https://login.veeam.com/en/oauth?client_id=nXojRrypJ8&redirect_uri=https%3A%2F%2Fwww.veeam.com%2Fservices%2Fauthentication%2Fredirect_url&response_type=code&scope=profile&state=eyJmaW5hbFJlZGlyZWN0TG9jYXRpb24iOiJodHRwczovL3d3dy52ZWVhbS5jb20va2IzMDMyIiwiaGFzaCI6ImE1NWI0ZTkzLWMyOWQtNDRkNS1iODAzLTFlOWY3Zjc0OWIxYiJ9
How to Create Custom Backup Policy IAM Role
Challenge
The Backup Policy IAM role is used to run the following backup operations:
- Enumerating of the resources.
- Taking EBS snapshots of selected EC2 instances volumes.
- Creating volumes from snapshots.
- Attaching volumes to the worker instance.
Solution
The following types of deployment scenarios require the Backup Policy IAM role:
For this type of the deployment a second "Backup account" is required. Make sure to create one using the AWS web site. Veeam Backup for AWS Management appliance must be deployed in the Backup Account.
To allow the Veeam Backup appliance to perform required operations inside of the Production Account, a Backup Policy Role must be created in the Production Account.
This role must be made available for usage from the Backup Account.
Proceed through the following steps to create such a role:
1. Use the following JSON to create an IAM Policy by following the instructions from the How to create IAM Policy article
These permissions will allow the backup service to perform operations required for backup.
3. Choose Create role.
4. Select the type of the trusted entity Another AWS Account.
5. In the Account ID field, enter the ID of your Backup Account (you can get this number in the AWS console of the Backup Account, in My Account located in the top-right menu).
6. Select the Require external ID checkbox and enter a pass phrase to raise the level of security for the role.
7. Click Next: Permissions.
8. In the filter policies search box, enter the name of the policy created in the Step 1.
9. In the first column, select the policy.
10. Click Next: Tags.
11. Enter tagging info if needed and click Next: Review.
12. Assign a name to the IAM Role. This name will be used in Veeam Backup for AWS (e.g. vb4aws_restore_role).
13. Click Create role.
14. Once the role is created, you will be able to see it in the list of available roles.
NOTE: This type of deployment (since it is not very secure) is recommended for test, demo and small environments only!
1. Please use the following JSON text to create IAM Policy by following instructions from How to create IAM Policy article
These permissions will allow backup service to perform required for backup operations:
3. Choose Create role.
4. Select type of trusted entity AWS Service.
5. Select your use case EC2. Choose EC2 in Select your use case
6. Press Next: Permissions button.
7. Enter the name of the policy created on step 1 in filter policies search box.
8. Select the policy with ticking on the checkbox in the first column.
9. Press Next: Tags button.
10. Enter tagging info if desired and press Next: Review button.
11. Give a name to the IAM Role - you will be using this name in the Veeam Backup for AWS UI (e.g. vb4aws_pol2role).
12. Press Create role button.
13. After successful creation of the role you will be able to see it in the list of all available roles.
14. To add this role to the Veeam Backup for AWS service, you should update Trust relationships for the created role as described in this article.
- backup inside production
- isolated from production backup
Isolated from production backup deployment
For this type of the deployment a second "Backup account" is required. Make sure to create one using the AWS web site. Veeam Backup for AWS Management appliance must be deployed in the Backup Account.
To allow the Veeam Backup appliance to perform required operations inside of the Production Account, a Backup Policy Role must be created in the Production Account.
This role must be made available for usage from the Backup Account.
Proceed through the following steps to create such a role:
1. Use the following JSON to create an IAM Policy by following the instructions from the How to create IAM Policy article
These permissions will allow the backup service to perform operations required for backup.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ec2:CopySnapshot",
"ec2:CreateSnapshot",
"ec2:CreateSnapshots",
"ec2:CreateTags",
"ec2:DeleteSnapshot",
"ec2:DeleteTags",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeImages",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstances",
"ec2:DescribeInstanceStatus",
"ec2:DescribeKeyPairs",
"ec2:DescribeRegions",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DescribeRouteTables",
"ec2:DescribeVolumes",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcs",
"ec2:DescribeTags",
"ec2:ModifySnapshotAttribute",
"ec2:DescribeVolumeAttribute",
"ec2:GetEbsDefaultKmsKeyId",
"events:DeleteRule",
"events:DescribeRule",
"events:ListTargetsByRule",
"events:PutRule",
"events:PutTargets",
"events:RemoveTargets",
"iam:GetRole",
"iam:ListAttachedRolePolicies",
"iam:ListInstanceProfilesForRole",
"iam:ListRolePolicies",
"kms:DescribeKey",
"kms:ListAliases",
"kms:ListKeys",
"kms:CreateGrant",
"kms:GetKeyPolicy",
"kms:ReEncryptFrom",
"kms:ReEncryptTo",
"s3:GetBucketLocation",
"servicequotas:ListServiceQuotas",
"sns:CreateTopic",
"sns:DeleteTopic",
"sns:ListSubscriptionsByTopic",
"sns:ListTopics",
"sns:SetTopicAttributes",
"sns:Subscribe",
"sns:Unsubscribe",
"ssm:GetCommandInvocation",
"ssm:SendCommand",
"sts:AssumeRole",
"sts:GetCallerIdentity",
"sts:GetSessionToken",
"sqs:DeleteMessage",
"sqs:ListQueues",
"sqs:ReceiveMessage",
"sqs:DeleteQueue",
"sqs:SendMessage",
"sqs:CreateQueue",
"sqs:SetQueueAttributes"
],
"Resource": "*",
"Effect": "Allow"
}
]
}
2. Navigate to Roles.3. Choose Create role.
4. Select the type of the trusted entity Another AWS Account.
5. In the Account ID field, enter the ID of your Backup Account (you can get this number in the AWS console of the Backup Account, in My Account located in the top-right menu).
6. Select the Require external ID checkbox and enter a pass phrase to raise the level of security for the role.
7. Click Next: Permissions.
8. In the filter policies search box, enter the name of the policy created in the Step 1.
9. In the first column, select the policy.
10. Click Next: Tags.
11. Enter tagging info if needed and click Next: Review.
12. Assign a name to the IAM Role. This name will be used in Veeam Backup for AWS (e.g. vb4aws_restore_role).
13. Click Create role.
14. Once the role is created, you will be able to see it in the list of available roles.
Backup inside production deployment
NOTE: This type of deployment (since it is not very secure) is recommended for test, demo and small environments only!
1. Please use the following JSON text to create IAM Policy by following instructions from How to create IAM Policy article
These permissions will allow backup service to perform required for backup operations:
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ec2:AttachVolume",
"ec2:CopySnapshot",
"ec2:CreateKeyPair",
"ec2:CreateSnapshot",
"ec2:CreateSnapshots",
"ec2:CreateTags",
"ec2:CreateVolume",
"ec2:DeleteKeyPair",
"ec2:DeleteSnapshot",
"ec2:DeleteTags",
"ec2:DeleteVolume",
"ec2:DeregisterImage",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeImages",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstances",
"ec2:DescribeInstanceStatus",
"ec2:DescribeKeyPairs",
"ec2:DescribeRegions",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DescribeRouteTables",
"ec2:DescribeVolumes",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcs",
"ec2:DescribeTags",
"ec2:DetachVolume",
"ec2:ImportImage",
"ec2:ModifyInstanceAttribute",
"ec2:ModifySnapshotAttribute",
"ec2:DescribeVolumeAttribute",
"ec2:GetEbsDefaultKmsKeyId",
"ec2:RunInstances",
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:TerminateInstances",
"events:DeleteRule",
"events:DescribeRule",
"events:ListTargetsByRule",
"events:PutRule",
"events:PutTargets",
"events:RemoveTargets",
"iam:GetRole",
"iam:ListAttachedRolePolicies",
"iam:ListInstanceProfilesForRole",
"iam:ListRolePolicies",
"kms:DescribeKey",
"kms:ListAliases",
"kms:CreateGrant",
"kms:GetKeyPolicy",
"kms:ReEncryptFrom",
"kms:ReEncryptTo",
"kms:ListKeys",
"s3:GetBucketLocation",
"servicequotas:ListServiceQuotas",
"sns:CreateTopic",
"sns:DeleteTopic",
"sns:ListSubscriptionsByTopic",
"sns:ListTopics",
"sns:SetTopicAttributes",
"sns:Subscribe",
"sns:Unsubscribe",
"ssm:GetCommandInvocation",
"ssm:SendCommand",
"sts:AssumeRole",
"sts:GetCallerIdentity",
"sts:GetSessionToken",
"sqs:DeleteMessage",
"sqs:ListQueues",
"sqs:ReceiveMessage",
"sqs:DeleteQueue",
"sqs:SendMessage",
"sqs:CreateQueue",
"sqs:SetQueueAttributes"
],
"Resource": "*",
"Effect": "Allow"
}
]
}
2. Navigate to Roles.3. Choose Create role.
4. Select type of trusted entity AWS Service.
5. Select your use case EC2. Choose EC2 in Select your use case
6. Press Next: Permissions button.
7. Enter the name of the policy created on step 1 in filter policies search box.
8. Select the policy with ticking on the checkbox in the first column.
9. Press Next: Tags button.
10. Enter tagging info if desired and press Next: Review button.
11. Give a name to the IAM Role - you will be using this name in the Veeam Backup for AWS UI (e.g. vb4aws_pol2role).
12. Press Create role button.
13. After successful creation of the role you will be able to see it in the list of all available roles.
14. To add this role to the Veeam Backup for AWS service, you should update Trust relationships for the created role as described in this article.
KB ID:
3032
Product:
Veeam Backup for AWS
Version:
Any
Published:
2019-12-02
Last Modified:
2020-08-13
Couldn't find what you were looking for?
Below you can submit an idea for a new knowledge base article.
Report a typo on this page:
Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!
Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!
Spelling error in text
Knowledge base content request
How can we assist you today?
How can we assist you today?
Happy Holidays!
Chat is offline now. Please fill out the form and we will call you back.
Technical
General and Licensing
Renewal
Sales
Partnership
Do you have an issue or need post-sales technical assistance?
*if you need help choosing the right product, please select "Sales" chat
Do you need guidance on the website, upgrade hints or help with your licenses/accounts?
Questions regarding your Veeam contract renewal? Contact us and learn how you can maximize your savings
Do you need additional license, pricing details, product information or have any other sales-related question?
Would you like to become our partner or do you need assistance as our existing partner?
Start chat
We apologize, but this chat is not available at the moment
Start chat
We apologize, but this chat is not available at the moment
Start chat
We apologize, but this chat is not available at the moment
Start chat
We apologize, but this chat is not available at the moment
Privacy Notice. By submitting, you agree that your personal data will be managed by Veeam in accordance with the Privacy Policy.
Back
Thank you for your request!
Veeam representative will get back to you shortly.
Stay up to date with Veeam product updates, latest news, and recent content.
By subscribing, you agree to receive communications about Veeam products, services and events. Your personal data will be managed by Veeam in accordance with the Privacy Policy. You can unsubscribe at any time.