Service Account Configuration
HPE Morpheus VM Essentials
The RiverMeadow platform utilizes the HPE Morpheus VM Essentials REST API to orchestrate the migration of workloads to the HVM hypervisor. The security best practice is to create a dedicated service account that will be used by the RiverMeadow Meadow migration appliance to interact with the REST API. This service account should be granted only the privileges that are required to ensure that it aligns with the security principle of least privilege.
User Role
Privileges or permissions within HPE Morpheus VM Essentials are associated with a user role for assignment. This is why a dedicated user role should be created to assign the required privileges to the user account. The required role privileges that need to be granted to the user role can be found below.
Role Privileges
The following privileges are required by the HPE Morpheus VM Essentials user role to migrate workloads using the RiverMeadow platform:
HPE Morpheus VM Essentials Role Privileges
| Privilege | Access Level |
|---|---|
| Backup Settings | Full |
| Environment Settings | Full |
| Provisioning Settings | Full |
| Roles | Full |
| Service Plans | Read |
| Clusters | Full |
| Compute | Full |
| Groups | Full |
| Networks | Read |
| Storage | Read |
| Virtual Images | Full |
| Power Control | Full |
| Reconfigure | Full |
| Reconfigure: Change Plan | Full |
| Reconfigure: Disk Add | Full |
| Reconfigure: Disk Change Type | Full |
| Reconfigure: Disk Modify | Full |
| Reconfigure: Disk Remove | Full |
| Reconfigure: Network Add | Full |
| Reconfigure: Network Modify | Full |
| Reconfigure: Network Remove | Full |
| Retry/Cancel | Full |
| Activity | Read |
| Dashboard | Read |
| Import Image | Full |
| Instances: Add | Full |
| Instances: Clone | Full |
| Instances: Delete | Full |
| Instances: Edit | Full |
| Instances: List | Full |
| Instances: Settings | Full |
| Remote Console | User |
| Snapshots | Full |
| Snapshots: Linked Clone | Full |
The most current version of the required privileges is available in the RiverMeadow documentation: https://docs.rivermeadow.com/hpe-vme-required-privileges.
User Account
Once the user role has been created, a dedicated user account (local or external identity provider) should be created in the HPE Morpheus VM Essentials platform with a secure password for use by the RiverMeadow migration appliance. The dedicated user role should be assigned to the service account.
VMware vSphere (VM Based - Optional)
The RiverMeadow platform supports VM based migrations from VMware vSphere to HPE Morpheus VM Essentials using a hypervisor-level integration. A user account with elevated privileges to the source VMware vSphere environment is required for VM based migrations. This service account is used to automate the deployment of the source worker appliance and execute migration related activities such as creating snapshots.
VMware vSphere Role Privileges
| Group | Privilege |
|---|---|
| Datastore | Allocate space |
| Datastore | Browse datastore |
| Datastore | Low level file operations |
| Datastore | Update virtual machine files |
| Network | Assign network |
| Resource | Apply recommendations |
| Resource | Assign vApp to resource pool |
| Resource | Create resource pool |
| Resource | Query vMotion |
| Storage Views | View |
| vApp | Add virtual machine |
| vApp | Assign resource pool |
| vApp | Assign vApp |
| vApp | Create |
| vApp | Import |
| vApp | Power On |
| vApp | Rename |
| vApp | vApp application configuration |
| vApp | vApp instance configuration |
| vApp | vApp managedBy configuration |
| vApp | vApp resource configuration |
| vApp | View OVF environment |
| Virtual Machine | Change Configuration > Acquire disk lease |
| Virtual Machine | Change Configuration > Acquire disk lease |
| Virtual Machine | Change Configuration > Add existing disk |
| Virtual Machine | Change Configuration > Add new disk |
| Virtual Machine | Change Configuration > Add or remove device |
| Virtual Machine | Change Configuration > Advanced configuration |
| Virtual Machine | Change Configuration > Change resource |
| Virtual Machine | Change Configuration > Configure Raw device |
| Virtual Machine | Change Configuration > Configure managedBy |
| Virtual Machine | Change Configuration > Display connection setting |
| Virtual Machine | Change Configuration > Modify device settings |
| Virtual Machine | Change Configuration > Reload from path |
| Virtual Machine | Change Configuration > Remove disk |
| Virtual Machine | Change Configuration > Rename |
| Virtual Machine | Change Configuration > Disk change tracking |
| Virtual Machine | Change Configuration > Reset guest information |
| Virtual Machine | Change Configuration > Toggle disk change tracking |
| Virtual Machine | Change Configuration > Unlock virtual machine |
| Virtual Machine | Guest Operations > Guest operation modifications |
| Virtual Machine | Guest Operations > Guest operation program execution |
| Virtual Machine | Guest Operations > Guest operation queries |
| Virtual Machine | Interaction > Power on |
| Virtual Machine | Provisioning > Allow disk access |
| Virtual Machine | Provisioning > Allow read-only disk access |
| Virtual Machine | Provisioning > Allow virtual machine files upload |
| Virtual Machine | Provisioning > Modify customization specifications |
| Virtual Machine | Provisioning > Customize guest |
| Virtual Machine | Provisioning > Deploy template |
| Virtual Machine | Provisioning > Modify customization specifications |
| Virtual Machine | Provisioning > Promote disks |
| Virtual Machine | Provisioning > Read customization specifications |
| Virtual Machine | Snapshot Management > Create Snapshot |
| Virtual Machine | Snapshot Management > Remove Snapshot |
| Virtual Machine | Snapshot Management > Rename Snapshot |
| Virtual Machine | Snapshot Management > Revert to Snapshot |