1-800-691-1991 | 9am - 8pm ET
EN

How to Create Custom Worker Instance IAM Role

KB ID: 3060
Product: Veeam Backup for AWS
Version: Any
Published: 2020-06-24
Last Modified: 2021-03-03
Get weekly article updates
By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Policy.

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

error icon

Oops! Something went wrong.

Please try again later.

Challenge

The Worker IAM role is used to launch worker instances for backup and restore using S3 repository.

Solution

To configure a custom Worker IAM Role follow the steps below.

Use the following JSON to create an IAM Policy using the following instructions from the How to create IAM Policy article. These permissions will allow Veeam Backup for AWS service to perform operations required:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:SendCommand",
                "ssm:GetCommandInvocation",
                "sqs:ListQueues",
                "sqs:CreateQueue",
                "sqs:SetQueueAttributes",
                "sqs:ReceiveMessage",
                "sqs:DeleteMessage",
                "sqs:DeleteQueue",
                "ec2:DescribeRegions",
                "ec2:DescribeAccountAttributes",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeVpcs",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeSubnets",
                "ec2:DescribeInstances",
                "ec2:DescribeInstanceAttribute",
                "ec2:RunInstances",
                "ec2:StopInstances",
                "ec2:TerminateInstances",
                "ec2:ModifyInstanceAttribute",
                "ec2:DescribeKeyPairs",
                "ec2:CreateKeyPair",
                "ec2:DeleteKeyPair",
                "ec2:DescribeVolumes",
                "ec2:CreateVolume",
                "ec2:AttachVolume",
                "ec2:DetachVolume",
                "ec2:DeleteVolume",
                "ec2:DescribeSnapshots",
                "ec2:CreateSnapshot",
                "ec2:CreateSnapshots",
                "ec2:DeleteSnapshot",
                "ec2:ModifySnapshotAttribute",
                "ec2:CreateTags",
                "ec2:DescribeImages",
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:CreateInstanceProfile",
                "iam:ListAttachedRolePolicies",
                "iam:ListInstanceProfilesForRole",
                "iam:AddRoleToInstanceProfile",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "iam:PassRole",
                "iam:DetachRolePolicy",
                "iam:DeleteRolePolicy",
                "iam:ListRolePolicies",
                "iam:DeleteInstanceProfile",
                "iam:GetRole",
                "iam:GetInstanceProfile",
                "ebs:ListChangedBlocks",
                "ebs:ListSnapshotBlocks",
                "kms:ListKeys",
                "kms:ListAliases",
                "kms:GetKeyPolicy",
                "kms:ReEncryptTo",
                "kms:ReEncryptFrom",
                "kms:DescribeKey",
                "ec2:GetEbsDefaultKmsKeyId",
                "kms:CreateGrant",
                "servicequotas:ListServiceQuotas",
                "ec2:DescribeTags",
                "ec2:DescribeInstanceStatus",
                "ec2:StartInstances",
                "sqs:SendMessage",
                "sts:GetSessionToken",
                "ebs:ListChangedBlocks",
                "ebs:ListSnapshotBlocks",
                "ec2:DescribeVolumeAttribute",
		"iam:GetContextKeysForPrincipalPolicy",
		"iam:SimulatePrincipalPolicy"
            ],
            "Resource": "*"
        }
    ]
}
The following role configuration steps will vary depending on in which account the created Worker IAM role will be located in relation to your Veeam Backup for AWS service.
 

Worker IAM Role and Veeam Backup for AWS service will be located in different accounts

 
  1. Navigate to Roles in the IAM Service.
  2. Choose Create role.
  3. Select the type of the trusted entity Another AWS Account.
  4. In the Account ID field, enter the ID of your Backup Account (you can get this number in the AWS console of the Backup Account, in My Account located in the top-right menu).
  5. Select the Require external ID checkbox and enter a pass phrase to raise the level of security for the role.
  6. Click Next: Permissions.
  7. In the filter policies search box, enter the name of the policy created in the Step 1.
  8. In the first column, select the policy.
  9. Click Next: Tags.
  10. Enter tagging info if needed and click Next: Review.
  11. Assign a name to the IAM Role. This name will be used in Veeam Backup for AWS (e.g. vb4aws_workers_role).
  12. Click Create role.
  13. Once the role is created, you will be able to see it in the list of available roles.

Alternatively, you can use create role wizard with Service role checked in configuration.
 

Worker IAM role will be created in the same account as the Veeam Backup for AWS service

 
  1. Navigate to Roles in the IAM Service.
  2. Choose Create role.
  3. Select the type of the trusted entity AWS Service.
  4. Select EC2 in Choose the service that will use this role.
  5. Click Next: Permissions.
  6. In filter policies search box, enter the name of the policy created in the Step 1 
  7. In the first column, select the policy.
  8. Click Next: Tags.
  9. Enter tagging info if needed and click Next: Review.
  10. Assign a name to the IAM Role. This name will be used in Veeam Backup for AWS (e.g. vb4aws_worker_role).
  11. Click Create role.
  12. Once the role is created, you will be able to see it in the list of available roles.
  13. To add this role to the Veeam Backup for AWS service, you must update Trust relationships for the created role as described in this article.
Click here to send feedback regarding this KB, or suggest content for a new KB.
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please try again later.

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case

By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Policy.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Thank you for your interest in Veeam products!
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

error icon

Oops! Something went wrong.

Please try again later.