Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to automate backup of a Linux AWS instance. I would like to do this via one of the many scripts available that rely on the API access of AWS to do snapshots of the underlying EBS volume.

What I had trouble to find out is if I should run these scripts/enable API access on the instance to back up, on another instance, or even from a host from outside of AWS? What is safer?


share|improve this question
up vote 4 down vote accepted

If you create an IAM user (or instance role, if you prefer) that can only create snapshots - nothing else, including deletion - and use that user's access keys, it pretty much won't matter.

Even if your keys leaked out to 4chan, the worst they could do would be to make a whole bunch of snapshots.

Here's an example IAM policy:

    "Statement": [{
        "Action": [
        "Effect": "Allow",
        "Resource": "*"
share|improve this answer
Awesome, thanks! I didn't know that I could limit what a user could do. Kinda obvious though. – arnuschky Oct 5 '13 at 15:26
IAM users and roles are very much your friend. :-) – ceejayoz Oct 5 '13 at 15:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.