AWS IAM User Permissions

To restore to Amazon EC2, it is recommended that the IAM user whose credentials you plan to use to connect to AWS has administrative permissions — access to all AWS actions and resources.

If you do not want to provide full access to AWS, you can grant to the IAM user a minimal set of permissions that will be sufficient for restore. To do that, create the following policy in the JSON format and attach it to the IAM user.

Note

The ec2: CreateRole permission is required if you want to perform restore without helper appliances. This permission is used to create a service role named vmimport required for import to Amazon EC2. If you plan to restore workloads using helper appliances, you can omit the ec2: CreateRole permission. However, restore without helper appliances will fail.

{

 "Version": "2012-10-17",

 "Statement": [{

  "Action": [

   "ec2:DescribeInstances",

   "ec2:DescribeInstanceTypes",

   "ec2:RunInstances",

   "ec2:TerminateInstances",

   "ec2:StartInstances",

   "ec2:StopInstances",

   "ec2:ModifyInstanceAttribute",

   "ec2:DescribeImages",

   "ec2:ImportImage",

   "ec2:DeregisterImage",

   "ec2:DescribeVolumes",

   "ec2:CreateVolume",

   "ec2:ModifyVolume",

   "ec2:ImportVolume",

   "ec2:DeleteVolume",

   "ec2:AttachVolume",

   "ec2:DetachVolume",

   "ec2:GetEbsEncryptionByDefault",

   "ec2:CreateSnapshot",

   "ec2:DescribeSnapshots",

   "ec2:DeleteSnapshot",

   "ec2:DescribeSubnets",

   "ec2:DescribeNetworkInterfaces",

   "ec2:DescribeSecurityGroups",

   "ec2:DescribeKeyPairs",

   "ec2:CreateKeyPair",

   "ec2:DeleteKeyPair",

   "ec2:DescribeAvailabilityZones",

   "ec2:DescribeVpcs",

   "ec2:DescribeConversionTasks",

   "ec2:DescribeImportImageTasks",

   "ec2:DescribeVolumesModifications",

   "ec2:CancelImportTask",

   "ec2:CancelConversionTask",

   "ec2:CreateTags",

   "ec2:DescribeAccountAttributes",

   "ec2:DescribeDhcpOptions",

   "ec2:DescribeVpcAttribute",

   "iam:GetRole",

   "iam:CreateRole",

   "iam:PutRolePolicy",

   "iam:DeleteRolePolicy",

   "s3:CreateBucket",

   "s3:ListBucket",

   "s3:ListAllMyBuckets",

   "s3:DeleteBucket",

   "s3:PutObject",

   "s3:DeleteObject",

   "s3:GetBucketLocation",

   "s3:PutLifeCycleConfiguration",

   "s3:GetObject",

   "s3:RestoreObject",

   "s3:AbortMultiPartUpload",

   "s3:ListBucketMultiPartUploads",

   "s3:ListMultipartUploadParts"

  ],

  "Effect": "Allow",

  "Resource": "*"

 }]

}

Alternatively, you can attach the created policy to the IAM group or role to which the IAM user is assigned.

For information on how to create and attach a policy to an IAM user, see the Creating IAM Policies and Adding and Removing IAM Identity Permissions sections in the AWS IAM User Guide.

Page updated 1/25/2024

Page content applies to build 12.1.1.56