DynamoDB Backup IAM Role Permissions
Veeam Backup for AWS uses DynamoDB Backup IAM roles to perform the following operations:
- To enumerate resources added to a backup policy.
- To create backups of DynamoDB tables.
- To create backup copies, and so on.
To perform these operations, IAM roles specified in the DynamoDB backup policy settings must meet the following requirements:
- The backup appliance must be granted permissions to assume the IAM roles. For more information on the requirements for adding IAM roles, see Before You Begin.
- The AWS Backup service must be granted permissions to assume the IAM roles.
To allow the AWS Backup service to assume an IAM role, configure trust relationships for the role and add the following statement to the trust policy:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "sts:AssumeRole", "Principal": { "Service": "backup.amazonaws.com" } } ] } |
To learn how to modify role trust policies, see AWS Documentation.
- The IAM roles must be granted the following permissions:
- IAM roles specified in the backup policy settings:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup:CopyFromBackupVault", "backup:CopyIntoBackupVault", "backup:DeleteRecoveryPoint", "backup:DescribeBackupJob", "backup:DescribeCopyJob", "backup:DescribeRecoveryPoint", "backup:DescribeRegionSettings", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", "backup:ListTags", "backup:StartBackupJob", "backup:StartCopyJob", "backup:StopBackupJob", "backup:TagResource", "backup:UntagResource", "backup:UpdateRegionSettings", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "dynamodb:StartAwsBackupJob", "ec2:DescribeRegions", "ec2:DescribeAvailabilityZones, "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:GetContextKeysForPrincipalPolicy", "iam:GetRole", "iam:ListAccountAliases", "iam:PassRole", "iam:SimulatePrincipalPolicy", "kms:Decrypt", "sns:CreateTopic", "sns:DeleteTopic", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sns:SetTopicAttributes", "sns:Subscribe", "sns:Unsubscribe", "sqs:CreateQueue", "sqs:DeleteMessage", "sqs:DeleteQueue", "sqs:ListQueues", "sqs:ReceiveMessage", "sqs:SetQueueAttributes" ], "Resource": "*" } ] } |
- IAM roles used to perform backup operations manually as described in section Creating DynamoDB Backups Manually:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "backup-storage:MountCapsule", "backup:CopyFromBackupVault", "backup:CopyIntoBackupVault", "backup:CreateBackupVault", "backup:DeleteBackupVault", "backup:DeleteRecoveryPoint", "backup:DescribeBackupJob", "backup:DescribeCopyJob", "backup:DescribeRecoveryPoint", "backup:DescribeRegionSettings", "backup:ListBackupVaults", "backup:ListTags", "backup:StartBackupJob", "backup:StartCopyJob", "backup:StopBackupJob", "backup:TagResource", "backup:UntagResource", "backup:UpdateRegionSettings", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListTagsOfResource", "dynamodb:StartAwsBackupJob", "ec2:DescribeRegions", "iam:GetContextKeysForPrincipalPolicy", "iam:GetRole", "iam:PassRole", "iam:SimulatePrincipalPolicy", "kms:Decrypt", "kms:DescribeKey" ], "Resource": "*" } ] } |
To learn how to create IAM roles and assign them the required permissions, see Appendix A. Creating IAM Roles in AWS.