BACK TO KB LIST

How to Create Custom Backup Policy IAM Role

KB ID: 3032
Product: Veeam Backup for AWS | 1.0 | 2.0 | 3.0
Published: 2019-12-02
Last Modified: 2022-04-01
Get weekly article updates
By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

error icon

Oops! Something went wrong.

Please try again later.

Article Applicability

Starting with Veeam Backup for AWS v4, all permissions requirements are located in the User Guide:

The permissions listed below in this article are for Veeam Backup for AWS versions before version 4.

The Backup Policy IAM role is used to run the following backup operations:
  • Enumerating of the resources.
  • Taking EBS snapshots of selected EC2 instances volumes.
  • Creating volumes from snapshots.
  • Attaching volumes to the worker instance.

Isolated from production backup deployment

The isolated from production deployment type provides an exceptional level of protection in cases when the whole production environment is lost. This type of deployment is recommended as the most secure one.
For this type of deployment, a second "Backup account" is required. Make sure to create one using the AWS website. Veeam Backup for AWS Management appliance must be deployed in the Backup Account.
To allow the Veeam Backup appliance to perform required operations inside the Production Account, you must create a Backup Policy Role in the Production Account.

This role must be made available for usage from the Backup Account.

Proceed through the following steps to create such a role:

Use the following JSON to create an IAM Policy. 
These permissions will allow the Veeam Backup for AWS service to perform operations required for backup.
Expand to view permissions to backup EC2 instances 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ebs:ListChangedBlocks",
                "ebs:ListSnapshotBlocks",
                "ec2:CreateSnapshot",
                "ec2:CreateSnapshots",
                "ec2:CreateTags",
                "ec2:DeleteSnapshot",
                "ec2:DeleteTags",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeConversionTasks",
                "ec2:DescribeImages",
                "ec2:DescribeInstances",
                "ec2:DescribeRegions",
                "ec2:DescribeTags",
                "ec2:DescribeSnapshots",
                "ec2:DescribeSubnets",
                "ec2:DescribeVolumeAttribute",
                "ec2:DescribeVolumes",
                "ec2:GetEbsDefaultKmsKeyId",
                "ec2:ModifySnapshotAttribute",
                "events:DeleteRule",
                "events:DescribeRule",
                "events:ListTargetsByRule",
                "events:PutRule",
                "events:PutTargets",
                "events:RemoveTargets",
                "iam:GetContextKeysForPrincipalPolicy",
                "iam:ListInstanceProfiles",
                "iam:SimulatePrincipalPolicy",
                "kms:CreateGrant",
                "kms:DescribeKey",
                "kms:GetKeyPolicy",
                "kms:ListAliases",
                "kms:ListKeys",
                "kms:ReEncryptFrom",
                "kms:ReEncryptTo",
                "servicequotas:ListServiceQuotas",
                "sns:CreateTopic",
                "sns:DeleteTopic",
                "sns:ListSubscriptionsByTopic",
                "sns:ListTopics",
                "sns:SetTopicAttributes",
                "sns:Subscribe",
                "sns:Unsubscribe",
                "sqs:CreateQueue",
                "sqs:DeleteMessage",
                "sqs:DeleteQueue",
                "sqs:ListQueues",
                "sqs:ReceiveMessage",
                "sqs:SetQueueAttributes",
                "ssm:DescribeInstanceInformation",
                "ssm:GetCommandInvocation",
                "ssm:SendCommand"
            ],
                      "Resource": "*",
                      "Effect": "Allow"
          }
    ]
}
Expand to view permissions to backup RDS instances 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "events:DeleteRule",
                "events:DescribeRule",
                "events:ListTargetsByRule",
                "events:PutRule",
                "events:PutTargets",
                "events:RemoveTargets",
                "iam:GetContextKeysForPrincipalPolicy",
                "iam:GetRole",
                "iam:SimulatePrincipalPolicy",
                "kms:CreateGrant",
                "kms:DescribeKey",
                "kms:GetKeyPolicy",
                "kms:ListKeys",
                "rds:AddTagsToResource",
                "rds:CopyDBSnapshot",
                "rds:CreateDBSnapshot",
                "rds:DeleteDBSnapshot",
                "rds:DescribeDBInstances",
                "rds:DescribeDBSnapshots",
                "rds:ListTagsForResource",
                "rds:ModifyDBSnapshotAttribute",
                "sns:CreateTopic",
                "sns:DeleteTopic",
                "sns:ListSubscriptionsByTopic",
                "sns:ListTopics",
                "sns:SetTopicAttributes",
                "sns:Subscribe",
                "sns:Unsubscribe",
                "sqs:CreateQueue",
                "sqs:DeleteMessage",
                "sqs:DeleteQueue",
                "sqs:ListQueues",
                "sqs:ReceiveMessage",
                "sqs:SendMessage",
                "sqs:SetQueueAttributes"
            ],
                      "Resource": "*",
                      "Effect": "Allow"
          }
    ]
}
Expand to view permissions to backup VPC settings 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ec2:DescribeAddresses",
                "ec2:DescribeClientVpnAuthorizationRules",
                "ec2:DescribeClientVpnEndpoints",
                "ec2:DescribeClientVpnRoutes",
                "ec2:DescribeClientVpnTargetNetworks",
                "ec2:DescribeCustomerGateways",
                "ec2:DescribeDhcpOptions",
                "ec2:DescribeEgressOnlyInternetGateways",
                "ec2:DescribeInstances",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeManagedPrefixLists",
                "ec2:DescribeNatGateways",
                "ec2:DescribeNetworkAcls",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeRegions",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeTransitGatewayAttachments",
                "ec2:DescribeTransitGatewayMulticastDomains",
                "ec2:DescribeTransitGatewayPeeringAttachments",
                "ec2:DescribeTransitGatewayRouteTables",
                "ec2:DescribeTransitGateways",
                "ec2:DescribeTransitGatewayVpcAttachments",
                "ec2:DescribeVpcAttribute",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeVpcEndpointServiceConfigurations",
                "ec2:DescribeVpcPeeringConnections",
                "ec2:DescribeVpcs",
                "ec2:DescribeVpnConnections",
                "ec2:DescribeVpnGateways",
                "ec2:GetManagedPrefixListEntries",
                "ec2:GetTransitGatewayRouteTableAssociations",
                "ec2:GetTransitGatewayRouteTablePropagations",
                "ec2:SearchTransitGatewayRoutes",
                "elasticloadbalancing:DescribeListeners",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeTags",
                "elasticloadbalancing:DescribeTargetGroups",
                "elasticloadbalancing:DescribeTargetHealth",
                "iam:GetContextKeysForPrincipalPolicy",
                "iam:ListAccountAliases",
                "iam:SimulatePrincipalPolicy",
                "ram:GetResourceShares",
                "ram:ListPrincipals",
                "ram:ListResources",
                "ram:ListResourceSharePermissions"
            ],
                      "Resource": "*",
                      "Effect": "Allow"
          }
    ]
}
  1. Navigate to Roles.
  2. Choose Create role. 
  3. Select the type of the trusted entity, Another AWS Account.
  4. In the Account ID field, enter the ID of your Backup Account (you can get this number in the AWS console of the Backup Account, in My Account located in the top-right menu).
  5. Select the Require external ID checkbox and enter a passphrase to raise security for the role.
  6. Click Next: Permissions.
  7. In the filter policies search box, enter the name of the policy created in Step 1.
  8. In the first column, select the policy.
  9. Click Next: Tags.
  10. Enter tagging info if needed and click Next: Review.
  11. Assign a name to the IAM Role. You will use this name in Veeam Backup for AWS (e.g., vb4aws_restore_role).
  12. Click Create role.
  13. Once the role is created, you will see it in the list of available roles.

Backup inside production deployment

This type of deployment (since it is not very secure) is recommended for test, demo and small environments only!
Use the following JSON text to create IAM Policy.
These permissions will allow the backup service to perform operations required for backup.
Expand to view permissions to backup EC2 instances 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ebs:ListChangedBlocks",
                "ebs:ListSnapshotBlocks",
                "ec2:AttachVolume",
                "ec2:CreateKeyPair",
                "ec2:CreateSnapshot",
                "ec2:CreateSnapshots",
                "ec2:CreateTags",
                "ec2:CreateVolume",
                "ec2:DeleteKeyPair",
                "ec2:DeleteSnapshot",
                "ec2:DeleteTags",
                "ec2:DeleteVolume",
                "ec2:DeregisterImage",
                "ec2:DescribeAccountAttributes",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeConversionTasks",
                "ec2:DescribeImages",
                "ec2:DescribeInstanceAttribute",
                "ec2:DescribeInstances",
                "ec2:DescribeInstanceStatus",
                "ec2:DescribeKeyPairs",
                "ec2:DescribeRegions",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSnapshots",
                "ec2:DescribeSubnets",
                "ec2:DescribeRouteTables",
                "ec2:DescribeVolumeAttribute",
                "ec2:DescribeVolumes",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeVpcs",
                "ec2:DescribeTags",
                "ec2:DetachVolume",
                "ec2:ImportImage",
                "ec2:ModifyInstanceAttribute",
                "ec2:ModifySnapshotAttribute",
                "ec2:DescribeVolumeAttribute",
                "ec2:GetEbsDefaultKmsKeyId",
                "ec2:RunInstances",
                "ec2:StartInstances",
                "ec2:StopInstances",
                "ec2:TerminateInstances",
                "events:DeleteRule",
                "events:DescribeRule",
                "events:ListTargetsByRule",
                "events:PutRule",
                "events:PutTargets",
                "events:RemoveTargets",
                "iam:GetContextKeysForPrincipalPolicy",
                "iam:GetRole",
                "iam:ListAttachedRolePolicies",
                "iam:ListInstanceProfilesForRole",
                "iam:ListRolePolicies",
                "iam:SimulatePrincipalPolicy",
                "kms:DescribeKey",
                "kms:ListAliases",
                "kms:CreateGrant",
                "kms:GetKeyPolicy",
                "kms:ReEncryptFrom",
                "kms:ReEncryptTo",
                "kms:ListKeys",
                "s3:GetBucketLocation",
                "servicequotas:ListServiceQuotas",
                "sns:CreateTopic",
                "sns:DeleteTopic",
                "sns:ListSubscriptionsByTopic",
                "sns:ListTopics",
                "sns:SetTopicAttributes",
                "sns:Subscribe",
                "sns:Unsubscribe",
                "ssm:GetCommandInvocation",
                "ssm:SendCommand",
                "sts:AssumeRole",
                "sts:GetCallerIdentity",
                "sts:GetSessionToken",
                "sqs:DeleteMessage",
                "sqs:ListQueues",
                "sqs:ReceiveMessage",
                "sqs:DeleteQueue",
                "sqs:SendMessage",
                "sqs:CreateQueue",
                "sqs:SetQueueAttributes",
                "ssm:DescribeInstanceInformation",
                "ssm:GetCommandInvocation",
                "ssm:SendCommand"
                ],
                      "Resource": "*",
                      "Effect": "Allow"
          }
    ]
}
Expand to view permissions to backup RDS instances 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "events:DeleteRule",
                "events:DescribeRule",
                "events:ListTargetsByRule",
                "events:PutRule",
                "events:PutTargets",
                "events:RemoveTargets",
                "iam:GetContextKeysForPrincipalPolicy",
                "iam:GetRole",
                "iam:SimulatePrincipalPolicy",
                "kms:CreateGrant",
                "kms:DescribeKey",
                "kms:GetKeyPolicy",
                "kms:ListKeys",
                "rds:AddTagsToResource",
                "rds:CopyDBSnapshot",
                "rds:CreateDBSnapshot",
                "rds:DeleteDBSnapshot",
                "rds:DescribeDBInstances",
                "rds:DescribeDBSnapshots",
                "rds:ListTagsForResource",
                "rds:ModifyDBSnapshotAttribute",
                "sns:CreateTopic",
                "sns:DeleteTopic",
                "sns:ListSubscriptionsByTopic",
                "sns:ListTopics",
                "sns:SetTopicAttributes",
                "sns:Subscribe",
                "sns:Unsubscribe",
                "sqs:CreateQueue",
                "sqs:DeleteMessage",
                "sqs:DeleteQueue",
                "sqs:ListQueues",
                "sqs:ReceiveMessage",
                "sqs:SendMessage",
                "sqs:SetQueueAttributes"
            ],
                      "Resource": "*",
                      "Effect": "Allow"
          }
    ]
}
Expand to view permissions to backup VPC settings 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ec2:DescribeAddresses",
                "ec2:DescribeClientVpnAuthorizationRules",
                "ec2:DescribeClientVpnEndpoints",
                "ec2:DescribeClientVpnRoutes",
                "ec2:DescribeClientVpnTargetNetworks",
                "ec2:DescribeCustomerGateways",
                "ec2:DescribeDhcpOptions",
                "ec2:DescribeEgressOnlyInternetGateways",
                "ec2:DescribeInstances",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeManagedPrefixLists",
                "ec2:DescribeNatGateways",
                "ec2:DescribeNetworkAcls",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeRegions",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeTransitGatewayAttachments",
                "ec2:DescribeTransitGatewayMulticastDomains",
                "ec2:DescribeTransitGatewayPeeringAttachments",
                "ec2:DescribeTransitGatewayRouteTables",
                "ec2:DescribeTransitGateways",
                "ec2:DescribeTransitGatewayVpcAttachments",
                "ec2:DescribeVpcAttribute",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeVpcEndpointServiceConfigurations",
                "ec2:DescribeVpcPeeringConnections",
                "ec2:DescribeVpcs",
                "ec2:DescribeVpnConnections",
                "ec2:DescribeVpnGateways",
                "ec2:GetManagedPrefixListEntries",
                "ec2:GetTransitGatewayRouteTableAssociations",
                "ec2:GetTransitGatewayRouteTablePropagations",
                "ec2:SearchTransitGatewayRoutes",
                "elasticloadbalancing:DescribeListeners",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeTags",
                "elasticloadbalancing:DescribeTargetGroups",
                "elasticloadbalancing:DescribeTargetHealth",
                "iam:GetContextKeysForPrincipalPolicy",
                "iam:ListAccountAliases",
                "iam:SimulatePrincipalPolicy",
                "ram:GetResourceShares",
                "ram:ListPrincipals",
                "ram:ListResources",
                "ram:ListResourceSharePermissions"
            ],
                      "Resource": "*",
                      "Effect": "Allow"
          }
    ]
}
  1. Navigate to Roles.
  2. Choose Create role.
  3. Select type of trusted entity AWS Service.
  4. Select your use case EC2. Choose EC2 in Select your use case
  5. Press Next: Permissions button.
  6. Enter the name of the policy created on step 1 in the filter policies search box.
  7. Select the policy by ticking the checkbox in the first column.
  8. Press Next: Tags button.
  9. Enter tagging info if desired and press the Next: Review button.
  10. Give a name to the IAM Role - you will be using this name in the Veeam Backup for AWS UI (e.g., vb4aws_pol2role).
  11. Press Create role button.
  12. After the successful creation of the role, you will see it in the list of all available roles.
  13. To add this role to the Veeam Backup for AWS service, you should update Trust relationships for the created role as described in KB3120.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please try again later.

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Verify your email to continue your product download
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend
Start using Veeam:
Download the product
&
Activate the license key
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

error icon

Oops! Something went wrong.

Please try again later.