Plug-In Permissions
To perform backup and restore operations, accounts that AWS Plug-in for Veeam Backup & Replication uses to perform data protection and disaster recovery operations must be granted the following permissions.
Veeam Backup & Replication User Account Permissions
A user account that you plan to use when installing and working with Veeam Backup & Replication must have permissions described in the Veeam Backup & Replication User Guide, section Installing and Using Veeam Backup & Replication.
Veeam Backup for AWS User Account Permissions
A user account that Veeam Backup & Replication will use to authenticate against the backup appliance and get access to the appliance functionality must be assigned the Portal Administrator role. For more information on user roles, see Managing User Accounts.
Note |
When you deploy a backup appliance from the Veeam Backup & Replication console, Veeam Backup & Replication will automatically create the necessary user account that will be assigned all the required permissions. |
AWS Plug-in for Veeam Backup & Replication requires the following IAM identities:
- An IAM user whose permissions are used to create, connect and manage backup appliances. To be able to perform these operations, the specified IAM user must have the following set of permissions:
Full list of permissions
|
List of permissions to deploy a backup appliance
|
List of permissions to connect a backup appliance
|
List of permissions to add a repository
|
List of permissions to encrypt repositories using AWS KMS keys
|
List of permissions to upgrade backup appliance to version 7.0
|
Note |
Veeam Backup & Replication does not check permissions of permissions the Default Backup Restore IAM role created on the backup appliance during upgrade to version 7.0. To update permissions of the role, add the necessary permissions listed below to the IAM policy. |
List of permissions to upgrade the Default Backup Restore IAM role
|
Important |
Note that the following permissions are only required to remove created resources during appliance deployment: ec2:DeleteSubnet, ec2:DeleteSecurityGroup, ec2:DetachInternetGateway, ec2:DeleteInternetGateway, ec2:DeleteVpc. If for any security reasons you do not want these permissions to be added, you will need to remove the resources manually in the AWS Management Console in case of a deployment failure or the removal of backup appliances from the backup infrastructure. |
- IAM roles whose permissions are used to perform data protection and disaster recovery operations with AWS resources.
When you deploy a new backup appliance, the Default Backup Restore IAM role is automatically created and added to the appliance. The Default Backup Restore IAM role is assigned all permissions required to perform data protection and disaster recovery operations in the same AWS account where the backup appliance resides. For more information on the Default Backup Restore IAM role permissions, see Full List of IAM Permissions. However, you can create additional IAM roles with granular permissions and add them to the appliance as described in section Managing IAM Roles.
- IAM users whose one-time access keys are specified to access standard backup repositories where the image-level backups are stored must have permissions described in the Using Amazon S3 Object Storage section in the Veeam Backup & Replication User Guide if plan to copy image-level backups or to restore guest OS files from image-level backups. To learn how to specify one-time access keys of IAM users, see sections Connecting to Existing Appliance and Creating New Repositories.
- IAM users whose one-time access keys are used to automatically grant missing permissions to IAM users and roles must have the following permissions:
"iam:AttachRolePolicy", "iam:CreatePolicy" |
Veeam Backup & Replication neither saves nor stores these one-time access keys in the configuration database.
Virtualization Servers and Hosts Service Account Permissions
If you plan to copy backups to on-premises backup repositories, to perform restore to VMware vSphere and Microsoft Hyper-V environments, or to perform other tasks related to virtualization servers and hosts, you must check whether the service account specified for these servers and hosts has the required permissions described in the Veeam Backup & Replication User Guide for VMware vSphere and Veeam Backup & Replication User Guide for Microsoft Hyper-V, section Using Virtualization Servers and Hosts.
Microsoft Azure Account Permissions
An Azure AD application that you plan to use to restore EC2 instances to Microsoft Azure must have permissions described in the Veeam Backup & Replication User Guide, section Permissions.
Google Cloud Service Account Permissions
A service account that you plan to use to restore EC2 instances to Google Cloud must have permissions described in the Veeam Backup & Replication User Guide, section Google Compute Engine IAM User Permissions.