Permissions required for IAM roles for Resiliency Manager, IMS, and Replication Gateway
Following are the permissions required for the roles that you need to create for Resiliency Manager, IMS, and Replication Gateway for recovery to AWS data center.
Table: Permissions required for role for Resiliency Manager
Service name | Permission |
|---|---|
ec2 | ec2:DescribeVpcs ec2:DescribeAvailabilityZones |
S3 | s3:ListBucket |
Table: Permissions required for role for IMS
Service name | Permission |
|---|---|
ec2 | ec2:RunInstances ec2:CreateTags ec2:StartInstances ec2:DescribeInstanceStatus ec2:StopInstances ec2:TerminateInstances ec2:RegisterImage ec2:DescribeImageAttribute ec2:DescribeInstanceAttribute ec2:DeregisterImage ec2:DeleteVolume ec2:CreateVolume ec2:AttachVolume ec2:DetachVolume ec2:CreateSnapshot ec2:DeleteSnapshot ec2:ImportSnapshot ec2:DescribeImportSnapshotTasks ec2:CreateImage ec2:CreateNetworkInterface ec2:DeleteNetworkInterface ec2:AttachNetworkInterface ec2:ModifyNetworkInterfaceAttribute ec2:ModifyInstanceAttribute ec2:CreateStoreImageTask ec2:DescribeStoreImageTasks ec2:CreateRestoreImageTask ec2:DescribeVpcs ec2:DescribeSubnets ec2:DescribeImages ec2:DescribeSecurityGroups ec2:DescribeNetworkInterfaces ec2:DescribeVolumes ec2:DescribeAvailabilityZones ec2:DescribeSnapshots ec2:DescribeInstances ec2:GetEbsDefaultKmsKeyId ec2:GetEbsEncryptionByDefault ec2:DescribeInstanceTypes
|
ebs | ebs:CompleteSnapshot ebs:GetSnapshotBlock ebs:ListChangedBlocks ebs:ListSnapshotBlocks ebs:PutSnapshotBlock ebs:StartSnapshot |
events | events:PutTargets events:ListTargetsByRule events:DeleteRule events:PutRule events:RemoveTargets events:ListRules |
execute-api | execute-api:Invoke |
S3 | s3:ListBucket s3:PutObject s3:DeleteObject s3:GetObject s3:GetBucketLocation |
KMS | kms:ListAliases kms:ListKeys kms:DescribeKey |
logs | logs:DescribeLogGroups logs:DescribeLogStreams logs:FilterLogEvents logs:DeleteLogGroup logs:DeleteLogStream logs:CreateLogGroup logs:PutRetentionPolicy |
Table: Permissions required for role for Replication Gateway
Service name | Permission |
|---|---|
execute-api | execute-api:Invoke |
S3 | s3:PutObject s3:GetObject s3:ListBucket |