How to Create Secure IAM Policy for Connection to S3 Object Storage
| KB ID: | 3151 |
| Product: | Veeam Backup & Replication |
| Published: | 2020-04-21 |
| Last Modified: | 2021-06-23 |
Challenge
How to create a secure IAM policy to connect to the S3 bucket where backup data is to be stored (Veeam Backup Object Repository).
Solution
There are two policies to choose from. The first policy is for use when immutability is not used for the cloud tier. The second policy is for use when immutability is used for the cloud tier.
Use the following JSON for non-immutable buckets (make sure to replace the <yourbucketname> tag with the actual name) to create an IAM Policy by following the instructions from the How to Create IAM Policy article. These permissions will allow Veeam Backup Service to access the S3 repository to save/load data to/from an object repository.
Use the following JSON for non-immutable buckets (make sure to replace the <yourbucketname> tag with the actual name) to create an IAM Policy by following the instructions from the How to Create IAM Policy article. These permissions will allow Veeam Backup Service to access the S3 repository to save/load data to/from an object repository.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "SecureBucketPolicy0",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject",
"s3:GetBucketLocation",
"s3:GetBucketVersioning",
"s3:GetBucketObjectLockConfiguration"
],
"Resource": [
"arn:aws:s3:::<yourbucketname>/*",
"arn:aws:s3:::<yourbucketname>"
]
},
{
"Sid": "SecureBucketPolicy1",
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"s3:ListBucket"
],
"Resource": "*"
}
]
}
Use the following JSON for immutable buckets (make sure to replace the <yourbucketname> tag with the actual name) to create an IAM Policy by following the instructions from the How to Create IAM Policy article. These permissions will allow Veeam Backup Service to access the S3 repository to save/load data to/from an object repository.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject",
"s3:GetBucketVersioning",
"s3:GetBucketObjectLockConfiguration",
"s3:ListBucketVersions",
"s3:GetObjectVersion",
"s3:GetObjectRetention",
"s3:GetObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectLegalHold",
"s3:DeleteObjectVersion"
],
"Resource": [
"arn:aws:s3:::<yourbucketname>/*",
"arn:aws:s3:::<yourbucketname>"
]
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"s3:ListBucket"
],
"Resource": "*"
}
]
}More information
IAM Policy creation instructions - https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html
Veeam Help Center reference - https://helpcenter.veeam.com/docs/backup/vsphere/required_permissions.html
Veeam Help Center reference - https://helpcenter.veeam.com/docs/backup/vsphere/required_permissions.html
| KB ID: | 3151 |
| Product: | Veeam Backup & Replication |
| Published: | 2020-04-21 |
| Last Modified: | 2021-06-23 |
Couldn't find what you were looking for?
Below you can submit an idea for a new knowledge base article.
Report a typo on this page:
Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!
Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!
