VPC Configuration Restore IAM Permissions

To perform VPC configuration restore operations, IAM roles and IAM users specified in the restore settings must meet the following requirements:

The backup appliance must be granted permissions to assume the IAM roles. For more information on the requirements for adding IAM roles, see Before You Begin.

The IAM roles must be granted the following permissions:

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Action": [

"ec2:AcceptVpcEndpointConnections",

"ec2:AllocateAddress",

"ec2:AssociateAddress",

"ec2:AssociateClientVpnTargetNetwork",

"ec2:AssociateDhcpOptions",

"ec2:AssociateRouteTable",

"ec2:AssociateSubnetCidrBlock",

"ec2:AssociateTransitGatewayMulticastDomain",

"ec2:AssociateTransitGatewayRouteTable",

"ec2:AssociateVpcCidrBlock",

"ec2:AttachInternetGateway",

"ec2:AttachVpnGateway",

"ec2:AuthorizeClientVpnIngress",

"ec2:AuthorizeSecurityGroupEgress",

"ec2:AuthorizeSecurityGroupIngress",

"ec2:CreateClientVpnEndpoint",

"ec2:CreateClientVpnRoute",

"ec2:CreateCustomerGateway",

"ec2:CreateDefaultSubnet",

"ec2:CreateDefaultVpc",

"ec2:CreateDhcpOptions",

"ec2:CreateEgressOnlyInternetGateway",

"ec2:CreateInternetGateway",

"ec2:CreateManagedPrefixList",

"ec2:CreateNatGateway",

"ec2:CreateNetworkAcl",

"ec2:CreateNetworkAclEntry",

"ec2:CreateNetworkInterface",

"ec2:CreateRoute",

"ec2:CreateRouteTable",

"ec2:CreateSecurityGroup",

"ec2:CreateSubnet",

"ec2:CreateTags",

"ec2:CreateTransitGateway",

"ec2:CreateTransitGatewayMulticastDomain",

"ec2:CreateTransitGatewayPeeringAttachment",

"ec2:CreateTransitGatewayPrefixListReference",

"ec2:CreateTransitGatewayRoute",

"ec2:CreateTransitGatewayRouteTable",

"ec2:CreateTransitGatewayVpcAttachment",

"ec2:CreateVpc",

"ec2:CreateVpcEndpoint",

"ec2:CreateVpcEndpointServiceConfiguration",

"ec2:CreateVpcPeeringConnection",

"ec2:CreateVpnConnection",

"ec2:CreateVpnGateway",

"ec2:DeleteClientVpnEndpoint",

"ec2:DeleteClientVpnRoute",

"ec2:DeleteCustomerGateway",

"ec2:DeleteDhcpOptions",

"ec2:DeleteEgressOnlyInternetGateway",

"ec2:DeleteInternetGateway",

"ec2:DeleteManagedPrefixList",

"ec2:DeleteNatGateway",

"ec2:DeleteNetworkAcl",

"ec2:DeleteNetworkAclEntry",

"ec2:DeleteNetworkInterface",

"ec2:DeleteRoute",

"ec2:DeleteRouteTable",

"ec2:DeleteSecurityGroup",

"ec2:DeleteSubnet",

"ec2:DeleteTransitGateway",

"ec2:DeleteTransitGatewayMulticastDomain",

"ec2:DeleteTransitGatewayPeeringAttachment",

"ec2:DeleteTransitGatewayPrefixListReference",

"ec2:DeleteTransitGatewayRoute",

"ec2:DeleteTransitGatewayRouteTable",

"ec2:DeleteTransitGatewayVpcAttachment",

"ec2:DeleteVpc",

"ec2:DeleteVpcEndpointServiceConfigurations",

"ec2:DeleteVpcEndpoints",

"ec2:DeleteVpcPeeringConnection",

"ec2:DeleteVpnConnection",

"ec2:DeleteVpnGateway",

"ec2:DescribeAddresses",

"ec2:DescribeAvailabilityZones",

"ec2:DescribeClientVpnAuthorizationRules",

"ec2:DescribeClientVpnEndpoints",

"ec2:DescribeClientVpnRoutes",

"ec2:DescribeClientVpnTargetNetworks",

"ec2:DescribeCustomerGateways",

"ec2:DescribeDhcpOptions",

"ec2:DescribeEgressOnlyInternetGateways",

"ec2:DescribeInstances",

"ec2:DescribeInternetGateways",

"ec2:DescribeManagedPrefixLists",

"ec2:DescribeNatGateways",

"ec2:DescribeNetworkAcls",

"ec2:DescribeNetworkInterfaces",

"ec2:DescribeRegions",

"ec2:DescribeRouteTables",

"ec2:DescribeSecurityGroups",

"ec2:DescribeSubnets",

"ec2:DescribeTransitGatewayAttachments",

"ec2:DescribeTransitGatewayMulticastDomains",

"ec2:DescribeTransitGatewayPeeringAttachments",

"ec2:DescribeTransitGatewayRouteTables",

"ec2:DescribeTransitGatewayVpcAttachments",

"ec2:DescribeTransitGateways",

"ec2:DescribeVpcAttribute",

"ec2:DescribeVpcEndpointServiceConfigurations",

"ec2:DescribeVpcEndpoints",

"ec2:DescribeVpcPeeringConnections",

"ec2:DescribeVpcs",

"ec2:DescribeVpnConnections",

"ec2:DescribeVpnGateways",

"ec2:DetachInternetGateway",

"ec2:DetachVpnGateway",

"ec2:DisableTransitGatewayRouteTablePropagation",

"ec2:DisableVgwRoutePropagation",

"ec2:DisassociateAddress",

"ec2:DisassociateClientVpnTargetNetwork",

"ec2:DisassociateRouteTable",

"ec2:DisassociateTransitGatewayMulticastDomain",

"ec2:DisassociateTransitGatewayRouteTable",

"ec2:EnableTransitGatewayRouteTablePropagation",

"ec2:EnableVgwRoutePropagation",

"ec2:GetManagedPrefixListEntries",

"ec2:GetTransitGatewayMulticastDomainAssociations",

"ec2:GetTransitGatewayPrefixListReferences",

"ec2:GetTransitGatewayRouteTableAssociations",

"ec2:GetTransitGatewayRouteTablePropagations",

"ec2:ModifyClientVpnEndpoint",

"ec2:ModifyManagedPrefixList",

"ec2:ModifyNetworkInterfaceAttribute",

"ec2:ModifySubnetAttribute",

"ec2:ModifyTransitGateway",

"ec2:ModifyTransitGatewayVpcAttachment",

"ec2:ModifyVpcAttribute",

"ec2:ModifyVpcEndpoint",

"ec2:ModifyVpcEndpointServiceConfiguration",

"ec2:ModifyVpcPeeringConnectionOptions",

"ec2:ModifyVpnConnection",

"ec2:RejectVpcEndpointConnections",

"ec2:ReleaseAddress",

"ec2:ReplaceNetworkAclAssociation",

"ec2:ReplaceRouteTableAssociation",

"ec2:RevokeClientVpnIngress",

"ec2:RevokeSecurityGroupEgress",

"ec2:RevokeSecurityGroupIngress",

"ec2:SearchTransitGatewayRoutes",

"elasticloadbalancing:AddTags",

"elasticloadbalancing:CreateListener",

"elasticloadbalancing:CreateLoadBalancer",

"elasticloadbalancing:CreateTargetGroup",

"elasticloadbalancing:DeleteListener",

"elasticloadbalancing:DeleteLoadBalancer",

"elasticloadbalancing:DeleteTargetGroup",

"elasticloadbalancing:DeregisterTargets",

"elasticloadbalancing:DescribeListeners",

"elasticloadbalancing:DescribeLoadBalancers",

"elasticloadbalancing:DescribeTags",

"elasticloadbalancing:DescribeTargetGroups",

"elasticloadbalancing:DescribeTargetHealth",

"elasticloadbalancing:ModifyTargetGroup",

"elasticloadbalancing:RegisterTargets",

"elasticloadbalancing:RemoveTags",

"elasticloadbalancing:SetSecurityGroups",

"elasticloadbalancing:SetSubnets",

"iam:GetContextKeysForPrincipalPolicy",

"iam:ListAccountAliases",

"iam:SimulatePrincipalPolicy",

"lambda:ListFunctions",

"ram:AssociateResourceShare",

"ram:CreateResourceShare",

"ram:DeleteResourceShare",

"ram:DisassociateResourceShare",

"ram:GetResourceShareAssociations",

"ram:GetResourceShares",

"ram:ListPrincipals",

"ram:ListResourceSharePermissions",

"ram:ListResources",

"ram:TagResource",

"ram:UntagResource",

"s3:GetBucketLocation",

"s3:ListAllMyBuckets",

"s3:ListBucket",

"s3:PutObject",

"servicequotas:ListServiceQuotas"

"Resource": "*"

}

]

}

To learn how to create IAM roles and assign them the required permissions, see Appendix A. Creating IAM Roles in AWS.