PowerProtect Data Manager 19.15 Amazon Web Services Deployment Guide

IAM user roles and permissions

The following table lists the minimum permissions that are required for the IAM user roles.

ListTopics
GetTopicAttributes

ViewSubscriptions
Subscribe
Unsubscribe
ListBuilds
DescribeBuilds

Write PassRole
ListRoles

The following JSON code can be used set these permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "aws-marketplace:ViewSubscriptions",
                "aws-marketplace:Subscribe",
                "aws-marketplace:Unsubscribe",
                "aws-marketplace:ListBuilds",
                "aws-marketplace:DescribeBuilds",
                "iam:ListRoles",
                "iam:ListInstanceProfiles",
                "sns:GetTopicAttributes",
                "sns:ListTopics"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Action": "ec2:*",
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Action": [
                "cloudformation:*"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
           ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "StringLike": {
                    "iam:PassedToService": [
                        "ec2.amazonaws.com"
                    ]
                }
            }
        }
]
}

IAM PowerProtect Data Manager role

When creating the CloudFormation stack, select the PowerProtect Data Manager role from CloudFormation > Stacks > Create stack > Configure stack options > PowerProtect Data Manager Instance and Network Configuration > IAM Role (Optional).

IAM CloudFormation role and permissions

The AWS CloudFormation service deploys the PowerProtect Data Managerinstance. By default, this service uses the same roles and permissions as the logged-in user. These permissions can be changed by selecting an IAM CloudFormation role.

When you create the CloudFormation stack, the IAM CloudFormation role is selected from CloudFormation > Stacks > Create stack > Configure stack options > Permissions > IAM role name.

The following table lists the minimum permissions that are required for the IAM CloudFormation role.

Write PassRole
ListRoles

The following JSON code can be used set these permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "iam:PassedToService": "ec2.amazonaws.com"
                }
            }
        }
    ]
}