Service IAM Roles in Backup Account

[kmontgo]

Hello,

Service IAM Roles in Backup Account requires many IAM and EC2 permissions with a Resource of "*" as the default.
The permissions being called out on a security audit are `iam:PutRolePolicy`, `iam:AttachRolePolicy`, iam:PassRole` and `ec2:RunInstances` as examples.

Is there a way to restrict these permissions to only the VBA_Worker instances? Maybe some other method of narrowing the scope if these rights?

Thank you!

[nielsengelen]

Hi Kent,

Sorry for the late reply.

We have a list of IAM permissions required in our user guide.

These are the minimum requirements to ensure everything works. Within the product, we also have the option to create dedicated roles for specific features (workloads, workers). Have you tried this already by any chance?

[kmontgo]

Niels,

I had not considered using the dedicated role option and that may help with the privilege restriction.

Thank you for the feedback,

Kent

[nielsengelen]

No problem. Please let us know if you face any issues or questions.

Thanks!