Minimum IAM permissions for AWS backup

[davejab]

Hi 👋

Can't find any reference for the minimum required IAM permissions required to run, does anyone have a minimal policy they can share?

Thanks!

[m90]

I don't know how this maps to a policy document, but looking at the relevant code you can see the APIs used are:

• PutObject
• ListObjects (only used when pruning is configured)
• DeleteObject (only used when pruning is configured)

[davejab]

Trying with this as a bare minimum:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "VisualEditor0",
			"Effect": "Allow",
			"Action": [
				"s3:PutObject",
				"s3:ListBucket",
				"s3:DeleteObject"
			],
			"Resource": [
				"arn:aws:s3:::xxxxxx",
				"arn:aws:s3:::xxxxxx/*"
			]
		}
	]
}

Running a one off:

docker run --rm \ 
  -v /my/data/dir:/backup/data \
  --env AWS_ACCESS_KEY_ID="xxxxxx" \
  --env AWS_SECRET_ACCESS_KEY="xxxxxx" \
  --env AWS_S3_BUCKET_NAME="xxxxxx" \
  --env GPG_PASSPHRASE="xxxxxx" \
  --entrypoint backup \
  offen/docker-volume-backup:v2.42.0

Results in:

time=2024-08-15T20:54:35.178Z level=INFO msg="Created backup of `/backup` at `/tmp/backup-2024-08-15T20-54-35.tar.gz`."
time=2024-08-15T20:54:35.207Z level=INFO msg="Encrypted backup using gpg, saving as `/tmp/backup-2024-08-15T20-54-35.tar.gz.gpg`."
time=2024-08-15T20:54:47.236Z level=INFO msg="Removed tar file `/tmp/backup-2024-08-15T20-54-35.tar.gz`."
time=2024-08-15T20:54:47.238Z level=INFO msg="Removed GPG file `/tmp/backup-2024-08-15T20-54-35.tar.gz.gpg`."
time=2024-08-15T20:54:47.238Z level=ERROR msg="Fatal error running command: s3.(*s3Storage).Copy: error uploading backup to remote storage: [Message]: 'The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint.', [Code]: PermanentRedirect, [StatusCode]: 301" error="main.(*command).runAsCommand: error running script: main.runScript.func4: error running script: main.(*script).copyArchive: error copying archive: s3.(*s3Storage).Copy: error uploading backup to remote storage: [Message]: 'The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint.', [Code]: PermanentRedirect, [StatusCode]: 301"

Changing the policy to allow s3:* just works, minio must be doing other operations subtly

[m90]

I think the permission is strangely called s3:ListAllMyBuckets: https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListBuckets.html when you're currently using s3:ListBucket.

Alternatively, you could probably also set a region-specific endpoint like it says in the error message.

[davejab]

That's what I was missing, oddly I needed both, can't confirm if pruning works just yet but this should be it:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "VisualEditor0",
			"Effect": "Allow",
			"Action": [
				"s3:ListAllMyBuckets",
				"s3:PutObject",
				"s3:DeleteObject",
				"s3:ListBucket"
			],
			"Resource": [
				"arn:aws:s3:::xxxxxxx",
				"arn:aws:s3:::xxxxxxx/*"
			]
		}
	]
}