How to Configure "Trust relationships" for Custom Roles

KB ID:
3120
Product:
Veeam Backup for AWS
Version:
1.0
Published:
Last Modified:
2020-03-02

Challenge

You are using custom roles for Veeam Backup for AWS.

Cause

You must manually add a default role (e.g. <SERVER_NAME>-VeeamImpersonationRoleV1-XXXXXXXXXXXX) to the list of trusted relationships, otherwise the following error will be shown in the UI when you are adding a custom role into the Veeam Backup for AWS configuration:

User-added image

and the following error message will be found in the log file:

[14.02.2020 14:46:34] <ab9a> Info     [CDefaultAmazonStsInfrastructure] Assuming role 'arn:aws:iam::xxxxxxxxxxxxx:role/custom_role'.
[14.02.2020 14:46:35] <ab9a> Error    [TryInvokeAsync] Attempt: 1/10. Fail: User: arn:aws:sts::xxxxxxxxxxxxx:assumed-role/<SERVER_NAME>-VeeamImpersonationRoleV1-XXXXXXXXXXXX/x-xxxxxxxxxxxxxxxxx is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::xxxxxxxxxxxxx:role/custom_role

Solution

1. Go to Cloud Formation service in the region where Veeam Backup for AWS server is deployed.
2. Select appropriate Stack from the list by clicking its name in the Stack Name column.
3. Go to the Resources tab.
4. Find the <SERVER_NAME>-VeeamImpersonationRoleV1-XXXXXXXXXXXX in the Logical ID column.
5. Go to the role description by clicking it's name in the Physical ID column.
6. Copy Role ARN by clicking Copy to clipboard in order to add it to the trusted list for recently added role:
User-added image
7. Go to the Roles tab in Identity and Access Management (IAM) service.
8. Find the custom role you want to add into Veeam Backup for AWS.
9. Select it by clicking its name in the Role Name column.
10. Go to the Trust relationship tab.
User-added image
11. Click Edit trust relationship.
12. Add the following JSON.
{
    "Version": "2012-10-17",
    "Statement": [
    {
        "Effect": "Allow",
        "Principal":
    {
        "AWS": "ARN of the role from step 6"
    },
        "Action": "sts:AssumeRole"
    }
  ]
}

Rate the quality of this KB article: 
5 out of 5 based on 1 ratings

Couldn't find what you were looking for?

Below you can submit an idea for a new knowledge base article.

Report a typo on this page:

Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!

Spelling error in text:

Submit