VBO - S3 Object Storage IAM Policy

[warnox]

Hi,

Is there official documentation showing the required permissions (AWS IAM Policy) for VBO to use an S3 bucket? I can only find the documentation for Backup & Replication, but nothing for VBO. I've been using the following, and it works, but not sure if this is ideal.

Code: Select all

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:DeleteObject",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-name",
                "arn:aws:s3:::*/*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "*"
        }
    ]
}

Thanks for any input.

[Mike Resseler]

Hi @warnox

VBO works with an access key to connect to S3. See here: https://helpcenter.veeam.com/docs/vbo36 ... tml?ver=40

[warnox]

Hi Mike,

Yea but an access key is tied to a user, which should have the least privilege policy applied. I’m looking for https://www.veeam.com/kb3151 but for VBO...

[Mike Resseler]

Ah sorry, I thought you meant rights for VBO to run effectively, my bad.

It should be the same privileges'. I will ask our QA team to verify if those are the least ones and ask support to write a KB specific for VBO

[Mike Resseler]

Hi @warnox

Bucket policy:

{
"Version": "2012-10-17",
"Id": "vbopolicy",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::11111111111111:user/IAM_USER_ID"
},
"Action": [
"s3:ListBucket"
],
"Resource": "arn:aws:s3::: examplebucketname "
},
{
"Effect": "Allow",
"Principal": {
"AWS": " arn:aws:iam::11111111111111:user/IAM_USER_ID "
},
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject",
"s3:AbortMultipartUpload"
],
"Resource": "arn:aws:s3::: examplebucketname /*"
}
]
}

User policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"s3:GetBucketLocation"
],
"Resource": "arn:aws:s3:::*"
}
]
}

I will ask to put this information into a KB.
Thanks
Mike

[warnox]

Thanks Mike, exactly what I was after.

[Polina]

And now it's covered in the KB: https://www.veeam.com/kb4046