---
title: "Prerequisites to Deploy a vNIOS Instance"
canonical: "https://docs.infoblox.com/space/NAIG/636354593/Prerequisites%20to%20Deploy%20a%20vNIOS%20Instance"
format: markdown
---
Before deploying vNIOS for AWS instances in the AWS cloud, ensure your setup meets the requirements in this topic.

This topic also includes HA-specific prerequisites to deploy instances with high availability (HA).

- Set up a registered AWS account.  
According to the region, the account must be registered at:
  - For AWS global regions: www.amazon.com
  - For AWS China: www.amazonaws.cn
- If you plan to configure a vNIOS appliance as an AWS API proxy, obtain the access key ID and secret access key pair. You will use the key pair to provide AWS access to NIOS cloud admins. For information, see *[Configuring AWS Access for NIOS Cloud Admins](https://infoblox-docs.atlassian.net/wiki/spaces/NAIG/pages/37454198)* and *[Using the Infoblox vNIOS for AWS API Proxy](https://infoblox-docs.atlassian.net/wiki/spaces/NAIG/pages/38109527)*.  
The access key ID and secret access key pair is required when you configure a vNIOS for DNS synchronization and vDiscovery. For more information, see *[Amazon Route 53 Integration](https://infoblox-docs.atlassian.net/wiki/spaces/NAIG/pages/277546012)* and *[vDiscovery on AWS VPCs](https://infoblox-docs.atlassian.net/wiki/spaces/NAIG/pages/37650904)* respectively.
- In the Amazon EC2 console, complete the following:
  - Create a VPC and a minimum of two subnets that are required to launch the vNIOS instance. You can use vNIOS for AWS to control, provision, and manage IP addresses in your AWS VPCs.
    - For instructions on how to create and deploy VPCs and subnets, and for more information about VPCs, see *[Deploy AWS VPC](https://docs.infoblox.com/space/DeploymentGuidevNIOSforAWS/736297360/Deploy+AWS+VPC+(Optional))*.
    - For different types of VPC deployments, see *[Shared-Services VPC Deployments](https://infoblox-docs.atlassian.net/wiki/spaces/NAIG/pages/37683496)* and *[Multiple-VPCs Full-Public-Cloud Deployment](https://infoblox-docs.atlassian.net/wiki/spaces/NAIG/pages/37454256)*.
  - Create an IAM role profile with the permissions defined in the *[Defining an IAM Role](#Define_IAM_Role)* section.
- Install AWS CLI. This is required for AWS China deployments, for setting up vNIOS as an AWS API proxy, or if you are manually converting the vNIOS .vmdk image to an AMI.
- Configure AWS credentials for the account used to run the CLI commands. This is required when using temporary credentials or an assumed role.
  - To configure, run the `aws configure` command and specify the access key ID, access key, and the region when prompted.  
Example:  
`$ aws configure`  
`AWS Access Key ID: EXAMPLEID`  
`AWS Secret Access Key: xxxxxx1234`  
`Default region name: <region_name>`  
`Default output format: json`
  - For AWS global regions, refer to [AWS Regions](https://docs.aws.amazon.com/global-infrastructure/latest/regions/aws-regions.html).
  - The supported regions for AWS China are:  
- `cn-north-1`  
- `cn-northwest-1`

> ⚠️ **Note**
> ⚠️ 
> ⚠️ After deploying the instances in AWS, ensure that the time on the HA nodes in NIOS is synchronized with the local time.  
> ⚠️ You can configure NTP servers on the vNIOS appliance and enable the NTP service to synchronize time on the appliance. For information about how to set up the NTP server, refer to the* **[Infoblox NIOS Documentation](https://docs.infoblox.com/)*.

# > Macro (anchor)

Defining an IAM Role

Create an IAM instance profile with a policy that has required permissions and attach the policy to the IAM role. You will then assign the IAM role to the AWS instance as defined in the *[Attaching an IAM Role to the vNIOS Instance](https://infoblox-docs.atlassian.net/wiki/spaces/NAIG/pages/2647064580)* section to assign HA related access permissions to the instance.

## Creating a Policy

Create a policy in AWS by specifying the permissions listed in this section.

To create a policy in the AWS portal, complete the following steps:

1. Sign in to the *AWS Management Console*.
2. In the *AWS Management Console* home page, search for and click **IAM**.
3. In the left navigation panel, expand **Access management** and click **Policies**.
4. Click the **Create policy** button.
5. On the *Specify permissions* page, add actions to the policy by copying the sample JSON scripts given in the below sections and pasting it in the **JSON** tab > **Policy editor** box, and then click **Next**.
  - *[Sample JSON Script with Permissions to Convert a Disk Image to an AMI](#Policy_JSON_all_Deplpyments)*
  - *[Sample JSON Script for HA](#Policy_JSON_HA)*
6. On the *Review and create* page, specify a **Policy name** and review the permissions.
7. Click **Create policy**.

## Sample JSON Scripts

Consider the following when editing a sample JSON script:

- When you copy the entire JSON script, values such as the account ID are not automatically populated and hence you must specify them manually.
- The set of permissions included in the JSON script, is a minimum requirement to perform the defined tasks such as allowing a VM instance to manage resources in the AWS cloud. You may add more permissions to the role, but Infoblox recommends that you do not remove any permission from the required list.

### > Macro (anchor)

Sample JSON Script with Permissions to Convert a Disk Image to an AMI

The permissions listed below are required for AWS deployments to convert a .vmdk image to an AMI. These permissions grant access to Amazon S3 buckets, read VM images, and create Amazon Machine Images (AMIs).

The following script has permissions needed for disk import:

`{`  
`    "Version": "2012-10-17",`  
`    "Statement": [`  
`        {`  
`            "Effect": "Allow",`  
`            "Action": [`  
`                "s3:GetBucketLocation",`  
`                "s3:GetObject",`  
`                "s3:ListBucket",`  
`                "s3:PutObject",`  
`                "s3:GetBucketAcl"`  
`            ],`  
`            "Resource": [`  
`                "arn:<partition>:s3:::<bucketname>,`  
`                "arn:<partition>:s3:::<bucketname>/*"`  
`            ]`  
`        },`  
`        {`  
`            "Effect": "Allow",`  
`            "Action": [`  
`                "ec2:ImportSnapshot",`  
`                "ec2:ImportImage",`  
`                "ec2:DescribeImportSnapshotTasks",`  
`                "ec2:DescribeSnapshots",`  
`                "ec2:CancelImportTask",`  
`                "ec2:ModifySnapshotAttribute",`  
`                "ec2:CopySnapshot",`  
`                "ec2:CreateTags",`  
`                "ec2:RegisterImage",`  
`                "ec2:Describe*"`  
`            ],`  
`            "Resource": "*"`  
`        }`  
`    ]`  
`}`


For the resource`<partition>`, specify one of the following:

- `aws` for AWS global regions
- `aws-cn` for AWS China

| **Action** | **Description** |
| --- | --- |
| `s3:GetBucketLocation` | Gives permission to retrieve the region in which an Amazon S3 bucket resides. |
| `s3:GetObject` | Gives permission for retrieving objects from Amazon S3. |
| `s3:ListBucket` | Gives permission to list some or all objects in an Amazon S3 bucket (up to 1000). |
| `s3:PutObject` | Gives permission to add an object to a bucket. |
| `s3:GetBucketAcl` | Gives permission to use the acl subresource to return the access control list (ACL) of an Amazon S3 bucket. |
| `ec2:ImportSnapshot` | Gives permission to import a disk into a snapshot. |
| `ec2:ImportImage` | Gives permission to import single or multi-volume disk images or EBS snapshots into an AMI. |
| `ec2:DescribeImportSnapshotTasks` | Gives permission to describe the import snapshot tasks. |
| `ec2:DescribeSnapshots` | Gives permission to describe one or more EBS snapshots. |
| `ec2:CancelImportTask` | Gives permission to cancel an in-process import task. |
| `ec2:ModifySnapshotAttribute` | Gives permission to add or remove permission settings for a snapshot. |
| `ec2:CopySnapshot` | Gives permission to copy a point-in-time snapshot of an EBS volume and store it in the Amazon S3 bucket. |
| `ec2:CreateTags` | Gives permission to add or overwrite one or more tags for Amazon EC2 resources. |
| `ec2:RegisterImage` | Gives permission to register an Amazon Machine Image (AMI). |
| `ec2:Describe` | Gives permission to view metadata about EC2 resources such as instances. |

### > Macro (anchor)

Sample JSON Script for HA Deployments

The permissions below are the minimum required for VM instances to manage AWS cloud resources. For detailed instructions, see the AWS documentation.

`{`  
`    "Version": "2012-10-17",`  
`    "Statement": [`  
`        {`  
`            "Sid": "VisualEditor0",`  
`            "Effect": "Allow",`  
`            "Action": [`  
`                "ec2:UnassignPrivateIpAddresses",`  
`                "ec2:AssignPrivateIpAddresses",`  
`                "ec2:DescribeNetworkInterfaces",`  
`                "iam:ListRoles",`  
`                "iam:ListAttachedRolePolicies",`  
`                "iam:GetPolicy",`  
`                "iam:GetPolicyVersion",`  
`                "iam:GetRole"`  
`            ],`  
`            "Resource": [`  
`                "arn:<partition>:ec2:*:<account_id>:network-interface/*",`  
`                "*"`  
`            ]`  
`        }`  
`    ]`  
`}`  


- For resource `<partition>`, specify:
  - `aws` for AWS global regions
  - `aws-cn` for AWS China
- For AWS China, use the resource as:  
`"Resource”:`  
`    “arn:aws-cn:ec2::<account_id>:network-interface/“`
- To allow access to resources, you must set the `Effect` element to `Allow`
- NIOS uses the roles with read permissions to run a check and validate the configuration on the host.
- NIOS uses the roles with write permissions to unassign and assign private and public IP addresses during an HA failover. The following permissions provide write access:

| **Action** | **Description** |
| --- | --- |
| `ec2:UnassignPrivateIpAddresses` | Gives permission to unassign private IP addresses from network interfaces during an HA failover. |
| `ec2:AssignPrivateIpAddresses` | Gives permission to assign private IP addresses to network interfaces during an HA failover. |
| `ec2:DescribeNetworkInterfaces` | Gives permission to describe one or more network interfaces. |
| `iam:ListRoles` | Gives permission to list the IAM roles that have the specified path prefix. |
| `iam:ListAttachedRolePolicies` | Gives permission to list all managed policies that are attached to the specified IAM role. |
| `iam:GetPolicy` | Gives permission to retrieve information about the specified managed policy, including the policy's default version and the total number of identities to which the policy is attached |
| `iam:GetPolicyVersion` | Gives permission to retrieve information about a version of the specified managed policy, including the policy document. |
| `iam:GetRole` | Gives permission to retrieve information about the specified role, including the role's path, GUID, ARN, and the role's trust policy |
| `ec2:AssociateAddress` | Associates the configured public IP address with the private IP address.<br>If you intend to use a public IP address to access the HA Grid from outside of your virtual network, include this role permission. |
| `ec2:DescribeAddresses` | Gives permission to view information about elastic IP address in AWS. |

## Adding an IAM Role to the Instance Profile

Create a role by assigning the policy that you created. When you create a role in the AWS Management console, an instance profile with the same name as the role is automatically created, which can be used to pass the role information to a vNIOS instance. For detailed instructions, refer to the AWS documentation.

If you are converting the NIOS .vmdk disk to AMI, you must create an IAM service role by name `vmimport`.

In the AWS portal, complete the following steps:

1. In the left navigation panel, expand **Access management** and click **Roles**.
2. Click the **Create role** button.
3. On the *Select trusted entity* page:
  1. Select the entity type as **AWS service**.
  2. Select **EC2** in the **Service or use case** drop-down list for the vNIOS instance to call the AWS service.
  3. Click **Next**.
4. On the *Add Permissions* page:
  1. Search for and select the policy that you created and click **Next**.
  2. On the *Name, review, and create* page, type a name to the role.  
**Note**: Specify `vmimport` as the name if you are converting the .vmdk image to AMI. The `aws ec2 import-snapshot` command uses the VM Import/Export service role.
  3. Click **Create role**.

> ⚠️ **Note**
> ⚠️ 
> ⚠️ When attaching the policy to an existing role, ensure to choose the option **Attach policies** instead of **Create inline policy** because HA will not work with inline policies. To attach:  
> ⚠️ On the *Roles* page > click the <role> > **Permissions** tab > **Add Permissions** drop-down list choose **Attach policies** > select the policy.

For more information about Amazon IAM, see the Amazon IAM documentation page at [http://docs.aws.amazon.com/IAM/latest/UserGuide/IAM_Introduction.html](http://docs.aws.amazon.com/IAM/latest/UserGuide/IAM_Introduction.html).