> ## Documentation Index
> Fetch the complete documentation index at: https://clumio.reclear.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Protect an AWS account

> Connect an AWS account, configure protection, and verify recovery with a small restore.

Connect an AWS account with Terraform, protect an S3 bucket, and verify recovery with a small
restore.

<Note>
  **Prototype note.** This workflow is based on public Clumio documentation and has not been validated
  against a live Clumio tenant. A production version would require a live test of every step.
</Note>

## Before you start

You need:

* permission to create an IAM role and related policies in the AWS account;
* Terraform 1.0 or later for the infrastructure-as-code path.

<Steps>
  <Step title="Choose a control plane">
    Choose a control plane that supports the AWS regions containing the resources you want to
    protect. The US East control plane is available only to existing customers. New US customers use
    US West.

    See [Supported regions](/reference/regions) for the current control-plane and data-plane mapping.
  </Step>

  <Step title="Create the tenant">
    Sign up directly through the [Clumio portal](https://portal.clumio.com/register).
  </Step>

  <Step title="Create an API token">
    Create a personal token for this tutorial and store it in a secrets manager. Follow
    [Create and rotate API tokens](/developer-tools/authentication).
  </Step>

  <Step title="Connect the AWS account with Terraform">
    Use the Terraform provider and AWS bootstrap module for a reviewable infrastructure-as-code
    workflow.

    The Terraform path has two parts:

    1. `clumio_aws_connection` registers the AWS account and region with Clumio.
    2. `clumio-code/aws-template/clumio` creates the AWS resources required for the selected data
       sources.

    The [Terraform provider guide](/developer-tools/terraform) contains a verified example based on
    Clumio's current Registry documentation.
  </Step>

  <Step title="Confirm discovery">
    Return to the Clumio console and confirm that the connected account appears in inventory. Check
    that the resources you plan to protect are visible before creating a policy.
  </Step>

  <Step title="Configure protection">
    Create a protection group, define a backup policy, and assign the policy to the group. With the
    Terraform provider, these are separate resources:

    * `clumio_protection_group` selects the S3 buckets;
    * `clumio_policy` defines the RPO, retention, and backup tier; and
    * `clumio_policy_assignment` connects the policy to the protection group.

    Run `terraform plan` before applying the configuration.
  </Step>

  <Step title="Verify a backup and restore">
    Confirm that Clumio reports a successful backup for the protected resource. Then restore a small
    object or test resource to a safe target and confirm that the recovered data is usable.

    This prototype does not include a REST restore request because no example was validated against a
    live tenant. That request should be added only after testing the exact endpoint and payload.
  </Step>
</Steps>

## What you completed

You connected an AWS account, selected S3 resources for protection, assigned a backup policy, and
verified recovery with a small restore.

## Automate this workflow

The connection, policy, and protection group you created here can be managed as code or from a
client:

<CardGroup cols={2}>
  <Card title="Terraform" icon="cube" href="/developer-tools/terraform">
    Manage the connection, policy, and protection group declaratively.
  </Card>

  <Card title="Python SDK" icon="python" href="/developer-tools/python-sdk">
    Create the same objects from Python.
  </Card>

  <Card title="REST API" icon="square-terminal" href="/api-reference/protect-resource">
    Protect a resource directly against the API.
  </Card>

  <Card title="Choose a tool" icon="code" href="/developer-tools/overview">
    Compare the options before committing to one.
  </Card>
</CardGroup>

## Where to go next

* [Protection model](/protect/overview) — how policies, groups, and rules compose.
* [Amazon S3](/protect/workloads/s3) — the workload used in this quickstart.
* [Create and rotate API tokens](/developer-tools/authentication) — credentials for automation.