- Veeam Support Knowledge Base
- How to Create Custom IAM Role to Perform Restores
How to Create Custom IAM Role to Perform Restores
Get weekly article updates
By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.
Cheers for trusting us with the spot in your mailbox!
Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest
Veeam Backup for AWS requires certain privileges in order to restore backup data.
To perform restores, the proper security access must be provided to the Veeam Backup for AWS server:
- Specify an IAM role which Veeam Backup for AWS server can switch to for restore operations.
- Provide access keys from an IAM User
There are two types of deployments where IAM role is required to perform a restore:
- Isolated from production backup
- Backup inside the production
Depending on the deployment type, IAM Roles must be created in different accounts.
Isolated from production backup deployment
The isolated from production deployment type provides exceptional level of protection in cases when the whole production environment is lost. This type of deployment is recommended as the most secure one.
In this type of deployment, the Veeam Backup for AWS server is running in a dedicated Backup Account. The IAM Restore Role must be created in the Production Account.
Use the following JSON to create an IAM Policy.
These permissions will allow Veeam Backup for AWS service to perform operations required for restore.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ec2:AttachVolume",
"ec2:CopySnapshot",
"ec2:CreateKeyPair",
"ec2:CreateTags",
"ec2:CreateVolume",
"ec2:DeleteKeyPair",
"ec2:DeleteSnapshot",
"ec2:DeleteTags",
"ec2:DeleteVolume",
"ec2:DeregisterImage",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeImages",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstances",
"ec2:DescribeInstanceStatus",
"ec2:DescribeKeyPairs",
"ec2:DescribeRegions",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DescribeRouteTables",
"ec2:DescribeVolumes",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcs",
"ec2:DescribeTags",
"ec2:DetachVolume",
"ec2:ImportImage",
"ec2:ModifyInstanceAttribute",
"ec2:ModifySnapshotAttribute",
"ec2:RunInstances",
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:TerminateInstances",
"ec2:GetEbsDefaultKmsKeyId",
"events:DeleteRule",
"events:DescribeRule",
"events:ListTargetsByRule",
"events:PutRule",
"events:PutTargets",
"events:RemoveTargets",
"iam:AddRoleToInstanceProfile",
"iam:AttachRolePolicy",
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:DeleteRolePolicy",
"iam:DetachRolePolicy",
"iam:GetInstanceProfile",
"iam:GetRole",
"iam:ListAttachedRolePolicies",
"iam:ListInstanceProfilesForRole",
"iam:ListRolePolicies",
"iam:PassRole",
"iam:PutRolePolicy",
"iam:RemoveRoleFromInstanceProfile",
"kms:DescribeKey",
"kms:ListAliases",
"kms:ListKeys",
"kms:CreateGrant",
"kms:GetKeyPolicy",
"kms:ReEncryptFrom",
"kms:ReEncryptTo",
"s3:GetBucketLocation",
"servicequotas:ListServiceQuotas"
],
"Resource": "*",
"Effect": "Allow"
}
]
}- Navigate to Roles.
- Choose Create role.
- Select the type of the trusted entity Another AWS Account.
- In the Account ID field, enter the ID of your Backup Account (you can get this number in the AWS console of the Backup Account, in My Account located in the top-right menu).
- Select the Require external ID checkbox and enter a passphrase to raise the level of security for the role.
- Click Next: Permissions.
- In the filter policies search box, enter the name of the policy created in Step 1.
- In the first column, select the policy.
- Click Next: Tags.
- Enter tagging info if needed and click Next: Review.
- Assign a name to the IAM Role. This name will be used in Veeam Backup for AWS (e.g. vb4aws_restore_role).
- Click Create role.
- Once the role is created, you will be able to see it in the list of available roles.
Backup inside Production deployment
This type of deployment (since it is not very secure) is recommended for test, demo and small environments only!
Use the following JSON to create an IAM Policy.
These permissions will allow Veeam Backup for AWS service to perform operations required for restore.
These permissions will allow Veeam Backup for AWS service to perform operations required for restore.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ec2:AttachVolume",
"ec2:CopySnapshot",
"ec2:CreateKeyPair",
"ec2:CreateTags",
"ec2:CreateVolume",
"ec2:DeleteKeyPair",
"ec2:DeleteSnapshot",
"ec2:DeleteTags",
"ec2:DeleteVolume",
"ec2:DeregisterImage",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeImages",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstances",
"ec2:DescribeInstanceStatus",
"ec2:DescribeKeyPairs",
"ec2:DescribeRegions",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DescribeRouteTables",
"ec2:DescribeVolumes",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcs",
"ec2:DescribeTags",
"ec2:DetachVolume",
"ec2:ImportImage",
"ec2:ModifyInstanceAttribute",
"ec2:ModifySnapshotAttribute",
"ec2:RunInstances",
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:TerminateInstances",
"ec2:GetEbsDefaultKmsKeyId",
"events:DeleteRule",
"events:DescribeRule",
"events:ListTargetsByRule",
"events:PutRule",
"events:PutTargets",
"events:RemoveTargets",
"iam:AddRoleToInstanceProfile",
"iam:AttachRolePolicy",
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:DeleteRolePolicy",
"iam:DetachRolePolicy",
"iam:GetInstanceProfile",
"iam:GetRole",
"iam:ListAttachedRolePolicies",
"iam:ListInstanceProfilesForRole",
"iam:ListRolePolicies",
"iam:PassRole",
"iam:PutRolePolicy",
"iam:RemoveRoleFromInstanceProfile",
"kms:DescribeKey",
"kms:ListAliases",
"kms:ListKeys",
"kms:CreateGrant",
"kms:GetKeyPolicy",
"kms:ReEncryptFrom",
"kms:ReEncryptTo",
"s3:GetBucketLocation",
"servicequotas:ListServiceQuotas"
],
"Resource": "*",
"Effect": "Allow"
}
]
}- Navigate to Roles
- Choose Create role
- Select the type of the trusted entity AWS Service
- Select EC2 in Choose the service that will use this role
- Click Next: Permissions
- In the filter policies edit box, enter the name of the policy specified in Step 1
- In the first column, select the policy
- Click Next: Tags
- Enter tagging info if needed and click Next: Review
- Assign a name to the IAM Role. This name will be used in Veeam Backup for AWS (e.g. vb4aws_restore_role)
- Click Create role
- Once the role is created, you will be able to see it in the list of available roles
- To add this role to the Veeam Backup for AWS service, you must update Trust relationships for the created role as described in KB3120.
How to obtain access keys for IAM User to use for Instance Restore operation
If you already have an IAM User account which you would like to use to perform restore operations, go to the section "Acquiring access keys for an IAM User".
Creating an IAM User for performing restore
Use the following JSON to create an IAM Policy.
These permissions will allow the Veeam Backup for AWS service to perform operations required for restore.
In order to restore EC2 instances, use the permissions below.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ec2:AttachVolume",
"ec2:CopySnapshot",
"ec2:CreateTags",
"ec2:CreateVolume",
"ec2:DeleteSnapshot",
"ec2:DeleteTags",
"ec2:DeleteVolume",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeConversionTasks",
"ec2:DescribeImages",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstances",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstanceTypes",
"ec2:DescribeKeyPairs",
"ec2:DescribeRegions",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DescribeVolumes",
"ec2:DescribeVpcs",
"ec2:DescribeTags",
"ec2:DetachVolume",
"ec2:GetEbsDefaultKmsKeyId",
"ec2:ModifyInstanceAttribute",
"ec2:ModifySnapshotAttribute",
"ec2:RunInstances",
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:TerminateInstances",
"events:DeleteRule",
"events:DescribeRule",
"events:ListTargetsByRule",
"events:PutRule",
"events:PutTargets",
"events:RemoveTargets",
"iam: GetContextKeysForPrincipalPolicy",
"iam:PassRole",
"iam: SimulatePrincipalPolicy",
"kms:CreateGrant",
"kms:DescribeKey",
"kms:GetKeyPolicy",
"kms:ListAliases",
"kms:ListKeys",
"kms:ReEncryptFrom",
"kms:ReEncryptTo",
"s3:GetBucketLocation",
"servicequotas:ListServiceQuotas",
"sns:CreateTopic",
"sns:DeleteTopic",
"sns:ListSubscriptionsByTopic",
"sns:ListTopics",
"sns:SetTopicAttributes",
"sns:Subscribe",
"sns:Unsubscribe",
"ssm:GetCommandInvocation",
"ssm:SendCommand",
"sts:AssumeRole",
"sts:GetCallerIdentity",
"sts:GetSessionToken",
"sqs:DeleteMessage",
"sqs:ListQueues",
"sqs:ReceiveMessage",
"sqs:DeleteQueue",
"sqs:SendMessage",
"sqs:CreateQueue",
"sqs:SetQueueAttributes"
],
"Resource": "*",
"Effect": "Allow"
}
]
}
In order to restore RDS instances, use the permissions below.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ec2:DescribeAvailabilityZones",
"ec2:DescribeRegions",
"ec2:DescribeSecurityGroups",
"ec2:DescribeVpcs",
"iam:CreateServiceLinkedRole",
"iam:GetContextKeysForPrincipalPolicy",
"iam:PassRole",
"iam:SimulatePrincipalPolicy",
"kms:CreateGrant",
"kms:DescribeKey",
"kms:GetKeyPolicy",
"kms:ListAliases",
"kms:ListKeys",
"rds:AddTagsToResource",
"rds:CopyDBSnapshot",
"rds:DeleteDBInstance",
"rds:DeleteDBSnapshot",
"rds:DescribeDBEngineVersions",
"rds:DescribeDBInstances",
"rds:DescribeDBParameterGroups",
"rds:DescribeDBSnapshots",
"rds:DescribeDBSubnetGroups",
"rds:DescribeOptionGroups",
"rds:DescribeOrderableDBInstanceOptions",
"rds:ListTagsForResource",
"rds:ModifyDBInstance",
"rds:RemoveTagsFromResource",
"rds:RestoreDBInstanceFromDBSnapshot"
],
"Resource": "*",
"Effect": "Allow"
}
]
}
In order to restore VPC settings, use the permissions below.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ec2:AcceptVpcEndpointConnections",
"ec2:AllocateAddress",
"ec2:AssociateAddress",
"ec2:AssociateClientVpnTargetNetwork",
"ec2:AssociateDhcpOptions",
"ec2:AssociateRouteTable",
"ec2:AssociateSubnetCidrBlock",
"ec2:AssociateTransitGatewayMulticastDomain",
"ec2:AssociateTransitGatewayRouteTable",
"ec2:AssociateVpcCidrBlock",
"ec2:AttachInternetGateway",
"ec2:AttachVpnGateway",
"ec2:AuthorizeClientVpnIngress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:CreateClientVpnEndpoint",
"ec2:CreateClientVpnRoute",
"ec2:CreateCustomerGateway",
"ec2:CreateDefaultSubnet",
"ec2:CreateDefaultVpc",
"ec2:CreateDhcpOptions",
"ec2:CreateEgressOnlyInternetGateway",
"ec2:CreateInternetGateway",
"ec2:CreateManagedPrefixList",
"ec2:CreateNatGateway",
"ec2:CreateNetworkAcl",
"ec2:CreateNetworkAclEntry",
"ec2:CreateNetworkInterface",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSecurityGroup",
"ec2:CreateSubnet",
"ec2:CreateTags",
"ec2:CreateTransitGateway",
"ec2:CreateTransitGatewayMulticastDomain",
"ec2:CreateTransitGatewayPeeringAttachment",
"ec2:CreateTransitGatewayRoute",
"ec2:CreateTransitGatewayRouteTable",
"ec2:CreateTransitGatewayVpcAttachment",
"ec2:CreateVpc",
"ec2:CreateVpcEndpoint",
"ec2:CreateVpcEndpointServiceConfiguration",
"ec2:CreateVpcPeeringConnection",
"ec2:CreateVpnConnection",
"ec2:CreateVpnGateway",
"ec2:DeleteClientVpnEndpoint",
"ec2:DeleteClientVpnRoute",
"ec2:DeleteCustomerGateway",
"ec2:DeleteDhcpOptions",
"ec2:DeleteEgressOnlyInternetGateway",
"ec2:DeleteInternetGateway",
"ec2:DeleteManagedPrefixList",
"ec2:DeleteNatGateway",
"ec2:DeleteNetworkAcl",
"ec2:DeleteNetworkAclEntry",
"ec2:DeleteNetworkInterface",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSecurityGroup",
"ec2:DeleteSubnet",
"ec2:DeleteTransitGateway",
"ec2:DeleteTransitGatewayMulticastDomain",
"ec2:DeleteTransitGatewayPeeringAttachment",
"ec2:DeleteTransitGatewayRoute",
"ec2:DeleteTransitGatewayRouteTable",
"ec2:DeleteTransitGatewayVpcAttachment",
"ec2:DeleteVpc",
"ec2:DeleteVpcEndpoints",
"ec2:DeleteVpcEndpointServiceConfigurations",
"ec2:DeleteVpcPeeringConnection",
"ec2:DeleteVpnConnection",
"ec2:DeleteVpnGateway",
"ec2:DescribeAddresses",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeClientVpnAuthorizationRules",
"ec2:DescribeClientVpnEndpoints",
"ec2:DescribeClientVpnRoutes",
"ec2:DescribeClientVpnTargetNetworks",
"ec2:DescribeCustomerGateways",
"ec2:DescribeDhcpOptions",
"ec2:DescribeEgressOnlyInternetGateways",
"ec2:DescribeInstances",
"ec2:DescribeInternetGateways",
"ec2:DescribeManagedPrefixLists",
"ec2:DescribeNatGateways",
"ec2:DescribeNetworkAcls",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeTransitGatewayAttachments",
"ec2:DescribeTransitGatewayMulticastDomains",
"ec2:DescribeTransitGatewayPeeringAttachments",
"ec2:DescribeTransitGatewayRouteTables",
"ec2:DescribeTransitGateways",
"ec2:DescribeTransitGatewayVpcAttachments",
"ec2:DescribeVpcAttribute",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcEndpointServiceConfigurations",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeVpcs",
"ec2:DescribeVpnConnections",
"ec2:DescribeVpnGateways",
"ec2:DetachInternetGateway",
"ec2:DetachVpnGateway",
"ec2:DisableTransitGatewayRouteTablePropagation",
"ec2:DisableVgwRoutePropagation",
"ec2:DisassociateAddress",
"ec2:DisassociateClientVpnTargetNetwork",
"ec2:DisassociateRouteTable",
"ec2:DisassociateTransitGatewayMulticastDomain",
"ec2:DisassociateTransitGatewayRouteTable",
"ec2:EnableTransitGatewayRouteTablePropagation",
"ec2:EnableVgwRoutePropagation",
"ec2:GetManagedPrefixListEntries",
"ec2:GetTransitGatewayMulticastDomainAssociations",
"ec2:GetTransitGatewayRouteTableAssociations",
"ec2:GetTransitGatewayRouteTablePropagations",
"ec2:ModifyClientVpnEndpoint",
"ec2:ModifyManagedPrefixList",
"ec2:ModifyNetworkInterfaceAttribute",
"ec2:ModifySubnetAttribute",
"ec2:ModifyTransitGateway",
"ec2:ModifyTransitGatewayVpcAttachment",
"ec2:ModifyVpcAttribute",
"ec2:ModifyVpcEndpoint",
"ec2:ModifyVpcEndpointServiceConfiguration",
"ec2:ModifyVpcPeeringConnectionOptions",
"ec2:ModifyVpnConnection",
"ec2:RejectVpcEndpointConnections",
"ec2:ReleaseAddress",
"ec2:ReplaceNetworkAclAssociation",
"ec2:ReplaceRouteTableAssociation",
"ec2:RevokeClientVpnIngress",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:SearchTransitGatewayRoutes",
"elasticloadbalancing:AddTags",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateTargetGroup",
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:DeleteLoadBalancer",
"elasticloadbalancing:DeleteTargetGroup",
"elasticloadbalancing:DeregisterTargets",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeTags",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:ModifyTargetGroup",
"elasticloadbalancing:RegisterTarget",
"elasticloadbalancing:RemoveTags",
"elasticloadbalancing:SetSecurityGroups",
"elasticloadbalancing:SetSubnets",
"iam:GetContextKeysForPrincipalPolicy",
"iam:SimulatePrincipalPolicy",
"lambda:ListFunctions",
"ram:AssociateResourceShare",
"ram:CreateResourceShare",
"ram:DeleteResourceShare",
"ram:DisassociateResourceShare",
"ram:GetResourceShares",
"ram:ListPrincipals",
"ram:ListResources",
"ram:ListResourceSharePermissions",
"ram:TagResource",
"ram:UntagResource",
"servicequotas:ListServiceQuotas"
],
"Resource": "*",
"Effect": "Allow"
}
]
}- Navigate to Users section of IAM Management.
- Click Add User.
- Enter the user name and select Access Type as AWS Management Console access.
- Select the password for this user and proceed to the next step by clicking Next: Permissions.
- Select attach existing policies directly.
- Filter by entering the name of the policy selected on step 1 and select the found item and proceed to the next page.
- Enter tagging info if needed and click Next: Review.
- Click Create User.
Acquiring access keys for an IAM User
- Navigate to Users section of IAM Management.
- Click the User name of the IAM User that you want to use for restore operations.
- Switch to the Security Credentials tab.
- Click Create Access Key.
- In the popup window, you will see a pair of access key and security key (hidden under the Show link).
- Copy and paste access and security keys to the Veeam Backup for AWS server UI, into the Account section of the restore wizard.
It is highly recommended to deactivate access keys right after the restore operation is complete. To do that, click the Make inactive link for the security key created.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
Spelling error in text
Thank you!
Your feedback has been received and will be reviewed.
Oops! Something went wrong.
Please try again later.
You have selected too large block!
Please try select less.
KB Feedback/Suggestion
This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
Verify your email to continue your product download
We've sent a verification code to:
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend
Start using Veeam:
Download the product
&
Activate the license key
Thank you!
Your feedback has been received and will be reviewed.