Veeam Backup for AWS 7.0 [Archived]
User Guide
Related documents
Search
This is an archive version of the document. To get the most up-to-date information, see the current version.

Full List of IAM Permissions

If you want Veeam Backup for AWS to use a single IAM role to perform all restore and backup operations, you can use the Default Backup Restore IAM role created during Veeam Backup for AWS installation or a custom IAM role that must meet the following requirements:

  1. The IAM role must be included at least in one instance profile. For more information on instance profiles, see AWS Documentation.
  1. The Amazon EC2, Amazon S3 Batch Operations and Amazon Backup services must be granted permissions to assume the IAM roles.

To allow an Amazon service to assume an IAM role, configure trust relationships for the role and add the following statement to the trust policy.

{

   "Version": "2012-10-17",

   "Statement": [

       {

           "Effect": "Allow",

           "Principal": {

               "Service": [

                   "backup.amazonaws.com",

                   "batchoperations.s3.amazonaws.com",

                   "ec2.amazonaws.com"

               ]

           },

           "Action": "sts:AssumeRole"

       }

   ]

}

To learn how to configure trust relationships, see Before You Begin.

  1. The IAM roles must be granted the following permissions:

Important

Since the size of an IAM policy added to an IAM role cannot exceed 6.144 characters, it is recommended to create 2 IAM policies that will cover all the required permissions. For more information on IAM character limits, see AWS Documentation.

Full List of IAM PermissionsPermissions, part 1

Full List of IAM PermissionsPermissions, part 2

To learn how to create IAM roles and assign them the required permissions, see Appendix A. Creating IAM Roles in AWS.

View all results across Veeam
Back to document search