Editing a cloud tiering schedule
After you create a cloud tiering schedule, you can edit the schedule by completing the following steps.
To edit a cloud tiering schedule
- In the navigation menu, expand Cloud Storage, and then click Cloud Tier.
The Cloud Tier page displays.
- On the Cloud Tier page, to reveal the scheduling options, click Schedule.
- For each time you want to change, do either of the following steps:
- To delete a time, click the trash can symbol.
- To change a time, click the box, select a new time, and then click Set.
- When finished, click Save.
- To hide the schedule options, click Schedule.
Deleting a cloud tier
Before deleting a cloud tier, review the details below:
- Only the files for whom the on-premises retention age applies and the file data which resides in the cloud will be removed locally.
- Data in the cloud bucket has to be deleted manually.
- Cloud policy settings on the source containers will be removed and the source container made available for cloud replication to a new cloud or archive tier.
Deleting a cloud tier from the GUI
To delete a cloud tier, complete the following steps.
- In the navigation menu, click Cloud Storage to expand the menu, then click Cloud Tier.
- Click Delete.
- When prompted to confirm, click Delete.
- In the Passphrase field, enter the passphrase used for Cloud Tier encryption. This provides validation that the person deleting the cloud tier has the appropriate authorization.
- Review the containers linked to the cloud tier and confirm that data in these containers can be deleted. Any containers with managed replication configured must be deleted manually before the cloud tier can be deleted.
- Click Delete.
Deleting a cloud tier from the CLI
- Access the QoreStor CLI. Refer to Using the QoreStor command line for more information.
- Delete your cloud tier using the command below. Refer to the QoreStor Command Line Reference Guide for more information.
cloud_tier --delete
- At the prompt, enter y for yes and press [Enter].
Configuring a cloud or archive tier
Cloud and archive and tiers can be configured via the UI or via the cloud_tier command in the QoreStor CLI. Before configuring an archive tier, ensure the following requirements are met:
- Your cloud storage must be configured prior to configuring a cloud or archive tier.
- Archive tier is not supported when QoreStor is installed in Cloud Optimized mode, Object Direct Small mode, or Demo mode.
- Permissions for your cloud storage must be correctly configured. Refer to Configuring required permissions to restore from Archive Tier for more information.
- Only RDA, VTL, and Object containers can be configured to tier data to Archive Tier.
|
|
NOTE: QoreStor's archive tier functionality relies on Amazon S3 Glacier and/or Amazon S3 Glacier Deep Archive storage. Before configuring an archive tier, your cloud archive storage must be properly configured. Please refer to the Amazon S3 documents below for more information:
|
Configuring required permissions to restore from Archive Tier
For QoreStor to perform batch operations for restoring objects to Amazon S3 storage from Amazon S3 Glacier or Amazon S3 Glacier Deep Archive storage, you must configure an AWS IAM policy with the required permissions and then attach the policy to your AWS account used to access the for accessing AWS S3 storage.
|
|
NOTE: When crating an archive tier after upgrading to QoreStor 7.1, the default mode of restores is Lambda. If you create the archive tier before upgrading to QoreStor 7.1, the upgrade automatically switches the restores from Batch operations to Lambda. To change this option, see Editing an archive tier restore mode using the command line interface. |
To configure required permissions to restore from Archive Tier
- From the AWS console, go to the IAM dashboard.
- Create a new role for allowing batch jobs for archive tier restore and attach a policy with the following permissions from the JSON document:
{ |
"Version": "2012-10-17", |
"Statement": [ |
{ |
"Sid": "VisualEditor0", |
"Effect": "Allow", |
"Action": [ |
"s3:GetObject", |
"s3:RestoreObject", |
"lambda:InvokeFunction", |
], |
"Resource": [ |
"arn:aws:lambda:*:<account_id>:function:*", |
"arn:aws:s3:::<S3_bucket_for_archive_tier>/*" |
] |
}, |
{ |
"Sid": "VisualEditor1", |
"Effect": "Allow", |
"Action": "s3:PutObject", |
"Resource": "arn:aws:s3:::<S3_bucket_for_archive_tier>/batch/*" |
} |
] |
} |
|
|
- Set the Trust Relationship to the Role for Batch and Lambda services by going to Role>Trust>Relationships>Edit Trust Relationship, and then replace the policy defined in JSON with the following policy document:
Trust Relationship policy
{ |
"Version": "2012-10-17", |
"Statement": [ |
{ |
"Effect": "Allow", |
"Principal": { |
"Service": "batchoperations.s3.amazonaws.com" |
}, |
"Action": "sts:AssumeRole" |
}, |
{ |
"Effect": "Allow", |
"Principal": { |
"Service": "lambda.amazonaws.com" |
}, |
"Action": "sts:AssumeRole" |
} |
] |
} |
You now have a new role with an attached policy and trust relationships for Batch and Lambda.
|
|
NOTE: Take note of the Role ARN to use later when you configure User permissions. |
- Give the IAM User the required permissions for cloud archive replication, beginning with a new policy, by completing the following steps:
- Create a new policy by going to IAM>Policies>Create Policy.
- Select the JSON for permissions.
- Replace the JSON with the following policy document, and then save it:
Replacement policy document
{ |
"Version": "2012-10-17", |
"Statement": [ |
{ |
"Sid": "VisualEditor0", |
"Effect": "Allow", |
"Action": [ |
"lambda:CreateFunction", |
"iam:GetRole", |
"lambda:InvokeFunction", |
"lambda:GetFunction", |
"lambda:UpdateFunctionConfiguration", |
"s3:RestoreObject", |
"s3:CreateBucket", |
"lambda:GetFunctionConfiguration", |
"s3:ListBucket", |
"lambda:PutFunctionConcurrency", |
"lambda:UpdateFunctionCode", |
"s3:PutObject", |
"s3:GetObject", |
"iam:PassRole", |
"lambda:GetFunctionConcurrency", |
"lambda:DeleteFunction", |
"lambda:DeleteFunctionConcurrency", |
"s3:DeleteObject", |
"s3:DeleteBucket" |
], |
"Resource": [ |
"arn:aws:iam::<account_id>:role/IAMLambdaOps_Restrictive", <This is the ARN of the Role previously created. You can determine account ID from ARN itself.> |
"arn:aws:lambda:*:<account_id>:function:QorestorArchiveRestore" <QorestorArchiveRestore is the Lambda function provided by Quest.> |
"arn:aws:s3:::<S3_bucket_for_archive_tier>" |
] |
}, |
{ |
"Sid": "VisualEditor1", |
"Effect": "Allow", |
"Action": "s3:ListAllMyBuckets", |
"Resource": "*" |
}, |
{ |
"Sid": "VisualEditor2", |
"Effect": "Allow", |
"Action": [ |
"s3:DescribeJob", |
"s3:UpdateJobPriority", |
"s3:UpdateJobStatus" |
], |
"Resource": "arn:aws:s3:*:<account_id>:job/*" |
}, |
{ |
"Sid": "VisualEditor3", |
"Effect": "Allow", |
"Action": [ |
"s3:ListJobs", |
"s3:CreateJob" |
], |
"Resource": "arn:aws:s3:*:<account_id>:job/*" |
} |
] |
} |
|
The policy creation is complete. Check that the permissions you entered are saved in the policy JSON document.
- To create an IAM User for the archive tier, go to IAM Dashboard>Users>Add User and complete the following steps:
- On the Add user page under Select AWS access type, to generate the access_key and secret_key, select Programmatic access.
- On the Permissions page, select Attach existing policy directly, and then select the policy you created in Step 1 to attach to this user.
- Following the directions in the remaining two tabs to finish creating the user.
|
|
NOTE: Be sure to download the access_keys for this user to use when creating an archive tier in QoreStor. |
