Cloud Accounts

Frame provides administrators with the ability to manage various components of their cloud accounts easily from the Frame console. This guide discusses how administrators can manage their virtual networks, master images, and instance types associated with each of their cloud accounts.

Administrators with the appropriate role can add new public cloud accounts and review the list and status of existing cloud accounts by navigating to the Customer or Organization Dashboard in the Admin Console and selecting Cloud Accounts in the left-hand menu.

To inspect or manage a specific cloud account, click on adjacent kebab menu icon of a specific cloud account and select Update.

Options by Infrastructure

The tabs you see at the top of the Cloud Account page will vary depending on the type of cloud account (infrastructure) you are accessing.

[!IMPORTANT] Backplane Separation and Cloud Account Usage

Dizzion Platform runs in two geographical backplanes: U.S. and EMEA (DEU).
This separation exists for data protection, compliance, and disaster recovery (DR) reasons.

Customers should never reuse or connect the same cloud environment across multiple backplanes.
For example:

• Do not use the same AWS Account in both U.S. and DEU backplanes.
• Do not reuse one Azure Subscription for different backplanes.
• Do not connect the same GCP Project to more than one backplane.
• Do not reuse the same IBM Cloud Resource Group (or IBM Account, depending on setup).

Each backplane must have its own cloud account. Using the same cloud account in multiple backplanes may cause unexpected issues, including problems with VM deletion and synchronization.

Requirement:

Always create a new cloud account per backplane to ensure proper operation, separation, and compliance.

Virtual Networks (AHV only)

The Virtual Networks tab is available for AHV cloud accounts. Under Virtual Networks, administrators can see which virtual networks have already been used to create Frame accounts with Frame workload VMs.

Each time you go to this tab, Frame control plane will retrieve the list of VLANs from your AHV cluster and display them in this tab.

If you would like to make another virtual network available to chose from when creating a new Frame account, you can click on the desired network under \*\*Apply another virtual network\*\* and click \*\*Save\*\* in the upper right corner of your Frame Console.

Instance Types (AHV only)

Administrators can add and remove custom instance types for AHV from the Instance Types tab by following the instructions below.

Add an Instance Type

1. Select the Instance Types tab at the top of the page and then click the blue Add instance type link.

3\\. Click \*\*Create\*\* at the bottom of the window when you are done.

Once you have defined the instance type under your AHV Cloud Account, you can go to Capacity of your Frame account(s) to add a test pool and/or production pool of this instance type.

Remove an Instance Type

If all pools using an instance type have been deleted from your Frame accounts, you can fully remove the instance type from the Cloud Accounts page.

1. Navigate to the Customer or Organization Dashboard in the Admin Console where the cloud account is registered.
2. Select Cloud Accounts in the left-hand menu.
3. Navigate to the cloud account where you will be deleting the instance type. Click on the adjacent kebab menu and select Update.
4. Click on the Instance Types tab at the top of the page. Click the red Delete link next to the instance type you would like to delete.

5. Click Remove in the bottom corner of the prompt that appears to confirm your choice.

Notification Center will notify you when the instance type has successfully been removed from your cloud account.

Update Configuration

The Configuration tab is available on the cloud account management page for AWS, Azure, IBM Cloud, and Nutanix AHV. The sections below discuss what is provided for each provider.

AWS

For an AWS cloud account, there are two sub-tabs: Update Stack and Recreate Stack.

Update Stack

The \*\*Update Stack\*\* tab provides you with your CloudFormation Stack template URL and Stack parameters, as shown above. These details can be used to update IAM (Identity and Access Management) roles as needed. As an example, you may need to use the CloudFormation Stack template URL to expand your IAM permissions after a Frame product update in order to use new product features.

Recreate Stack

Use the Recreate Stack sub-tab to recreate your CloudFormation stack to a known good state and verify the connection. Typically, most administrators will access this page when troubleshooting permissions/account setup issues.

In order to recreate your CloudFormation stack, you must delete the existing stack in your AWS Console which you can access directly from the Recreate Stack sub-tab.

Azure

The configuration tab for Azure can be used to update your Azure credentials found in the Azure Portal. Most administrators will need to access this page in order to update the client secret before it expires. Microsoft Azure limits client secrets to expire 2 years or less after their creation date.

If your client secret has expired, you can simply re-enter your cloud credentials here and click the \*\*Verify Connection\*\* button. Your Application ID and Directory ID can be found in the \*\*Overview\*\* section of your Frame app registration in the Azure Portal.

\### Template Images

The Template Image (aka Master Images) tab enables administrators to select the desired images they would like to use as the base images for Frame account Sandboxes. Please refer to the BYO OS Images of our documentation for detailed instructions on how to prepare and add your own template images to your infrastructure. The guides outline how to add your desired template images through your infrastructure provider and then make them visible in the Frame Console. Once they are added to your cloud account using the Master images tab, you can then use them to create a new Frame account or to reset the Sandbox image of an existing Frame account. You can also remove the template image from the list of template images.

Add a Template Image (AHV)

To add a new template image that has already been prepared and uploaded to your AHV cluster, perform the following steps:

1. Navigate to the Customer or Organization Dashboard in the Admin Console where the cloud account is registered.
2. Select Cloud Accounts in the left-hand menu.
3. Navigate to the cloud account you will be managing. Click on the adjacent kebab menu and select Update.
4. From there, navigate to the Master Images tab at the top of the page. The list of already imported template images are listed.

5\\. To add a new template image, select \*\*Import Image\*\*.

6\\. If your template image has not been imported into Frame before, click \*\*Sync\*\* so Frame Platform will query your infrastructure for the list of available images. Then, complete the remainder of the form:

• Select Image: Select the image to import from the picklist.
• Image Family: Specify the OS type for this image.
• Display Name: Enter the display name of image.

Click Import for Frame Platform to import your template image to your Cloud Account.

Add a Template Image (Public Cloud)

To add a new template image that has already been prepared and uploaded to a specific region in your public cloud infrastructure, perform the following steps:

1. Navigate to the Customer or Organization Dashboard in the Admin Console where the cloud account is registered.
2. Select Cloud Accounts in the left-hand menu.
3. Navigate to the cloud account you will be managing. Click on the adjacent kebab menu and select Update.
4. From there, navigate to the Master Images tab at the top of the page. The list of already imported template images are listed.

5\\. To add a new template image, select \*\*Import Image\*\*.

7\\. Once registration and validation (optional) of the image is complete, you can create new Frame accounts using your new template image or reset an existing Frame account Sandbox to the new template image.

\### Discard a Template Image

1\. Navigate to the Customer or Organization Dashboard in the \[Admin Console\](https://docs.difr.com/books/platform-administrators-guide/page/google-cloud-platform#admin-console) where the cloud account is registered. 2. Select \*\*Cloud Accounts\*\* in the left-hand menu. 3. Navigate to the cloud account you will be managing. Click on the adjacent kebab menu and select \*\*Update\*\*. 4. From there, navigate to the \*\*Master Images\*\* tab at the top of the page.

6\\. Click on \*\*Discard\*\* and Frame Platform will remove the imported template image from your cloud account.

Shared VPCs (GCP only)

Frame supports the ability for customers to use Google Cloud Platform's Shared VPCs, where a Google Host Project owns a VPC with specific subnets shared with other Google Service Projects. Once the GCP administrator has configured the GCP Host and Service Projects, the Frame administrators can follow the procedure below to set up the GCP Cloud Accounts in Frame to create Frame accounts in a Google Service Project.

Prerequisites

Before the Frame administrator can specify within Frame Console the Shared VPC subnets to use in a Google Service Project, the following conditions must be satisfied:

1. The GCP Host Project has been configured in GCP to have shared one or more subnets in the Shared VPC with the GCP Service Project.
2. The GCP Host and Service Projects are registered in Frame as separate GCP Cloud Accounts at the same level in the Frame Platform Hierarchy.

Share a Subnet

Once the two projects are registered in Frame, the Frame administrator can share the subnet(s) from the Shared VPC in the Google Host Project by doing the following:

1. Navigate to the Customer or Organization Dashboard where the two GCP Cloud Accounts are registered.
2. Select Cloud Accounts in the lefthand menu.
3. Click on the kebab menu for the GCP Host Cloud Account and click on Update.
4. Select the Shared VPCs tab.
5. Click Share Subnet in the upper right corner of the Shared VPCs page.
6. In the Share Subnets configuration window, specify the GCP Service Cloud Account in the Destination Cloud Service pick list that will have access to the Shared VPC subnet(s).
7. Specify one or more Shared VPC subnets which are to be accessible to the GCP Service Cloud Account within Frame.
8. Click Share Subnets button to save the configuration.

A new entry in the Shared Subnets list will appear. These Shared VPC subnets are now visible in the Account Creation workflow when you create the Frame Account using the Destination GCP Cloud Account and customer-managed networking.

Revoke a Shared Subnet

If you wish to stop using a shared subnet, you will need to ensure that the shared subnet is no longer has Frame-managed workload VMs (e.g,. terminate Frame accounts using that shared subnet) and then:

1. Navigate to the Customer or Organization Dashboard where the two GCP Cloud Accounts are registered.
2. Select Cloud Accounts in the lefthand menu.
3. Click on the kebab menu for the GCP Host Cloud Account and click on Update.
4. Select the Shared VPCs tab.
5. Under the Shared Subnets list, click on the kebab menu for the Destination Cloud Service/Subnet combination you want to revoke.
6. Confirm you wish to revoke the access to the Shared VPC subnet by the GCP Service Cloud Account.

Add a Cloud Account Region

Administrators can add additional regions after their cloud account has been setup using the Add Regions function.

1. Navigate to the Customer or Organization Dashboard in the Admin Console where the cloud account is registered.
2. Select Cloud Accounts in the left-hand menu.
3. Find the cloud account where you want to add a new cloud region. Click on the adjacent kebab menu and select Add regions.

4\\. A new window will appear. You have two options to choose from:

\\\\\\\\\\\\\\\\n\\\\\\\\\\\\\\\\n- \*\*All supported regions:\*\* Select this option if you would like to add all other supported regions aside from the ones you have already specified.\\\\\\\\\\\\\\\\n- \*\*Specify regions:\*\* Select this option if you would like to add just a few additional supported regions to your cloud account. Simply click inside the regions field and select as many regions as you wish from the drop-down menu.\\\\\\\\\\\\\\\\n\\\\\\\\\\\\\\\\n

5\\. Once you have made your selection, click \*\*Save\*\* in the bottom right corner of the window. You will receive updates in your notification center regarding the status.

\### Deactivate a Cloud Account

1\. Navigate to the Customer or Organization Dashboard in the \[Admin Console\](https://docs.difr.com/books/platform-administrators-guide/page/google-cloud-platform#admin-console) where the cloud account is registered. 2. Select \*\*Cloud Accounts\*\* in the left-hand menu. 3. Find the cloud account where you want to deactivate. Click on the adjacent kebab menu and select \*\*Deactivate\*\*.

For AHV, once the AHV Cloud Account is deactivated, the Cloud Connector Appliance (CCA) VM(s) and Streaming Gateway Appliance (SGA) VMs can be terminated in Prism Element and categories removed from Prism Central.

Reconnect Cloud Account

When the Frame control plane is unable to communicate with the cloud account infrastructure, the status for the cloud account in the Cloud Accounts list will be displayed as "U" for Unavailable (instead of "R" for Ready). The administrator will need to correct the issue and may need to manually trigger a reconnection of the cloud account.

Common reasons for an unavailable cloud account are:

AHV:

• Prism Element service account username/password was changed or expired
• Cloud Connector Appliance (CCA) VMs are unresponsive or powered off
• Cloud Connector Appliance (CCA) is unable to connect to the Frame control plane (cch.console.nutanix.com)

Public cloud:

• Azure shared secret expired
• Required IAM roles/permissions were removed from AWS IAM role or GCP service account
• To reconnect an unavailable cloud account after the issues have been addressed:
• 1. Navigate to the Customer or Organization Dashboard in the Admin Console where the cloud account is registered.
• 2. Select Cloud Accounts in the left-hand menu.
• 3. Find the cloud account you want to reconnect. Click on the adjacent kebab menu and select Reconnect.
• 4. If the underlying issue(s) were addressed and Frame control plane is able to communicate with the cloud account infrastructure, the account status will change to "R".

If you need to update your Prism Central or Prism Element credentials, you will need to:

1. Go to the CCA Dashboard by specifying in your browser: powershell https://<CCA VM IP address>/
2. Log in with your current Prism Central credentials.
3. Click Profile in the top right menu and launch the update password wizard. The CCA wizard allows you to change either Prism Central or Prism Element username and password. You can also update both usernames/passwords at the same time.