Checking IAM Role Permissions

You can check whether permissions of an IAM role are sufficient to perform a data protection or disaster recovery operation for which the IAM role is specified.

It is recommended that you run the IAM role permission check before you perform any operation to avoid the operation failure. For example, after you specify an IAM role in worker instance settings, you can check whether permissions of this IAM are sufficient to launch worker instances. You can also run the permission check if you made changes in your AWS account and want to ensure that permissions granted to the IAM role remain sufficient.

To run the permission check for an IAM role, do the following:

1. Switch to the Configuration page.

2. Navigate to Accounts > IAM Roles.

3. Select an IAM role and click Check AWS permissions.

Veeam Backup for AWS will display the AWS Permission Check for IAM Role window where you can view the progress and results of the performed check. If the IAM role permissions are insufficient, the check will complete with errors. You can view the list of permissions that must be granted to the IAM role in the Missing Permissions column.

You can grant the missing permissions to the IAM role in the IAM Management Console or instruct Veeam Backup for AWS to do it. To learn how to grant permissions to an IAM Role using the IAM Management Console, see AWS Documentation.

To let Veeam Backup for AWS grant the missing permissions:

1. In the AWS Permission Check for IAM Role window, click Grant.
2. In the Grant permissions window, provide one-time access keys of an IAM user that is authorized to update permissions of the IAM role, and then click Apply.

3. To make sure that the missing permissions were successfully granted, click Recheck.