---
title: "New-VBRAmazonEC2Container"
description: "Defines a scope of Amazon EC2 instances, EC2 tags or AWS datacenters for a protection group. Product Edition: Standard, Enterprise, Enterprise Plus, Veeam Universal License This cmdlet defines the VBRAmazonEC2Container object."
canonical: "https://helpcenter.veeam.com/docs/vbr/powershell/new-vbramazonec2container.html"
breadcrumb: "Veeam PowerShell Reference > Veeam PowerShell Reference > Veeam Agent Management > Working with Protection Groups > Veeam Agent Management Protection Scope > New-VBRAmazonEC2Container"
dateModified: "2026-08-19"
---

# New-VBRAmazonEC2Container

## Short Description
Defines a scope of Amazon EC2 instances, EC2 tags or AWS datacenters for a protection group.

**Product Edition**: Standard, Enterprise, Enterprise Plus, Veeam Universal License

## Syntax
```
New-VBRAmazonEC2Container -Region <VBRAmazonEC2Region> -Entity <Object[]> [-ExcludeEntities]
 [-ExcludedEntity <Object[]>] [-AutoAssignIAMRole] [<CommonParameters>]
```

## Detailed Description
This cmdlet defines the [`VBRAmazonEC2Container`](vbramazonec2container.md) object. This object contains a scope of Amazon EC2 instances, EC2 tags or AWS datacenters.

Use this object to create a protection group with the [`Add-VBRProtectionGroup`](add-vbrprotectiongroup.md) cmdlet. After you create a protection group, Veeam Backup & Replication will deploy Veeam Agent on EC2 instances added to the scope of the protection group.

## Parameters

<table style="width:100%;" class="Blue_Table">
      <tr style="vertical-align:top">
        <th style="width:20%;">
          <p>Parameter</p>
        </th>
        <th style="width:20%;">
          <p>Description</p>
        </th>
        <th style="width:20%;">
          <p>Type</p>
        </th>
        <th style="width:10%;">
          <p>Required</p>
        </th>
        <th style="width:10%;">
          <p>Position</p>
        </th>
        <th style="width:10%;">
          <p>Accept Pipeline Input</p>
        </th>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">AutoAssignIAMRole</span></p>
        </td>
        <td>
          <p>Defines that the cmdlet will automatically set the IAM role with the <em>AmazonSSMManagedInstanceCore</em> policy to the EC2 instances that you want to back up.</p><p>If you do not provide this parameter, you will have to set the IAM role manually.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName, ByValue)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">Entity</span></p>
        </td>
        <td>
          <p>Specifies an array of the following entities that the cmdlet will add to a scope of a protection group:</p><ul><li>EC2 instances.</li><li>EC2 tags.</li><li>AWS datacenters.</li></ul><p>Accepts the <code>Object</code>[] object. To get this object, run the following  cmdlets:</p><ul><li><a href="get-vbramazonec2vm.md"><code>Get-VBRAmazonEC2VM</code></a></li><li><a href="new-vbramazonec2tag.md"><code>New-VBRAmazonEC2Tag</code></a></li><li><a href="get-vbramazonec2region.md"><code>Get-VBRAmazonEC2Region</code></a></li></ul>
        </td>
        <td style="width:10%;">
          <p><code>Object[]</code></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName, ByValue)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">ExcludedEntity</span></p>
        </td>
        <td>
          <p>Specifies an array of the following entities that the cmdlet will exclude from a scope of a protection group:</p><ul><li>EC2 instances.</li><li>EC2 tags.</li><li>AWS datacenters.</li></ul><p>Accepts the <code>Object[]</code> object. To get this object, run the following  cmdlets:</p><ul><li><a href="get-vbramazonec2vm.md"><code>Get-VBRAmazonEC2VM</code></a></li><li><a href="new-vbramazonec2tag.md"><code>New-VBRAmazonEC2Tag</code></a></li><li><a href="get-vbramazonec2region.md"><code>Get-VBRAmazonEC2Region</code></a></li></ul>
        </td>
        <td style="width:10%;">
          <p><code>Object[]</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName, ByValue)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">ExcludeEntities</span></p>
        </td>
        <td>
          <p>Defines that the cmdlet will exclude the following entities from a scope of a protection group:</p><ul><li>EC2 instances.</li><li>EC2 tags.</li><li>AWS datacenters.</li></ul><p>Provide the <code>ExcludedEntity</code> parameter to specify the excluded entities.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName, ByValue)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">Region</span></p>
        </td>
        <td>
          <p>Specifies AWS Regions in which you want to deploy Veeam Agent on cloud machines.</p><p>Accepts the <code>VBRAmazonEC2Region</code> object. To create this object, run the <a href="get-vbramazonec2region.md"><code>Get-VBRAmazonEC2Region</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><a href="vbramazonec2region.md"><code>VBRAmazonEC2Region</code></a></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName, ByValue)</p>
        </td>
      </tr>
    </table>

`<CommonParameters>`

This cmdlet supports Microsoft PowerShell common parameters. For more information on common parameters, see [ Microsoft Docs](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_commonparameters?view=powershell-7).

## Output Object
[`VBRAmazonEC2Container`](vbramazonec2container.md)

## Examples

::: example
### Example 1. Defining Scope of Amazon EC2 Instances for Protection Group

This example shows how to define the scope of Amazon EC2 instances to add them to a protection group.

```
$AWSaccount = Get-VBRAmazonAccount -Id "936edf7c-7cf3-4dbd-9895-c7485ef4bb2c"
$AWSregion = Get-VBRAmazonEC2Region -Account $AWSaccount -RegionType Global -Name "eu-central-1"
$instances = Get-VBRAmazonEC2VM -Region $AWSregion
$container = New-VBRAmazonEC2Container -Region $AWSregion -Entity $instances
```

Perform the following steps:

1. Run the [`Get-VBRAmazonAccount`](get-vbramazonaccount.md) cmdlet. Specify the `Id` parameter value. Save the result to the `$AWSaccount` variable.
2. Run the [`Get-VBRAmazonEC2Region`](get-vbramazonec2region.md) cmdlet. Set the `$AWSaccount` variable as the `Account` parameter value. Set the `Global` value as the `RegionType` parameter value. Specify the `Name` parameter value. Save the result to the `$AWSregion` variable.
3. Run the [`Get-VBRAmazonEC2VM`](get-vbramazonec2vm.md) cmdlet. Set the `$AWSregion` variable as the `Region` parameter value. Save the result to the `$instances` variable.
4. Run the `New-VBRAmazonEC2Container` cmdlet. Set the `$AWSregion` variable as the `Region` parameter value. Set the `$instances` variable as the `Entity` parameter value. Save the result to the `$container` variable.

:::

::: example
### Example 2. Defining Scope of AWS Datacenters for Protection Group

This example shows how to define the scope of Amazon EC2 datacenters to add them to a protection group.

```
$AWSaccount = Get-VBRAmazonAccount -Id "936edf7c-7cf3-4dbd-9895-c7485ef4bb2c"
$datacenter = Get-VBRAmazonEC2Region -Account $AWSaccount -RegionType Global -Name "eu-central-1"
$container = New-VBRAmazonEC2Container -Region $AWSregion -Entity $datacenter
```

Perform the following steps:

1. Run the [`Get-VBRAmazonAccount`](get-vbramazonaccount.md) cmdlet. Specify the `Id` parameter value. Save the result to the `$AWSaccount` variable.
2. Run the [`Get-VBRAmazonEC2Region`](get-vbramazonec2region.md) cmdlet. Set the `$AWSaccount` variable as the `Account` parameter value. Set the `Global` value as the `RegionType` parameter value. Specify the `Name` parameter value. Save the result to the `$datacenter` variable.
3. Run the `New-VBRAmazonEC2Container` cmdlet. Set the `$AWSregion` variable as the `Region` parameter value. Set the `$datacenter` variable as the `Entity` parameter value. Save the result to the `$container` variable.

:::

::: example
### Example 3. Defining Scope of AWS Tags for Protection Group

This example shows how to define the to define the scope of Amazon EC2 tags to add them to a protection group.

```
$AWSaccount = Get-VBRAmazonAccount -Id "936edf7c-7cf3-4dbd-9895-c7485ef4bb2c"
$AWSregion = Get-VBRAmazonEC2Region -Account $AWSaccount -RegionType Global -Name "eu-central-1"
$tag = New-VBRAmazonEC2Tag -Key "owner" -Value "vat"
$container = New-VBRAmazonEC2Container -Region $AWSregion -Entity $tag
```

Perform the following steps:

1. Run the [`Get-VBRAmazonAccount`](get-vbramazonaccount.md) cmdlet. Specify the `Id` parameter value. Save the result to the `$AWSaccount` variable.
2. Run the [`Get-VBRAmazonEC2Region`](get-vbramazonec2region.md) cmdlet. Set the `$AWSaccount` variable as the `Account` parameter value. Set the `Global` value as the `RegionType` parameter value. Specify the `Name` parameter value. Save the result to the `$AWSregion` variable.
3. Run the [`New-VBRAmazonEC2Tag`](new-vbramazonec2tag.md) cmdlet. Specify the `Key` and the `Value` parameter values. Save the result to the `$tag` variable.
4. Run the `New-VBRAmazonEC2Container` cmdlet. Set the `$AWSregion` variable as the `Region` parameter value. Set the `$tag` variable as the `Entity` parameter value. Save the result to the `$container` variable.

:::

## Related Commands

- [`Get-VBRAmazonAccount`](get-vbramazonaccount.md)
- [`Get-VBRAmazonEC2Region`](get-vbramazonec2region.md)
- [`Get-VBRAmazonEC2VM`](get-vbramazonec2vm.md)