Step 3. Specify IAM Role Permissions

At the Permissions step of the wizard, you can define specific operations that the backup appliance will be able to perform using the permissions of the created IAM role. To do that:

1. Set the Specify granular permissions toggle to On.
2. In the AWS Organization permissions section, select the Organization rescan role check box if you want to create an IAM role whose permissions will be used to collect information on the AWS Organization you want to add to the backup appliance.

The specified role must be created in the AWS account that manages the AWS Organization.

3. In the Veeam management roles section, choose actions that will be performed using the IAM role:

• Worker deployment role — will be used to deploy worker instances in the backup account.
• Production worker role — will be used to communicate with worker instances in production accounts.
• Repository role — will be used to create new repositories in Amazon S3 buckets and to further access the repositories during data protection and disaster recovery operations.

4. In the Workload permissions section, choose resources that will be protected using the IAM role, and operations that will be performed with these resources:

• Backup — the backup appliance will protect EC2, Redshift, DynamoDB, EFS, FSx and VPC resources.

Note that the list of permissions for this role will also contain additional permissions required to deploy worker instances in production accounts during EFS indexing and EC2 backup operations.

• Replication — the backup appliance will replicate cloud-native snapshots of EC2 and RDS resources.
• Snapshot — the backup appliance will create cloud-native snapshots of RDS resources.

Note that the list of permissions for this role will also contain additional permissions required to deploy worker instances in production accounts during RDS backup operations.

• Restore — the backup appliance will restore EC2, RDS, Redshift, DynamoDB, EFS, FSx and VPC resources.

Note that the list of permissions for this role will also contain additional permissions required to deploy worker instances in production accounts during EC2 and RDS restore operations.

Keep in mind that all the required permissions will be added to the created template and automatically assigned to the role when creating it in AWS.