Product Version: 8.1
Last Modified: 17 Dec 2018
Question
I do not want to grant full administrative IAM permissions to NAKIVO Backup & Replication.
What are the permissions required by NAKIVO Backup & Replication to work with Amazon EC2 instances?
Answer
The following Amazon Web Services IAM permissions are required:
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ec2:DescribeAvailabilityZones",
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups",
"ec2:DescribeInstances",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstanceStatus",
"ec2:DescribeVolumes",
"ec2:DescribeVolumeAttribute",
"ec2:DescribeVolumeStatus",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeNetworkInterfaceAttribute",
"ec2:DescribeImages",
"ec2:DescribeImageAttribute",
"ec2:DescribeSnapshots",
"ec2:DescribeSnapshotAttribute",
"ec2:DescribeKeyPairs",
"ec2:DescribeTags"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ec2:AttachClassicLinkVpc",
"ec2:DetachClassicLinkVpc",
"ec2:GetConsoleScreenshot",
"ec2:RunInstances",
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:RebootInstances",
"ec2:TerminateInstances",
"ec2:ModifyInstanceAttribute",
"ec2:ModifyInstancePlacement",
"ec2:ImportInstance"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": "ec2:CreateTags",
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ec2:CreateKeyPair",
"ec2:DeleteKeyPair"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ec2:CreateSecurityGroup",
"ec2:DeleteSecurityGroup"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ec2:AuthorizeSecurityGroupIngress",
"ec2:RevokeSecurityGroupIngress"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ec2:CreateVpc",
"ec2:DeleteVpc"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ec2:CreateSubnet",
"ec2:DeleteSubnet",
"ec2:ModifySubnetAttribute"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ec2:DescribeInternetGateways",
"ec2:CreateInternetGateway",
"ec2:DeleteInternetGateway",
"ec2:AttachInternetGateway"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ec2:DescribeRouteTables",
"ec2:CreateRouteTable",
"ec2:CreateRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteRoute",
"ec2:AssociateRouteTable"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ec2:CreateVolume",
"ec2:DeleteVolume",
"ec2:AttachVolume",
"ec2:DetachVolume",
"ec2:ModifyVolumeAttribute"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ec2:CreateSnapshot",
"ec2:DeleteSnapshot",
"ec2:ModifySnapshotAttribute",
"ec2:CopySnapshot"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ec2:DeregisterImage",
"ec2:RegisterImage",
"ec2:CreateImage"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": "iam:GetUser",
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"aws-marketplace:Subscribe",
"aws-marketplace:ViewSubscriptions",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:DescribeAccountAttributes"
],
"Effect": "Allow",
"Resource": "*"
}
]
}