Create IAM role

Introduction

As recommended by Amazon, we are now shifting toward using the so-called IAM roles. An IAM role is similar to an IAM user in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. Also, a role does not have any credentials (password or access keys) associated with it. Instead, if a user is assigned to a role, access keys are created dynamically and provided to the user. Essentially, instead of using your keys, our service account will assume that role (generated automatically via the MBS Management Console). Alternatively, you can generate a role via CloudBerry Explorer and then just import it to the Management Console.

In this article, we explain how to create an IAM role:

• using the Management Console
• using CloudBerry Explorer
• using the AWS IAM console

Generate an IAM Role using the Management Console

1. Open the Management Console.
2. Open the Backup > Storage Accounts page.

3. Click + to launch the Add storage account wizard.

4. On the Select storage step, select Amazon S3 & Glacier. Click Next.
5. On the Provide Credentials step, name the storage account, then select whether you need Amazon S3 & Glacier or Amazon S3 & Glacier (AWS China).

6. In the Authentication type field, select IAM Role (MBS wizard).

7. Enter the Access & Secret key. Again, they will only be used for the policy creation session and will not be stored in any of our databases. Proceed to specify the required backup destinations — either new or existing ones. Complete the wizard.

The IAM Role account will be created automatically, and you will be able to find it in the list of Storage Accounts:

Generate an IAM Role using CloudBerry Explorer

Alternatively, you can create a role via CloudBerry Explorer. That, in turn, gives you greater flexibility in configuring the proper policy. Launch the app and under Access Manager (IAM), click New CloudBerry MBS IAM role.

Select the required Amazon S3 account. If you haven't added one yet, go ahead and do that in the settings.

Select the required buckets.

Now you need to copy the Provider ID from the Management Console and paste it into the text field in Explorer.

To get the Provider ID, go to the Management Console, click Storage Accounts, then click Add Storage and choose Amazon S3 with Authentication type "IAM Role (Manual, best practice)":

Set the required permissions during the next few steps.

In the last step, copy the ARN role and paste it into the Management Console. Click Save.

If you ever need to get the list of all your roles, they're always accessible in your Amazon AWS Console.

Everything is set and done. Now you can proceed to give your users access to the storage. As you can see, the essentials haven’t really changed that much. However, we aim to stay up-to-date with Amazon’s guidelines and have therefore altered the authentication mechanism behind the scenes.

Generate an IAM Role using AWS Management Console

Alternatively, you can create a role via the AWS Management Console and then enter the IAM Role identifier into the Add Account dialog of the Management Console for Managed Backup Service.

1. Go to the AWS console to add a role. Click Create Role.

2. Enter 626709717326 in the account ID info.

3. Select the Require external ID (Best practice when a third party will assume this role) checkbox.

4. Paste the Provider ID into the External ID text field. Click Next: Permissions.

To get the Provider ID, go to the Management Console, click Storage Accounts, then click Add Storage and choose Amazon S3 with Authentication type "IAM Role (Manual, best practice)":

5. Click Create Policy.

6. Click JSON and insert the following policy:

{ 
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "s3:DeleteBucket",
"Resource": "*",
"Condition": {}
},
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": "*",
"Condition": {}
},
{
"Effect": "Allow",
"Action": "iam:SimulatePrincipalPolicy",
"Resource": "*",
"Condition": {}
},
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "*",
"Condition": {}
},
{
"Effect": "Allow",
"Action": "ses:*",
"Resource": "*",
"Condition": {}
},
{
"Effect": "Allow",
"Action": "sns:*",
"Resource": "*",
"Condition": {}
},
{
"Effect": "Allow",
"Action": [
"ec2:ImportInstance",
"ec2:ImportImage",
"ec2:DescribeInstances",
"ec2:MonitorInstances",
"ec2:RequestSpotInstances",
"ec2:RunInstances",
"ec2:StartInstances",
"ec2:TerminateInstances",
"ec2:ModifyInstanceAttribute",
"ec2:CreateTags",
"ec2:CancelImportTask",
"ec2:StartInstances",
"ec2:DescribeConversionTasks",
"ec2:DescribeImportImageTasks",
"ec2:ImportVolume",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:StopInstances",
"ec2:DescribeKeyPairs",
"ec2:DescribeImages",
"ec2:ImportSnapshot",
"ec2:DescribeImportSnapshotTasks",
"ec2:CreateVolume",
"ec2:CreateImage",
"ec2:DescribeVolumes",
"ec2:DescribeSnapshots",
"ec2:DeleteSnapshot",
"ec2:CreateSnapshot",
"ec2:AttachVolume",
"ec2:DeregisterImage"
],
"Resource": "*",
"Condition": {}
}
]
}

7. Review the policy and click Create Policy.

8. Go to the previous tab, click Refresh, and start typing the name of the policy that you created:

9. Select it and click Review.

10. Enter the role name (no spaces) and click Create.

11. Open the role you've just created and copy its ARN.

12. Head back to the MBS Management Console and paste the ARN into the bottom field.

13. On the next step, you can select S3 buckets that will contain the backup data.