How to Create Custom IAM Role to Connect to the Repository

KB ID:
3033
Product:
Veeam Backup for AWS
Version:
1.0
Published:
Last Modified:
2020-03-02

Challenge

The backup service is using the IAM Role to generate temporary access keys to connect to the S3 bucket where backup data is stored (Veeam Backup Object Repository).

Solution

1. Use the following JSON (make sure to replace the <yourbucketname> tag with the actual name) to create a IAM Policy by following the instructions from the How to create IAM Policy article.
These permissions will allow backup service to access the S3 repository to save/load data to/from an object repository.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::<yourbucketname>/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::<yourbucketname>"
        },
        {
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "*"
        }
    ]
}
2. In AWS Management Console, navigate to IAM Management Console (Services -> Security, Identity & Compliance -> IAM).
3. Click Create role.
4. Select the type of the trusted entity AWS Service.
5. Choose S3 in Choose the service that will use this role.
6. Choose S3 in Select your use case.
7. Click Next: Permissions
8. in the filter policies search box, enter the name of the policy created in the Step 1.
9. In the first column, select the policy.
10. Click Next: Tags.
11. Enter tagging info and click Next: Review.
12. Give a name to the IAM Role. You will be using this name in the Veeam Backup for AWS UI (e.g. vb4aws_repo1role).
13. Click Create role.
14. One the role is created, you will be able to see it in the list of available roles.
15. To add this role to the Veeam Backup for AWS service, you must update "Trust relationships" for the created role as described in this article.

Rate the quality of this KB article: 
3.5 out of 5 based on 2 ratings

Couldn't find what you were looking for?

Below you can submit an idea for a new knowledge base article.

Report a typo on this page:

Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!

Spelling error in text:

Submit