# 3 Start Using N2W
N2W opens to the Dashboard – an overview of recent backups, recoveries, alerts, resources, and costs.
Depending on your device resolution, the **Alerts** tile may not appear in the Dashboard. Regardless of screen resolution, all Alerts are available by selecting **Alerts** in the toolbar.
The first step in using N2W is to associate one or more of your cloud accounts with N2W.
* With AWS accounts you will be able to:
* Perform backup and recovery operations for a variety of AWS resource types
* Perform Disaster Recovery (DR)
* Copy to a Storage Repository (AWS S3, Azure, Wasabi)
* Manage volume usage
* Monitor costs and savings
* With Azure accounts, you will be able to perform backup and recovery operations for Azure VMs, SQL Servers, and Disks, and copy to a Storage Account. See section [26](https://docs.n2ws.com/user-guide/26-using-n2ws-with-azure) for complete details.
* With Wasabi accounts, you will be able to create a Storage type account. See section [27](https://docs.n2ws.com/user-guide/27-using-wasabi-storage).
## 3.1 Associating an AWS Account
To associate an AWS account for Recovery, you will need to either:
* Enter AWS credentials consisting of an access key and a secret key, or
* Use an IAM role, either on the N2W server instance or cross-account roles.
Following are the steps to associate an N2W account with an AWS account:
1. To manage your users and roles and obtain AWS credentials, go to the IAM console at
1. Follow the directions to either add a new account or view an existing account.
2. Capture the AWS credentials.
2. If the AWS account will be operating in special regions, such as China Cloud or US Government Cloud, see section [3.1.5](#3.1.5-special-regions) *before* adding the account in N2W.
3. To associate the AWS account with an N2W account, go to N2W:
1. In the left panel, select the **Accounts** tab.
2. b. In the **New** menu, select **AWS** account.
3. Complete the fields, entering the required information for the **Account Type** and **Authentication** method.
{% hint style="info" %}
You can add as many AWS accounts as your N2W edition permits.
{% endhint %}
### 3.1.1. Account Type
If you are using the Advanced or Enterprise Edition or a free trial, you will need to choose an account type.
* The **Backup** account is used to perform backups and recoveries and is the default 3333.
* The **DR** account is used to copy snapshots to as part of cross-account functionality.
* You choose whether this account is allowed to delete snapshots. If the account not allowed to delete snapshots when cleaning up, the outdated backups will be tagged. Not allowing N2W to delete snapshots of this account implies that the presented IAM credentials do not have the permission to delete snapshots.
* Enable **Use Secured DR Account** to select specific permissions for resource types and activities for prohibition. The **Secured DR Account Check** operation warns the N2W user about the existence of Prohibited Permissions in IAM policies of the DR account. Turn on the **Check Secured DR Account Periodically** toggle to perform a period check of whether the DR account backups are compromised by the presence of the prohibited permissions. For details about period and immediate checking of the account, see section [3.1.4](#3-2-1-checking-secured-dr-accounts).
* The **Storage** type account is used to receive backups for subsequent recovery or safekeeping. Wasabi accounts are **Storage** type accounts. See section [27](https://docs.n2ws.com/user-guide/27-using-wasabi-storage).
For accounts operating in special regions, in the **AWS Cloud Type** list, select the type of AWS cloud. See section [3.1.5](#3.1.5-special-regions).
### 3.1.2. Authentication
N2W Supports the following methods of authentication:
* **IAM User** - Authentication using IAM credentials, access and secret keys.
{% hint style="warning" %}
Using IAM User credentials is not recommended as they are less secure than using IAM roles.
{% endhint %}
* **CPM Instance IAM Role** – If an IAM role was assigned to the N2W server at launch time or later, you can use that IAM role to manage backups in the same AWS account the N2W server is in.
{% hint style="info" %}
Only the root/admin N2W user is allowed to use the IAM role.
{% endhint %}
* **Assume Role** – This type of authentication requires another AWS account already configured in N2W. The operation of using one account to take a role and accessing another account is called **assume role**.
* To allow one account to access another account, define a cross-account role in the target account and allow access from the source account.
* Regions must be enabled in both the source and target accounts.
{% hint style="info" %}
You can add as many AWS accounts as your N2W edition permits.
{% endhint %}
**To allow account authentication using Assume Role in N2W**:
1. In the **Authentication** box, choose **Assume Role**.
2. In the **Account Number** box, type the 12-digit account number, with no hyphens, of the target account.
3. In the **Role to Assume** box, type the role name, not the full Amazon Resource Name (ARN) of the role. N2W cannot automatically determine what the role name is, since it is defined at the target account, which N2W has no access to yet.
4. The **External ID** box is optional unless the cross-account role was created with the **3rd party** option.
5. In the **Assuming Account** list, choose the account that will assume the role of the target account. If you are the root user or independent user and have managed users defined, an additional selection list will appear enabling you to select the user.
6. Select **Scan Resources** to include the current account in tag scans performed by the system. Once **Scan Resources** is **Enabled**:
1. In the **Scan Regions** list, select the regions to scan. To select all regions, select the check box at the top of the list. To filter regions, start typing in the search box.
2. In the **Scan Resource Types** list, select the types of resources to scan. Select the top check box for all, or use the search box to filter types.
7. The **Capture VPCs** option defaults to enabled. Clear **Capture VPCs** to disable for this account. See section [23](https://docs.n2ws.com/user-guide/23-capturing-and-cloning-in-vpc-environments).
8. The **Use accurate volume usage** option defaults to enabled. Clear to disable for this account. See section[ ](https://docs.n2ws.com/user-guide/25-monitoring-costs-and-savings)[25](https://docs.n2ws.com/user-guide/25-monitoring-costs-and-savings).
9. Select **Save**.
{% hint style="info" %}
Scanning only specific resource types can reduce tag scan processing time and is useful when user permissions are limited to certain resource types.
{% endhint %}
### 3.1.3 Secured DR Account
The N2W Secured DR account feature hardens N2W security. It allows the N2W user to better protect the backups of his resources by making sure that backups kept in the DR account are not compromised by unwanted permissions. N2W can perform a periodic check to alert the user about IAM Users/Roles of the DR account that have unwanted IAM permissions.
The risk of unwanted permissions is demonstrated in the following example:
* If an IAM Role of a DR account has an attached policy that includes the “**ec2:DeleteSnapshot**” permission, the snapshot is in danger of getting deleted.
The N2W user has the flexibility of defining risky permissions for an account.
**To define a 'Secured' DR Account and prohibited permissions:**
1. In the **Accounts** tab, select a DR account, and then select **Edit**.
2. Select **Use Secured DR Account,** and then select **Select Prohibited Permissions**. By default, *all* permissions are prohibited.
3. For each type of target or action, clear the permissions to be 'allowed', and then select **Apply**.
4. Select **Save**.
N2W will check for policies whose account has permissions defined as 'prohibited' and list them as compromised in the check log. You can then generate the Secured DR Account Report to identify the accounts and policies at risk. See section [3.1.4](#3-2-1-checking-secured-dr-accounts).
The required IAM permissions for the DR account to check its users and roles are:
* iam:ListUsers
* iam:ListRoles
* iam:SimulatePrincipalPolicy
* iam:ListAccessKeys, for authentication
{% hint style="warning" %}
Removing permissions may compromise the safety of N2W backups. If permissions are removed, a warning alert for the secured DR account will appear as a potential backup risk.
{% endhint %}
### 3.1.4 Checking Secured DR Accounts
Two reports are available for checking Secured DR Accounts. If the **Check Secured DR Account** ‘**Show Log**’ indicates that there are compromised permissions, then you can run the **Generate Secured DR Report** to view the policies and users with the compromised permissions.
* **Check Secured DR Account** – Creates a summary status log (**Show Log**) with the number of policies and accounts with compromised permissions. The check can be run periodically throughout the day or run immediately.
* **Generate Secured DR Report** - A detailed list of the AWS policies and the prohibited permissions that are compromised for an account of the current user.
**To check Secured DR Accounts:**
1. In the **General Settings** tab, select the **Security & Password** tab.
2. To check the DR accounts periodically during the day, select **Check Secured DR Account**, select an hourly interval in the **Secured DR Check Interval** list, and then select **Save**.
3. To run the report immediately, select **Check Secured DR Account Now**, and confirm**.**
1. To view the progress and status of the operation, select **Background Tasks** in the toolbar. **Background Tasks** only appears after the first **Check** **Secured DR Account** or **Clone VPC** operation. Select **View All Tasks**.
4. To view the log, select **Show Log**. To download, select **Download Log** in the upper right corner of the log. The `Secured_DR_Account_check_log__
in the toolbar.
The first step in using N2W is to associate one or more of your cloud accounts with N2W.
* With AWS accounts you will be able to:
* Perform backup and recovery operations for a variety of AWS resource types
* Perform Disaster Recovery (DR)
* Copy to a Storage Repository (AWS S3, Azure, Wasabi)
* Manage volume usage
* Monitor costs and savings
* With Azure accounts, you will be able to perform backup and recovery operations for Azure VMs, SQL Servers, and Disks, and copy to a Storage Account. See section [26](https://docs.n2ws.com/user-guide/26-using-n2ws-with-azure) for complete details.
* With Wasabi accounts, you will be able to create a Storage type account. See section [27](https://docs.n2ws.com/user-guide/27-using-wasabi-storage).
## 3.1 Associating an AWS Account 
**New** menu, select **AWS** account.
3. Complete the fields, entering the required information for the **Account Type** and **Authentication** method.
{% hint style="info" %}
You can add as many AWS accounts as your N2W edition permits.
{% endhint %}
**Edit**.
2. Select **Use Secured DR Account,** and then select **Select Prohibited Permissions**. By default, *all* permissions are prohibited.
3. For each type of target or action, clear the permissions to be 'allowed', and then select **Apply**.
4. Select **Save**.
N2W will check for policies whose account has permissions defined as 'prohibited' and list them as compromised in the check log. You can then generate the Secured DR Account Report to identify the accounts and policies at risk. See section [3.1.4](#3-2-1-checking-secured-dr-accounts).
The required IAM permissions for the DR account to check its users and roles are:
* iam:ListUsers
* iam:ListRoles
* iam:SimulatePrincipalPolicy
* iam:ListAccessKeys, for authentication
{% hint style="warning" %}
Removing permissions may compromise the safety of N2W backups. If permissions are removed, a warning alert for the secured DR account will appear as a potential backup risk.
{% endhint %}
### 3.1.4 Checking Secured DR Accounts
Two reports are available for checking Secured DR Accounts. If the **Check Secured DR Account** ‘**Show Log**’ indicates that there are compromised permissions, then you can run the **Generate Secured DR Report** to view the policies and users with the compromised permissions.
* **Check Secured DR Account** – Creates a summary status log (**Show Log**) with the number of policies and accounts with compromised permissions. The check can be run periodically throughout the day or run immediately.
* **Generate Secured DR Report** - A detailed list of the AWS policies and the prohibited permissions that are compromised for an account of the current user.
**To check Secured DR Accounts:**
1. In the **General Settings** tab, select the **Security & Password** tab.
2. To check the DR accounts periodically during the day, select **Check Secured DR Account**, select an hourly interval in the **Secured DR Check Interval** list, and then select **Save**.
3. To run the report immediately, select **Check Secured DR Account Now**, and confirm**.**
1. To view the progress and status of the operation, select **Background Tasks** 
in the toolbar. **Background Tasks** only appears after the first **Check** **Secured DR Account** or **Clone VPC** operation. Select **View All Tasks**.
4. To view the log, select **Show Log**. To download, select 
**Download Log** in the upper right corner of the log. The `Secured_DR_Account_check_log_