1

I need to automate backup of a Linux AWS instance. I would like to do this via one of the many scripts available that rely on the API access of AWS to do snapshots of the underlying EBS volume.

What I had trouble to find out is if I should run these scripts/enable API access on the instance to back up, on another instance, or even from a host from outside of AWS? What is safer?

[1] https://github.com/colinbjohnson/aws-missing-tools/tree/master/ec2-automate-backup

4

If you create an IAM user (or instance role, if you prefer) that can only create snapshots - nothing else, including deletion - and use that user's access keys, it pretty much won't matter.

Even if your keys leaked out to 4chan, the worst they could do would be to make a whole bunch of snapshots.

Here's an example IAM policy:

{
    "Statement": [{
        "Action": [
            "ec2:CreateSnapshot"
        ],
        "Effect": "Allow",
        "Resource": "*"
    }]
}
  • Awesome, thanks! I didn't know that I could limit what a user could do. Kinda obvious though. – arnuschky Oct 5 '13 at 15:26
  • IAM users and roles are very much your friend. :-) – ceejayoz Oct 5 '13 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.