Creating the Failback and in-AWS right-sizing roles

The Failback and in-AWS right-sizing roles are required to utilize various AWS Elastic Disaster Recovery capabilities, including cross account failback and in-AWS features. Each Trusted AWS Account will need a set of these IAM roles for functionality. You can automatically create these roles, and their attached policies, via the Trusted accounts section of the AWS Elastic Disaster Recovery console. The roles required are:

1. DRSCrossAccountReplicationRole

2. DRSCrossAccountAgentRole

3. DRSCrossAccountAgentAuthorizedRole

If you intend to create these roles manually, please ensure they are placed in the service-role path, with the Role name ending in an underscore and the trusted Account ID, as specified below:

arn:aws:iam::account-id:role/service-role/DRSCrossAccountReplicationRole_trustedAccountID

DRSCrossAccountReplicationRole

The DRSCrossAccountReplicationRole contains the following trust policy. If you plan to use the policy as a template, replace the account-id the Trusted AWS Account ID.

{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Principal": {
                  "Service": "drs.amazonaws.com"
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                  "StringLike": {
                      "aws:SourceAccount": "account-id",
                      "aws:SourceArn": "arn:aws:drs:*:account-id:recovery-instance/*"
                  }
              }
          },
          {
              "Effect": "Allow",
              "Principal": {
                  "Service": "drs.amazonaws.com"
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                  "StringLike": {
                      "aws:SourceAccount": "account-id",
                      "aws:SourceArn": "arn:aws:drs:*:account-id:source-server/*"
                  }
              }
          }
      ]
  }

The DRSCrossAccountReplicationRole has the AWS Managed Policy AWSElasticDisasterRecoveryCrossAccountReplicationPolicy attached.

DRSCrossAccountAgentRole

The DRSCrossAccountAgentRole contains the following trust policy. If you plan to use the policy as a template, replace the trustedAccount with the Trusted AWS Account ID, and replace sourceAccount with the source AWS Account ID.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::targetAccount:root"
            },
            "Action": [
                "sts:AssumeRole",
                "sts:TagSession"
            ],
            "Condition": {
                "ArnEquals": {
                    "aws:PrincipalArn": "arn:aws:iam::targetAccount:role/service-role/DRSCrossAccountAgentAuthorizedRole_sourceAccount"
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::targetAccount:root"
            },
            "Action": "sts:SetSourceIdentity",
            "Condition": {
                "StringLike": {
                    "sts:SourceIdentity": "i-*"
                },
                "ArnEquals": {
                    "aws:PrincipalArn": "arn:aws:iam::targetAccount:role/service-role/DRSCrossAccountAgentAuthorizedRole_sourceAccount"
                }
            }
        }
    ]
}

The DRSCrossAccountAgentRole has the AWS Managed Policy AWSElasticDisasterRecoveryEc2InstancePolicy attached.

DRSCrossAccountAgentAuthorizedRole

The DRSCrossAccountAgentAuthorizedRole contains the following trust policy. If you plan to use the policy as a template, replace the account-id the Trusted AWS Account ID.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::account-id:root"
            },
            "Action": [
                "sts:AssumeRole",
                "sts:TagSession"
            ],
            "Condition": {
                "StringLike": {
                    "aws:RequestTag/SourceInstanceARN": "${ec2:SourceInstanceARN}"
                },
                "ForAnyValue:StringEquals": {
                    "sts:TransitiveTagKeys": "SourceInstanceARN"
                }
            }
        }
    ]
}

The DRSCrossAccountReplicationRole has the following inline policy attached. If you plan to use the policy as a template, replace the trustedAccount with the Trusted AWS Account ID, and replace sourceAccount with the source AWS Account ID.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "sts:AssumeRole",
                "sts:TagSession"
            ],
            "Resource": "arn:aws:iam::trustedAccount:role/service-role/DRSCrossAccountAgentRole_sourceAccount",
            "Effect": "Allow"
        },
        {
            "Condition": {
                "StringLike": {
                    "sts:SourceIdentity": "i-*"
                }
            },
            "Action": [
                "sts:SetSourceIdentity"
            ],
            "Resource": "arn:aws:iam::trustedAccount:role/service-role/DRSCrossAccountAgentRole_sourceAccount",
            "Effect": "Allow"
        }
    ]
}