This is an archive version of the document. To get the most up-to-date information, see the current version.RDS Backup IAM Role Permissions
Veeam Backup for AWS uses RDS Backup Policy IAM roles to perform the following operations:
- To enumerate resources added to a backup policy.
- To create cloud-native snapshots of RDS resources protected by the policy.
- To create snapshot replicas, and so on.
To perform these operations, IAM roles specified in the backup policy settings must be granted the following permissions:
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:DescribeAvailabilityZones", "ec2:DescribeRegions", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:GetContextKeysForPrincipalPolicy", "iam:GetRole", "iam:ListAccountAliases", "iam:SimulatePrincipalPolicy", "kms:CreateGrant", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:ListAliases", "kms:ListKeys", "rds:AddTagsToResource", "rds:CopyDBClusterSnapshot", "rds:CopyDBSnapshot", "rds:CreateDBClusterSnapshot", "rds:CreateDBSnapshot", "rds:DeleteDBClusterSnapshot", "rds:DeleteDBSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:ListTagsForResource", "rds:ModifyDBClusterSnapshotAttribute", "rds:ModifyDBSnapshotAttribute", "rds:RemoveTagsFromResource", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:SetTopicAttributes", "sns:Subscribe", "sns:Unsubscribe", "sqs:CreateQueue", "sqs:DeleteMessage", "sqs:DeleteQueue", "sqs:ListQueues", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:SetQueueAttributes" ], "Resource": "*", "Effect": "Allow" } ] } |