IAM service roles
An AWS Identity and Access Management (IAM) role is similar to a user, in that it is an AWS identity with permissions policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it. A service role is a role that an AWS service assumes to perform actions on your behalf. As a service that performs backup operations on your behalf, AWS Backup requires that you pass it a role to assume when performing backup operations on your behalf. For more information about IAM roles, see IAM Roles in the IAM User Guide.
The role that you pass to AWS Backup must have an IAM policy with the permissions that enable AWS Backup to perform actions associated with backup operations, such as creating, restoring, or expiring backups. Different permissions are required for each of the AWS services that AWS Backup supports. The role must also have AWS Backup listed as a trusted entity, which enables AWS Backup to assume the role.
When you assign resources to a backup plan, or if you perform an on-demand backup, copy, or restore, you must pass a service role that has access to perform the underlying operations on the specified resources. AWS Backup uses this role to create, tag, and delete resources in your account.
Using AWS roles to control access to backups
You can use roles to control access to your backups by defining narrowly scoped roles and by specifying who can pass that role to AWS Backup. For example, you could create a role that only grants permissions to back up Amazon Relational Database Service (Amazon RDS) databases and only grant Amazon RDS database owners permission to pass that role to AWS Backup. AWS Backup provides several predefined managed policies for each of the supported services. You can attach these managed policies to roles that you create. This makes it easier to create service-specific roles that have the correct permissions that AWS Backup needs.
For more information about AWS managed policies for AWS Backup, see Managed policies.
Default service role for AWS Backup
When using the AWS Backup console for the first time, you can choose to have AWS Backup create a default service role for you. This role has the permissions that AWS Backup needs to perform backup operations for all the AWS services that it supports. To choose the default service role, follow any of the options in Getting Started.
You must create the default role using the AWS Management Console. You cannot create the default role using the AWS Command Line Interface (AWS CLI).
If you prefer to use custom roles, such as separate roles for different resource types, you can also do that and pass your custom roles to AWS Backup. To view examples of roles that enable backup and restore for individual resource types, see the Customer managed policies table.
The default service role created by AWS Backup manages creating and restoring backups
without working with custom roles. The default service role is called AWSBackupDefaultServiceRole
.
AWSBackupDefaultServiceRole
contains two managed policies, AWSBackupServiceRolePolicyForBackup
and AWSBackupServiceRolePolicyForRestores
.
AWSBackupServiceRolePolicyForBackup
includes an IAM policy that grants
AWS Backup permissions to describe the resource being backed up, the ability to create, delete,
describe, or add tags to a backup. This IAM policy includes the necessary permissions
for all the resource types that AWS Backup supports.
AWSBackupServiceRolePolicyForRestores
includes an IAM policy that
grants AWS Backup permissions to create, delete, or describe the new resource being created
from a backup. It also includes permissions to tag the newly created resource. This IAM
policy includes the necessary permissions for all the resource types that AWS Backup
supports.
To restore an Amazon EC2 instance, you must launch a new instance.
Creating the default service role
Specific actions you take in the AWS Backup Console create the AWS Backup default service role. Other activity, such as CLI operations, cannot create that role.
To create the AWS Backup default service role AWSBackupDefaultServiceRole
in your AWS account:
Open the AWS Backup console at https://console.aws.amazon.com/backup
. -
To create the role for your account, either assign resources to a backup plan or create an on-demand backup.
-
Create a backup plan and assign resources to the backup. See Create a scheduled backup.
-
Alternatively, create an on-demand backup. See Create an on-demand backup.
-
-
Verify that you have created the
AWSBackupDefaultServiceRole
in your account by following these steps:-
Wait a few minutes. For more information, see Changes that I make are not always immediately visible in the AWS Identity and Access Management User Guide.
Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/
. In the left navigation menu, choose Roles.
In the search bar, type
AWSBackupDefaultServiceRole
. If this selection exists, you have created the AWS Backup default role and completed this procedure.If
AWSBackupDefaultServiceRole
still does not appear, add the following permissions to either the IAM user or IAM role you use to access the console.{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "iam:CreateRole", "iam:AttachRolePolicy", "iam:PassRole" ], "Resource":"arn:
aws
:iam::*:role/service-role/AWSBackupDefaultServiceRole" }, { "Effect":"Allow", "Action":[ "iam:ListRoles" ], "Resource":"*" } ] }For China Regions, replace
aws
withaws-cn
. For AWS GovCloud (US) Regions, replaceaws
withaws-us-gov
.-
If you cannot add permissions to your IAM user or IAM role, ask your administrator to manually create a role named
AWSBackupDefaultServiceRole
and attach that role to the managed policies it normally has:AWSBackupServiceRolePolicyForBackup
AWSBackupServiceRolePolicyForRestores
-