Organization Rescan IAM Permissions
To allow a backup appliance to collect information on AWS Organizations, the Organization rescan IAM role specified in the organization settings must meet the following requirements:
- The backup appliance must be granted permissions to assume the IAM role. For more information on the requirements for adding IAM roles, see Before You Begin.
- The IAM role must be granted the following permissions:
|
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:GetContextKeysForPrincipalPolicy", "iam:ListAccountAliases", "iam:SimulatePrincipalPolicy", "organizations:DescribeAccount", "organizations:DescribeOrganizationalUnit", "organizations:DescribeOrganization", "organizations:ListChildren", "organizations:ListRoots" ], "Resource": "*" } ] } |
To learn how to create IAM roles and assign them the required permissions, see Appendix A. Creating IAM Roles in AWS.