Backup and Recovery

The following topics describe the connection profile parameters for backup and recovery platforms and services:

AWS Backup Connection Profile Parameters

Before you can define a job, you must create a connection profile in the Configuration domain. A connection profile contains authorization credentials—such as the username, password, and other plug-in-specific parameters—and enables you to connect to the application server with only the connection profile name. To create a connection profile, see Creating a Centralized Connection Profile.

For more information about this plug-in, see Control-M for AWS Backup.

The following table describes the AWS Backup connection profile parameters.

Attribute

Description

AWS Backup URL

Determines the authentication endpoint for AWS Backup, based on the following format:

https://backup.<AWS Region>.amazonaws.com

AWS Region

Determines the AWS region where the job is located.

us-east-2

Authentication

Determines one of the following authentication methods:

  • AWS Key & Secret: Authenticates with an AWS access key and secret, which are used by services outside the AWS infrastructure.

  • AWS IAM Role: Authenticates with an AWS IAM role from within the AWS infrastructure, which removes the need to provide additional credentials.

AWS Access Key

Defines the access key assigned to the account with the relevant permissions to the AWS service.

AWS Secret

Defines the secret access key assigned to the account with the relevant permissions to the AWS service.

IAM Role

Defines the Identity and Access Management (IAM) role name for the AWS service connection.

Use External Vault

Determines whether to retrieve secret parameter values from an external vault, as described in CyberArk Secret Parameters in Connection Profiles.

Connection Timeout

Determines the number of seconds to wait after Control-M initiates a connection request before a timeout occurs.

Default: 20

AWS DataSync Connection Profile Parameters

Before you can define a job, you must create a connection profile in the Configuration domain. A connection profile contains authorization credentials—such as the username, password, and other plug-in-specific parameters—and enables you to connect to the application server with only the connection profile name. To create a connection profile, see Creating a Centralized Connection Profile.

For more information about this plug-in, see Control-M for AWS DataSync.

The following table describes the AWS DataSync connection profile parameters.

Attribute

Description

AWS DataSync URL

Determines the authentication endpoint for AWS DataSync, based on the following format:

https://datasync.<AWS Region>.amazonaws.com

AWS Logs URL

Defines the AWS Logs URL, based on the following format:

https://logs.<AWS Region>.amazonaws.com

AWS Region

Determines the AWS region where the job is located.

us-east-2

AuthenticationDetermines the AWS region where the job is located.us-east-2

Determines one of the following authentication methods:

  • AWS Key & Secret: Authenticates with an AWS access key and secret, which are used by services outside the AWS infrastructure.

  • AWS IAM Role: Authenticates with an AWS IAM role from within the AWS infrastructure, which removes the need to provide additional credentials.

AWS Access Key

Defines the access key assigned to the account with the relevant permissions to the AWS service.

AWS Secret

Defines the secret access key assigned to the account with the relevant permissions to the AWS service.

You can use Secrets in Code to hide this value in the code.

IAM Role

Defines the Identity and Access Management (IAM) role name for the AWS service connection.

Use External Vault

Determines whether to retrieve secret parameter values from an external vault, as described in CyberArk Secret Parameters in Connection Profiles.

Connection Timeout

Determines the number of seconds to wait after Control-M initiates a connection request before a timeout occurs.

Default: 30

Azure Backup Connection Profile Parameters

Before you can define a job, you must create a connection profile in the Configuration domain. A connection profile contains authorization credentials—such as the username, password, and other plug-in-specific parameters—and enables you to connect to the application server with only the connection profile name. To create a connection profile, see Creating a Centralized Connection Profile.

For more information about this plug-in, see Control-M for Azure Backup.

The following table describes the Azure Backup connection profile parameters.

Attribute

Authentication Method

Description

Azure Login URL

  • Service Principal

  • Managed Identity

Defines the base URL of the Microsoft Entra/Azure AD authentication endpoint.

Azure Management URL

  • Service Principal

  • Managed Identity

Defines the endpoint that enables you to perform API calls and retrieve the token for authentication.

Default: https://management.azure.com

Subscription ID

  • Service Principal

  • Managed Identity

Defines the Azure account ID of your organization.

Authentication Method

  • Service Principal

  • Managed Identity

Determines one of the following authentication methods:

  • Service Principal: Access protected Azure services and resources based on roles assigned to the Service Principal by the Azure administrator. The Service Principal is also known as an App Registration. Use this method if Control-M/Agent is installed on-premises or on another (non-Azure) cloud vendor.

  • Managed Identity: Access protected Azure services and resources using a key created and managed by the Azure platform, without login credentials. Use this method if Control-M/Agent is installed on an Azure virtual machine that has a Managed Identity with the required permissions.

Specify Managed Identity Client ID

Managed Identity

Determines whether the managed identity is specified by the Managed Identity Client ID attribute.

Toggle on this option when you use the Managed Identity authentication method and there are multiple managed identities defined on your Azure VM.

Managed Identity Client ID

Managed Identity

Defines the client ID of the managed identity used for access.

This attribute requires a value only if there are multiple managed identities defined on your Azure VM and you toggle on Specify Managed Identity Client ID.

Tenant ID

Service Principal

Defines the Azure tenant ID for your organization.

Application ID

Service Principal

Defines the Registered App for the Azure service in your Microsoft Entra/Azure AD tenant. The corresponding Service Principal must be assigned the Owner or Contributor role for the Azure service.

Client Secret

Service Principal

Defines the password associated with the Service Principal/registered application.

Use External Vault

Service Principal

Determines whether to retrieve secret parameter values from an external vault, as described in CyberArk Secret Parameters in Connection Profiles.

Connection Timeout

  • Service Principal

  • Managed Identity

Determines the number of seconds to wait after Control-M initiates a connection request before a timeout occurs.

Default: 60