure the following

1. “AWS” is paired with the value you copied for Lyve’s S3 Account ID.
2. “sts:ExternalID” is paired with the value you copied for External ID.
3. The Policy name is the LyveMobileAccessPolicy you created earlier.

Configure your import plan

After you’ve completed the prerequisites above, return to Lyve Management Portal and enter your access details.

1. On your Home page, select Subscriptions from the sidebar.
2. Select a Lyve Mobile service subscription from the list that includes a Cloud Import plan.
3. Select Import Plans in the sidebar, or select the link at the top of the page:

3. Select the + Credentials button in the upper right corner of the page.
4. Confirm your AWS S3 cloud destination and region, and then select Next.
5. Enter your Account ID and specify an existing bucket for the subscription. Select Validate Credentials.

6. To enable the checkbox, select the IP Address Access Guide link.
7. Check the checkbox, and then select Submit.

Inviting another user to configure an import plan

If a different member of your Org needs to configure the import plan for a Lyve Mobile subscription, you can invite them to do so in Lyve Management Portal.

• The person must be a member of the Org containing the Lyve Mobile subscription to which you want to add the import plan. See Manage Org members in the Lyve Management Portal User Manual.
• The member must be given the Manage Import Plans permission. See Manage subscription members in the Lyve Management Portal User Manual.

Naming guidelines

Best practices

See the following knowledge base articles:

• Best practices for managing AWS access keys
• Security Best Practices for Amazon S3
• Access control best practices
• Creating Amazon S3 backups
• Restoring S3 data

Troubleshooting

See the following knowledge base article:

• Troubleshooting