Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to automate backup of a Linux AWS instance. I would like to do this via one of the many scripts available that rely on the API access of AWS to do snapshots of the underlying EBS volume.

What I had trouble to find out is if I should run these scripts/enable API access on the instance to back up, on another instance, or even from a host from outside of AWS? What is safer?

[1] https://github.com/colinbjohnson/aws-missing-tools/tree/master/ec2-automate-backup

share|improve this question

1 Answer 1

up vote 4 down vote accepted

If you create an IAM user (or instance role, if you prefer) that can only create snapshots - nothing else, including deletion - and use that user's access keys, it pretty much won't matter.

Even if your keys leaked out to 4chan, the worst they could do would be to make a whole bunch of snapshots.

Here's an example IAM policy:

{
    "Statement": [{
        "Action": [
            "ec2:CreateSnapshot"
        ],
        "Effect": "Allow",
        "Resource": "*"
    }]
}
share|improve this answer
    
Awesome, thanks! I didn't know that I could limit what a user could do. Kinda obvious though. –  arnuschky Oct 5 '13 at 15:26
    
IAM users and roles are very much your friend. :-) –  ceejayoz Oct 5 '13 at 15:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.