How to Create Custom Worker Instance IAM Role

Challenge

The Worker Instance IAM role is used to launch worker instances.

Solution

To configure a custom IAM Role for worker instance follow the steps below to configure the IAM role.

1. Use the following JSON to create an IAM Policy using the following instructions from the How to create IAM Policy article. These permissions will allow Veeam Backup for AWS service to perform operations required:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "ssm:SendCommand",
                   "ssm:GetCommandInvocation",
                   "sqs:ListQueues",
                   "sqs:CreateQueue",
                   "sqs:SetQueueAttributes",
                   "sqs:ReceiveMessage",
                   "sqs:DeleteMessage",
                   "sqs:DeleteQueue",
                   "ec2:DescribeRegions",
                   "ec2:DescribeAccountAttributes",
                   "ec2:DescribeAvailabilityZones",
                   "ec2:DescribeRouteTables",
                   "ec2:DescribeSecurityGroups",
                   "ec2:DescribeVpcs",
                   "ec2:DescribeVpcEndpoints",
                   "ec2:DescribeSubnets",
                   "ec2:DescribeInstances",
                   "ec2:DescribeInstanceAttribute",
                   "ec2:RunInstances",
                   "ec2:StopInstances",
                   "ec2:TerminateInstances",
                   "ec2:ModifyInstanceAttribute",
                   "ec2:DescribeKeyPairs",
                   "ec2:CreateKeyPair",
                   "ec2:DeleteKeyPair",
                   "ec2:DescribeVolumes",
                   "ec2:CreateVolume",
                   "ec2:AttachVolume",
                   "ec2:DetachVolume",
                   "ec2:DeleteVolume",
                   "ec2:DescribeSnapshots",
                   "ec2:CreateSnapshot",
                   "ec2:CreateSnapshots",
                   "ec2:DeleteSnapshot",
                   "ec2:ModifySnapshotAttribute",
                   "ec2:CreateTags",
                   "ec2:DescribeImages",
                   "iam:CreateRole",
                   "iam:DeleteRole",
                   "iam:CreateInstanceProfile",
                   "iam:ListAttachedRolePolicies",
                   "iam:ListInstanceProfilesForRole",
                   "iam:AddRoleToInstanceProfile",
                   "iam:RemoveRoleFromInstanceProfile",
                   "iam:AttachRolePolicy",
                   "iam:PutRolePolicy",
                   "iam:PassRole",
                   "iam:DetachRolePolicy",
                   "iam:DeleteRolePolicy",
                   "iam:ListRolePolicies",
                   "iam:DeleteInstanceProfile",
                   "iam:GetRole",
                   "iam:GetInstanceProfile",
                   "ebs:ListChangedBlocks",
                   "ebs:ListSnapshotBlocks",
                   "kms:ListKeys",
                   "kms:ListAliases",
                   "kms:GetKeyPolicy",
                   "kms:ReEncryptTo",
                   "kms:ReEncryptFrom",
                   "kms:DescribeKey",
                   "ec2:GetEbsDefaultKmsKeyId",
                   "kms:CreateGrant",
                   "servicequotas:ListServiceQuotas",
                   "ec2:DescribeTags",
                   "ec2:DescribeInstanceStatus",
                   "ec2:StartInstances",
                   "sqs:SendMessage",
                   "sts:GetSessionToken",
                   "ebs:ListChangedBlocks",
                   "ebs:ListSnapshotBlocks",
                   "ec2:DescribeVolumeAttribute",
   		"iam:GetContextKeysForPrincipalPolicy",
   		"iam:SimulatePrincipalPolicy"
               ],
               "Resource": "*"
           }
       ]
   }

2. Navigate to Roles.
3. Choose Create role.
4. Select the type of the trusted entity Another AWS Account.
5. In the Account ID field, enter the ID of your Backup Account (you can get this number in the AWS console of the Backup Account, in My Account located in the top-right menu).
6. Select the Require external ID checkbox and enter a pass phrase to raise the level of security for the role.
7. Click Next: Permissions.
8. In the filter policies search box, enter the name of the policy created in the Step 1.
9. In the first column, select the policy.
10. Click Next: Tags.
11. Enter tagging info if needed and click Next: Review.
12. Assign a name to the IAM Role. This name will be used in Veeam Backup for AWS (e.g. vb4aws_workers_role).
13. Click Create role.
14. Once the role is created, you will be able to see it in the list of available roles.

Alternatively, you can use create role wizard in configuration with Service role checked.