https://login.veeam.com/en/oauth?client_id=nXojRrypJ8&redirect_uri=https%3A%2F%2Fwww.veeam.com%2Fservices%2Fauthentication%2Fredirect_url&response_type=code&scope=profile&state=eyJmaW5hbFJlZGlyZWN0TG9jYXRpb24iOiJodHRwczovL3d3dy52ZWVhbS5jb20va2IzMTIwIiwiaGFzaCI6IjI0YjRjYzU0LWZmZTgtNGE5Zi1hZWI1LTQyMWM5NjdlNjc3MyJ9
1-800-691-1991 | 9am - 8pm ET
EN

How to Configure "Trust relationships" for Custom Roles

Challenge

You are using custom roles for Veeam Backup for AWS.

Cause

You must manually add a default role (e.g. <SERVER_NAME>-VeeamImpersonationRoleV1-XXXXXXXXXXXX) to the list of trusted relationships, otherwise the following error will be shown in the UI when you are adding a custom role into the Veeam Backup for AWS configuration:

User-added image

and the following error message will be found in the log file:

[14.02.2020 14:46:34] <ab9a> Info     [CDefaultAmazonStsInfrastructure] Assuming role 'arn:aws:iam::xxxxxxxxxxxxx:role/custom_role'.
[14.02.2020 14:46:35] <ab9a> Error    [TryInvokeAsync] Attempt: 1/10. Fail: User: arn:aws:sts::xxxxxxxxxxxxx:assumed-role/<SERVER_NAME>-VeeamImpersonationRoleV1-XXXXXXXXXXXX/x-xxxxxxxxxxxxxxxxx is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::xxxxxxxxxxxxx:role/custom_role

Solution

1. Go to Cloud Formation service in the region where Veeam Backup for AWS server is deployed.
2. Select appropriate Stack from the list by clicking its name in the Stack Name column.
3. Go to the Resources tab.
4. Find the <SERVER_NAME>-VeeamImpersonationRoleV1-XXXXXXXXXXXX in the Logical ID column.
5. Go to the role description by clicking it's name in the Physical ID column.
6. Copy Role ARN by clicking Copy to clipboard in order to add it to the trusted list for recently added role:
User-added image
7. Go to the Roles tab in Identity and Access Management (IAM) service.
8. Find the custom role you want to add into Veeam Backup for AWS.
9. Select it by clicking its name in the Role Name column.
10. Go to the Trust relationship tab.
User-added image
11. Click Edit trust relationship.
12. Add the following JSON.
{
    "Version": "2012-10-17",
    "Statement": [
    {
        "Effect": "Allow",
        "Principal":
    {
        "AWS": "ARN of the role from step 6"
    },
        "Action": "sts:AssumeRole"
    }
  ]
}
KB ID:
3120
Product:
Veeam Backup for AWS
Version:
Any
Published:
2020-03-02
Last Modified:
2020-08-13
Please rate how helpful this article was to you:
5 out of 5 based on 1 ratings
Thank you for helping us improve!
An error occurred during voting. Please try again later.

Couldn't find what you were looking for?

Below you can submit an idea for a new knowledge base article.
Report a typo on this page:

Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!

Spelling error in text

Knowledge base content request
By submitting, you agree that your personal data will be managed by Veeam in accordance with the Privacy Policy.
Your report was sent to the responsible team. Our representative will contact you by email you provided.
We're working on it please try again later