Challenge
Backup Policy IAM role is used to run backup operations which include:- enumerating of the resources
- taking EBS snapshots of selected EC2 instances volumes
- rehydrating of snapshots back to volumes
- attaching volumes to the worker instance
- and so on - see permissions below
Solution
There are two types of deployments where this role is required to perform the backup: backup inside production or isolated from production backup.The isolated from production deployment is delivering exceptional level of protection when the whole production environment is lost. Veeam is recommending this type of the deployment as the most reliable one.
Isolated from production backup deployment
For this type of the deployment a second "Backup account" is required. Please create one using AWS web site
Veeam Backup for AWS Management appliance should be deployed in the Backup Account.
To allow Veeam Backup appliance to perform all required for backup operations inside of the Production Account a Backup Policy Role should be created in the Production Account. This role should be made available for usage from the Backup Account. Please proceed through the following steps to create such role.
1. Please use the following JSON text to create IAM Policy by following instructions from How to create IAM Policy article
These permissions will allow backup service to perform required for backup operations
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ec2:CopySnapshot"
"ec2:CreateSnapshot"
"ec2:CreateSnapshots"
"ec2:CreateTags"
"ec2:DeleteSnapshot"
"ec2:DescribeAvailabilityZones"
"ec2:DescribeImages"
"ec2:DescribeInstances"
"ec2:DescribeSnapshots"
"ec2:DescribeSubnets"
"ec2:DescribeTags"
"ec2:DescribeVolumes"
"ec2:ModifySnapshotAttribute"
"events:DeleteRule"
"events:DescribeRule"
"events:ListTargetsByRule"
"events:PutRule"
"events:PutTargets"
"events:RemoveTargets"
"iam:GetRole"
"iam:ListAttachedRolePolicies"
"iam:ListInstanceProfilesForRole"
"iam:ListRolePolicies"
"iam:ListRoleTags"
"iam:UpdateAssumeRolePolicy"
"s3:GetBucketLocation"
"sns:CreateTopic"
"sns:DeleteTopic"
"sns:ListSubscriptionsByTopic"
"sns:ListTopics"
"sns:SetTopicAttributes"
"sns:Subscribe"
"sns:Unsubscribe"
"sqs:CreateQueue"
"sqs:DeleteQueue"
"sqs:SetQueueAttributes"
"sts:AssumeRole"
"sts:GetCallerIdentity"
],
"Resource": "*",
"Effect": "Allow"
}
]
}
2. Navigate to Roles3. Choose "Create role"
4. Select type of trusted entity "Another AWS Service"
5. In the "Account ID" enter the ID of your second Backup Account (you can obtain this number if you login in AWS console of the Backup Account and select "My account" in top right menu)
6. Select the checkbox "Require external ID" and enter a pass phrase to raise level of security for the role
7. Press "Next: Permissions" button
8. Enter vb4aws_pol2 in "filter policies" edit box
9. Select the policy with ticking on the checkbox in the first column
10. Press "Next: Tags" button
11. Enter tagging info if desired and press "Next: Review" button
12. Give a name to the IAM Role - you will be using this name in the Veeam Backup for AWS UI (e.g. vb4aws_pol2role)
13. Press "Create role" button
14. After successful creation of the role you will be able to see it in the list of all available roles
Backup inside production deployment
NOTE: this type of deployment (since it is not very secure) is recommended for test, demo and small environments only!
1. Please use the following JSON text to create IAM Policy by following instructions from How to create IAM Policy article
These permissions will allow backup service to perform required for backup operations
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ec2:CopySnapshot"
"ec2:CreateSnapshot"
"ec2:CreateSnapshots"
"ec2:CreateTags"
"ec2:DeleteSnapshot"
"ec2:DescribeAvailabilityZones"
"ec2:DescribeImages"
"ec2:DescribeInstances"
"ec2:DescribeSnapshots"
"ec2:DescribeSubnets"
"ec2:DescribeTags"
"ec2:DescribeVolumes"
"ec2:ModifySnapshotAttribute"
"events:DeleteRule"
"events:DescribeRule"
"events:ListTargetsByRule"
"events:PutRule"
"events:PutTargets"
"events:RemoveTargets"
"iam:GetRole"
"iam:ListAttachedRolePolicies"
"iam:ListInstanceProfilesForRole"
"iam:ListRolePolicies"
"iam:ListRoleTags"
"iam:UpdateAssumeRolePolicy"
"s3:GetBucketLocation"
"sns:CreateTopic"
"sns:DeleteTopic"
"sns:ListSubscriptionsByTopic"
"sns:ListTopics"
"sns:SetTopicAttributes"
"sns:Subscribe"
"sns:Unsubscribe"
"sqs:CreateQueue"
"sqs:DeleteQueue"
"sqs:SetQueueAttributes"
"sts:AssumeRole"
"sts:GetCallerIdentity"
],
"Resource": "*",
"Effect": "Allow"
}
]
}
2. Press "Review policy" button3. Choose a name for the policy e.g. "vb4aws_pol2"
4. Press "Create policy" button
5. Navigate to Roles
6. Choose "Create role"
7. Select type of trusted entity "AWS Service"
7. Choose "EC2" in "Choose the service that will use this role"
8. Press "Next: Permissions" button
9. Enter vb4aws_pol2 in "filter policies" edit box
10. Select the policy with ticking on the checkbox in the first column
11. Press "Next: Tags" button
12. Enter tagging info if desired and press "Next: Review" button
13. Give a name to the IAM Role - you will be using this name in the Veeam Backup for AWS UI (e.g. vb4aws_pol2role)
14. Press "Create role" button
15. After successful creation of the role you will be able to see it in the list of all available roles