IAM Service Roles
An AWS Identity and Access Management (IAM) role is similar to a user, in that it is an AWS identity with permissions policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it. A service role is a role that an AWS service assumes to perform actions on your behalf. As a service that performs backup operations on your behalf, AWS Backup requires that you pass it a role to assume when performing backup operations on your behalf. For more information about IAM roles, see IAM Roles in the IAM User Guide.
The role that you pass to AWS Backup must have an IAM policy with the permissions that enable AWS Backup to perform actions associated with backup operations, such as creating, restoring, or expiring backups. Different permissions are required for each of the AWS services that AWS Backup supports. The role must also have AWS Backup listed as a trusted entity, which enables AWS Backup to assume the role.
When you assign resources to a backup plan, or if you perform an on-demand backup, copy, or restore, you must pass a service role that has access to perform the underlying operations on the specified resources. AWS Backup uses this role to create, tag, and delete resources in your account.
Using AWS Roles to Control Access to Backups
You can use roles to control access to your backups by defining narrowly scoped roles and by specifying who can pass that role to AWS Backup. For example, you could create a role that only grants permissions to back up Amazon Relational Database Service (Amazon RDS) databases and only grant Amazon RDS database owners permission to pass that role to AWS Backup. AWS Backup provides several predefined managed policies for each of the supported services. You can attach these managed policies to roles that you create. This makes it easier to create service-specific roles that have the correct permissions that AWS Backup needs.
For more information about AWS managed policies for AWS Backup, see Managed Policies.
Default Service Role for AWS Backup
When using the AWS Backup console for the first time, you can choose to have AWS Backup create a default service role for you. This role has the permissions that AWS Backup needs to perform backup operations for all the AWS services that it supports. To choose the default service role, follow any of the options in Getting Started.
You must create the default role using the AWS Management Console. You cannot create the default role using the AWS Command Line Interface (AWS CLI).
If you prefer to use custom roles, such as separate roles for different resource types, you can also do that and pass your custom roles to AWS Backup. To view examples of roles that enable backup and restore for individual resource types, see the table at at the end of Managed Policies.
The default service role created by AWS Backup manages creating and restoring backups.
It
has two managed policies, AWSBackupServiceRolePolicyForBackup and
AWSBackupServiceRolePolicyForRestores.
AWS Backup Default Service Role for Backups
This role includes an IAM policy that grants AWS Backup permissions to describe the resource being backed up, the ability to create, delete, or describe a backup, and the ability to add tags to the backup. For EC2 instance restores, you must also include the following permissions to launch the EC2 instance: "Action":"iam:PassRole", "Resource":"arn:aws:iam::account-id:role/role-name", "Effect":"Allow".
AWS Backup Default Service Role for Restores
This role includes an IAM policy that grants AWS Backup permissions to create, delete, or describe the new resource being created from a backup. It also includes permissions to tag the newly created resource. This IAM policy includes the necessary permissions for all the resource types that AWS Backup supports.
