1-800-691-1991 | 9am - 8pm ET
EN

How to Create Custom Backup Policy IAM Role

KB ID: 3032
Product: Veeam Backup for AWS
Version: Any
Published: 2019-12-02
Last Modified: 2021-07-23
The Backup Policy IAM role is used to run the following backup operations:
  • Enumerating of the resources.
  • Taking EBS snapshots of selected EC2 instances volumes.
  • Creating volumes from snapshots.
  • Attaching volumes to the worker instance.

Isolated from production backup deployment

The isolated from production deployment type provides an exceptional level of protection in cases when the whole production environment is lost. This type of deployment is recommended as the most secure one.
For this type of deployment, a second "Backup account" is required. Make sure to create one using the AWS website. Veeam Backup for AWS Management appliance must be deployed in the Backup Account.
To allow the Veeam Backup appliance to perform required operations inside the Production Account, you must create a Backup Policy Role in the Production Account.

This role must be made available for usage from the Backup Account.

Proceed through the following steps to create such a role:

Use the following JSON to create an IAM Policy by following the instructions from the How to create IAM Policy article. 
These permissions will allow the Veeam Backup for AWS service to perform operations required for backup.
Expand to view permissions to backup EC2 instances
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ebs:ListChangedBlocks",
                "ebs:ListSnapshotBlocks",
                "ec2:CreateSnapshot",
                "ec2:CreateSnapshots",
                "ec2:CreateTags",
                "ec2:DeleteSnapshot",
                "ec2:DeleteTags",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeConversionTasks",
                "ec2:DescribeImages",
                "ec2:DescribeInstances",
                "ec2:DescribeRegions",
                "ec2:DescribeTags",
                "ec2:DescribeSnapshots",
                "ec2:DescribeSubnets",
                "ec2:DescribeVolumeAttribute",
                "ec2:DescribeVolumes",
                "ec2:GetEbsDefaultKmsKeyId",
                "ec2:ModifySnapshotAttribute",
                "events:DeleteRule",
                "events:DescribeRule",
                "events:ListTargetsByRule",
                "events:PutRule",
                "events:PutTargets",
                "events:RemoveTargets",
                "iam:GetContextKeysForPrincipalPolicy",
                "iam:ListInstanceProfiles",
                "iam:SimulatePrincipalPolicy",
                "kms:CreateGrant",
                "kms:DescribeKey",
                "kms:GetKeyPolicy",
                "kms:ListAliases",
                "kms:ListKeys",
                "kms:ReEncryptFrom",
                "kms:ReEncryptTo",
                "servicequotas:ListServiceQuotas",
                "sns:CreateTopic",
                "sns:DeleteTopic",
                "sns:ListSubscriptionsByTopic",
                "sns:ListTopics",
                "sns:SetTopicAttributes",
                "sns:Subscribe",
                "sns:Unsubscribe",
                "sqs:CreateQueue",
                "sqs:DeleteMessage",
                "sqs:DeleteQueue",
                "sqs:ListQueues",
                "sqs:ReceiveMessage",
                "sqs:SetQueueAttributes",
                "ssm:DescribeInstanceInformation",
                "ssm:GetCommandInvocation",
                "ssm:SendCommand"
            ],
                      "Resource": "*",
                      "Effect": "Allow"
          }
    ]
}
Expand to view permissions to backup RDS instances
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "events:DeleteRule",
                "events:DescribeRule",
                "events:ListTargetsByRule",
                "events:PutRule",
                "events:PutTargets",
                "events:RemoveTargets",
                "iam:GetContextKeysForPrincipalPolicy",
                "iam:GetRole",
                "iam:SimulatePrincipalPolicy",
                "kms:CreateGrant",
                "kms:DescribeKey",
                "kms:GetKeyPolicy",
                "kms:ListKeys",
                "rds:AddTagsToResource",
                "rds:CopyDBSnapshot",
                "rds:CreateDBSnapshot",
                "rds:DeleteDBSnapshot",
                "rds:DescribeDBInstances",
                "rds:DescribeDBSnapshots",
                "rds:ListTagsForResource",
                "rds:ModifyDBSnapshotAttribute",
                "sns:CreateTopic",
                "sns:DeleteTopic",
                "sns:ListSubscriptionsByTopic",
                "sns:ListTopics",
                "sns:SetTopicAttributes",
                "sns:Subscribe",
                "sns:Unsubscribe",
                "sqs:CreateQueue",
                "sqs:DeleteMessage",
                "sqs:DeleteQueue",
                "sqs:ListQueues",
                "sqs:ReceiveMessage",
                "sqs:SendMessage",
                "sqs:SetQueueAttributes"
            ],
                      "Resource": "*",
                      "Effect": "Allow"
          }
    ]
}
Expand to view permissions to backup VPC settings
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ec2:DescribeAddresses",
                "ec2:DescribeClientVpnAuthorizationRules",
                "ec2:DescribeClientVpnEndpoints",
                "ec2:DescribeClientVpnRoutes",
                "ec2:DescribeClientVpnTargetNetworks",
                "ec2:DescribeCustomerGateways",
                "ec2:DescribeDhcpOptions",
                "ec2:DescribeEgressOnlyInternetGateways",
                "ec2:DescribeInstances",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeManagedPrefixLists",
                "ec2:DescribeNatGateways",
                "ec2:DescribeNetworkAcls",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeRegions",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeTransitGatewayAttachments",
                "ec2:DescribeTransitGatewayMulticastDomains",
                "ec2:DescribeTransitGatewayPeeringAttachments",
                "ec2:DescribeTransitGatewayRouteTables",
                "ec2:DescribeTransitGateways",
                "ec2:DescribeTransitGatewayVpcAttachments",
                "ec2:DescribeVpcAttribute",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeVpcEndpointServiceConfigurations",
                "ec2:DescribeVpcPeeringConnections",
                "ec2:DescribeVpcs",
                "ec2:DescribeVpnConnections",
                "ec2:DescribeVpnGateways",
                "ec2:GetManagedPrefixListEntries",
                "ec2:GetTransitGatewayRouteTableAssociations",
                "ec2:GetTransitGatewayRouteTablePropagations",
                "ec2:SearchTransitGatewayRoutes",
                "elasticloadbalancing:DescribeListeners",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeTags",
                "elasticloadbalancing:DescribeTargetGroups",
                "elasticloadbalancing:DescribeTargetHealth",
                "iam:GetContextKeysForPrincipalPolicy",
                "iam:ListAccountAliases",
                "iam:SimulatePrincipalPolicy",
                "ram:GetResourceShares",
                "ram:ListPrincipals",
                "ram:ListResources",
                "ram:ListResourceSharePermissions"
            ],
                      "Resource": "*",
                      "Effect": "Allow"
          }
    ]
}
  1. Navigate to Roles.
  2. Choose Create role
  3. Select the type of the trusted entity, Another AWS Account.
  4. In the Account ID field, enter the ID of your Backup Account (you can get this number in the AWS console of the Backup Account, in My Account located in the top-right menu).
  5. Select the Require external ID checkbox and enter a passphrase to raise security for the role.
  6. Click Next: Permissions.
  7. In the filter policies search box, enter the name of the policy created in Step 1.
  8. In the first column, select the policy.
  9. Click Next: Tags.
  10. Enter tagging info if needed and click Next: Review.
  11. Assign a name to the IAM Role. You will use this name in Veeam Backup for AWS (e.g., vb4aws_restore_role).
  12. Click Create role.
  13. Once the role is created, you will see it in the list of available roles.

Backup inside production deployment

This type of deployment (since it is not very secure) is recommended for test, demo and small environments only!
Use the following JSON text to create IAM Policy by following instructions from How to create IAM Policy article. These permissions will allow the backup service to perform operations required for backup.
Expand to view permissions to backup EC2 instances
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ebs:ListChangedBlocks",
                "ebs:ListSnapshotBlocks",
                "ec2:AttachVolume",
                "ec2:CreateKeyPair",
                "ec2:CreateSnapshot",
                "ec2:CreateSnapshots",
                "ec2:CreateTags",
                "ec2:CreateVolume",
                "ec2:DeleteKeyPair",
                "ec2:DeleteSnapshot",
                "ec2:DeleteTags",
                "ec2:DeleteVolume",
                "ec2:DeregisterImage",
                "ec2:DescribeAccountAttributes",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeConversionTasks",
                "ec2:DescribeImages",
                "ec2:DescribeInstanceAttribute",
                "ec2:DescribeInstances",
                "ec2:DescribeInstanceStatus",
                "ec2:DescribeKeyPairs",
                "ec2:DescribeRegions",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSnapshots",
                "ec2:DescribeSubnets",
                "ec2:DescribeRouteTables",
                "ec2:DescribeVolumeAttribute",
                "ec2:DescribeVolumes",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeVpcs",
                "ec2:DescribeTags",
                "ec2:DetachVolume",
                "ec2:ImportImage",
                "ec2:ModifyInstanceAttribute",
                "ec2:ModifySnapshotAttribute",
                "ec2:DescribeVolumeAttribute",
                "ec2:GetEbsDefaultKmsKeyId",
                "ec2:RunInstances",
                "ec2:StartInstances",
                "ec2:StopInstances",
                "ec2:TerminateInstances",
                "events:DeleteRule",
                "events:DescribeRule",
                "events:ListTargetsByRule",
                "events:PutRule",
                "events:PutTargets",
                "events:RemoveTargets",
                "iam:GetContextKeysForPrincipalPolicy",
                "iam:GetRole",
                "iam:ListAttachedRolePolicies",
                "iam:ListInstanceProfilesForRole",
                "iam:ListRolePolicies",
                "iam:SimulatePrincipalPolicy",
                "kms:DescribeKey",
                "kms:ListAliases",
                "kms:CreateGrant",
                "kms:GetKeyPolicy",
                "kms:ReEncryptFrom",
                "kms:ReEncryptTo",
                "kms:ListKeys",
                "s3:GetBucketLocation",
                "servicequotas:ListServiceQuotas",
                "sns:CreateTopic",
                "sns:DeleteTopic",
                "sns:ListSubscriptionsByTopic",
                "sns:ListTopics",
                "sns:SetTopicAttributes",
                "sns:Subscribe",
                "sns:Unsubscribe",
                "ssm:GetCommandInvocation",
                "ssm:SendCommand",
                "sts:AssumeRole",
                "sts:GetCallerIdentity",
                "sts:GetSessionToken",
                "sqs:DeleteMessage",
                "sqs:ListQueues",
                "sqs:ReceiveMessage",
                "sqs:DeleteQueue",
                "sqs:SendMessage",
                "sqs:CreateQueue",
                "sqs:SetQueueAttributes",
                "ssm: DescribeInstanceInformation",
                "ssm: GetCommandInvocation",
                "ssm: SendCommand"
                ],
                      "Resource": "*",
                      "Effect": "Allow"
          }
    ]
}
Expand to view permissions to backup RDS instances
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "events:DeleteRule",
                "events:DescribeRule",
                "events:ListTargetsByRule",
                "events:PutRule",
                "events:PutTargets",
                "events:RemoveTargets",
                "iam:GetContextKeysForPrincipalPolicy",
                "iam:GetRole",
                "iam:SimulatePrincipalPolicy",
                "kms:CreateGrant",
                "kms:DescribeKey",
                "kms:GetKeyPolicy",
                "kms:ListKeys",
                "rds:AddTagsToResource",
                "rds:CopyDBSnapshot",
                "rds:CreateDBSnapshot",
                "rds:DeleteDBSnapshot",
                "rds:DescribeDBInstances",
                "rds:DescribeDBSnapshots",
                "rds:ListTagsForResource",
                "rds:ModifyDBSnapshotAttribute",
                "sns:CreateTopic",
                "sns:DeleteTopic",
                "sns:ListSubscriptionsByTopic",
                "sns:ListTopics",
                "sns:SetTopicAttributes",
                "sns:Subscribe",
                "sns:Unsubscribe",
                "sqs:CreateQueue",
                "sqs:DeleteMessage",
                "sqs:DeleteQueue",
                "sqs:ListQueues",
                "sqs:ReceiveMessage",
                "sqs:SendMessage",
                "sqs:SetQueueAttributes"
            ],
                      "Resource": "*",
                      "Effect": "Allow"
          }
    ]
}
Expand to view permissions to backup VPC settings
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ec2:DescribeAddresses",
                "ec2:DescribeClientVpnAuthorizationRules",
                "ec2:DescribeClientVpnEndpoints",
                "ec2:DescribeClientVpnRoutes",
                "ec2:DescribeClientVpnTargetNetworks",
                "ec2:DescribeCustomerGateways",
                "ec2:DescribeDhcpOptions",
                "ec2:DescribeEgressOnlyInternetGateways",
                "ec2:DescribeInstances",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeManagedPrefixLists",
                "ec2:DescribeNatGateways",
                "ec2:DescribeNetworkAcls",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeRegions",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeTransitGatewayAttachments",
                "ec2:DescribeTransitGatewayMulticastDomains",
                "ec2:DescribeTransitGatewayPeeringAttachments",
                "ec2:DescribeTransitGatewayRouteTables",
                "ec2:DescribeTransitGateways",
                "ec2:DescribeTransitGatewayVpcAttachments",
                "ec2:DescribeVpcAttribute",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeVpcEndpointServiceConfigurations",
                "ec2:DescribeVpcPeeringConnections",
                "ec2:DescribeVpcs",
                "ec2:DescribeVpnConnections",
                "ec2:DescribeVpnGateways",
                "ec2:GetManagedPrefixListEntries",
                "ec2:GetTransitGatewayRouteTableAssociations",
                "ec2:GetTransitGatewayRouteTablePropagations",
                "ec2:SearchTransitGatewayRoutes",
                "elasticloadbalancing:DescribeListeners",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeTags",
                "elasticloadbalancing:DescribeTargetGroups",
                "elasticloadbalancing:DescribeTargetHealth",
                "iam:GetContextKeysForPrincipalPolicy",
                "iam:ListAccountAliases",
                "iam:SimulatePrincipalPolicy",
                "ram:GetResourceShares",
                "ram:ListPrincipals",
                "ram:ListResources",
                "ram:ListResourceSharePermissions"
            ],
                      "Resource": "*",
                      "Effect": "Allow"
          }
    ]
}
  1. Navigate to Roles.
  2. Choose Create role.
  3. Select type of trusted entity AWS Service.
  4. Select your use case EC2. Choose EC2 in Select your use case
  5. Press Next: Permissions button.
  6. Enter the name of the policy created on step 1 in the filter policies search box.
  7. Select the policy by ticking the checkbox in the first column.
  8. Press Next: Tags button.
  9. Enter tagging info if desired and press the Next: Review button.
  10. Give a name to the IAM Role - you will be using this name in the Veeam Backup for AWS UI (e.g., vb4aws_pol2role).
  11. Press Create role button.
  12. After the successful creation of the role, you will see it in the list of all available roles.
  13. To add this role to the Veeam Backup for AWS service, you should update Trust relationships for the created role as described in this article.
KB ID: 3032
Product: Veeam Backup for AWS
Version: Any
Published: 2019-12-02
Last Modified: 2021-07-23

Couldn't find what you were looking for?

Below you can submit an idea for a new knowledge base article.
Report a typo on this page:

Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!

Spelling error in text

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Your report was sent to the responsible team. Our representative will contact you by email you provided.
We're working on it please try again later
Knowledge base content request
By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Policy.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

ty icon

Thank you!

We have received your request and our team will reach out to you shortly.

OK

error icon

Oops! Something went wrong.

Please go back try again later.