Minimum Required AWS Permissions

For the AWS account used by the ZCA, Zerto requires only a subset of AWS permissions. This gives the Zerto customer more security and control over their AWS environment.

R

Tip:  To create a custom role for Managed Identity, you can use the JSON in the following section: Minimum required AWS permissions - in JSON format.

Permissions are required for:

Installing Zerto on AWS
Failover to AWS
Failover from AWS
Basic functionality
Collection of environment data

The following table lists the minimum required permissions, and for which task and service each permission is required:

Permission Required for Service
Resource: *    
AttachNetworkInterface Failover to AWS EC2
AttachVolume Failover to AWS EC2
CancelConversionTask Failover to AWS EC2
CancelImportTask Failover to AWS EC2
CreateNetworkInterface Failover to AWS EC2
CreateSnapshot Failover from AWS EC2
CreateTags Basic functionality EC2
CreateVolume Failover to AWS EC2
DeleteNetworkInterface Basic functionality EC2
DeleteSnapshot Failover from AWS EC2
DeleteTags Basic functionality EC2
DeleteVolume Failover to AWS EC2
DeregisterImage Failover from AWS EC2
DescribeAvailabilityZones Collection of environment data EC2
DescribeConversionTasks Failover to AWS EC2
DescribeImages

Basic functionality

Failover from AWS

EC2
DescribeInstanceAttribute Failover from AWS EC2
DescribeInstances Collection of environment data EC2
DescribeInstanceStatus Basic functionality EC2
DescribeNetworkInterfaces Basic functionality EC2
DescribeRegions Collection of environment data EC2
DescribeSnapshots Failover from AWS EC2
DescribeSecurityGroups Collection of environment data EC2
DescribeSubnets Collection of environment data EC2
DescribeTags Failover from AWS EC2
DescribeVolumes Collection of environment data EC2
DescribeVolumeStatus Failover from AWS EC2
DescribeVpcEndpoints Failover from AWS EC2
DescribeVpcs Collection of environment data EC2
DetachNetworkInterface Failover from AWS EC2
DetachVolume Failover to AWS EC2
ImportInstance Failover to AWS EC2
ImportVolume Failover to AWS EC2
ModifyVolume Failover from AWS EC2
ModifyInstanceAttribute Basic functionality EC2
ModifyNetworkInterfaceAttribute Failover from AWS EC2
RunInstances Basic functionality EC2
StartInstances Failover to AWS EC2
StopInstances Failover to AWS EC2
TerminateInstances Basic functionality EC2
GetObjectVersion Basic functionality S3
ListAllMyBuckets Basic functionality S3
HeadBucket Collection of environment data S3
GetPolicyVersion Install Zerto in AWS IAM
ListAttachedRolePolicies Install Zerto in AWS IAM
ListPolicyVersions Install Zerto in AWS IAM
PassRole Install Zerto in AWS IAM
DescribeTrails Collection of environment data CloudTrail
GetTrailStatus Collection of environment data CloudTrail
LookupEvents Collection of environment data CloudTrail
Resource: arn:aws:s3:::zerto*/*
PutObject Basic functionality S3
GetObject Basic functionality S3
DeleteObjectVersion Basic functionality S3
DeleteObject Basic functionality S3
Resource: arn:aws:s3:::zerto*    
ListBucketMultipartUploads

Basic functionality

Failover from AWS

S3
PutBucketTagging Basic functionality S3
PutLifecycleConfiguration Basic functionality S3
ListBucketVersions Basic functionality S3
CreateBucket Basic functionality S3
ListBucket Basic functionality S3
GetBucketLocation Basic functionality S3
DeleteBucket Basic functionality S3
GetBucketPolicy Collection of environment data S3
Resource: *,

StringEquals: ec2:ResourceTag/ZERTO_TAG: "ZERTO_VPC_RESOURCE"
   
AuthorizeSecurityGroupIngress Failover to AWS EC2
CreateSecurityGroup Basic functionality EC2
DeleteSecurityGroup Basic functionality EC2

Minimum required AWS permissions - in JSON format

Permissions for IAM roles can be specified by creating a policy in JSON format. The required AWS permissions are listed below. For further details, see Zerto - Prerequisites & Requirements for Amazon Web Services (AWS).

For your convenience, click here to access a .txt file, from which you can copy and paste.

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"ec2:AttachNetworkInterface",
"ec2:AttachVolume",
"ec2:CancelConversionTask",
"ec2:CancelImportTask",
"ec2:CreateNetworkInterface",
"ec2:CreateSnapshot",
"ec2:CreateTags",
"ec2:CreateVolume",
"ec2:DeleteNetworkInterface",
"ec2:DeleteSnapshot",
"ec2:DeleteTags",
"ec2:DeleteVolume",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeConversionTasks",
"ec2:DescribeImages",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstances",
"ec2:DescribeInstanceStatus",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeRegions",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DescribeTags",
"ec2:DescribeVolumes",
"ec2:DescribeVolumeStatus",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcs",
"ec2:DetachNetworkInterface",
"ec2:DetachVolume",
"ec2:ImportInstance",
"ec2:ImportVolume",
"ec2:ModifyInstanceAttribute",
"ec2:ModifyNetworkInterfaceAttribute",
"ec2:ModifyVolume",
"ec2:RunInstances",
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:TerminateInstances",
"s3:HeadBucket",
"s3:ListAllMyBuckets",
"cloudtrail:DescribeTrails",
"cloudtrail:GetTrailStatus",
"cloudtrail:LookupEvents",
"iam:GetPolicyVersion",
"iam:ListAttachedRolePolicies",
"iam:ListPolicyVersions",
"iam:PassRole"
],
"Resource": "*"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObjectVersion",
"s3:DeleteObject",
"s3:GetObjectVersion"
],
"Resource": "arn:aws:s3:::zerto*/*"
},
{
"Sid": "VisualEditor2",
"Effect": "Allow",
"Action": [
"s3:ListBucketMultipartUploads",
"s3:PutBucketTagging",
"s3:PutLifecycleConfiguration",
"s3:ListBucketVersions",
"s3:CreateBucket",
"s3:ListBucket",
"s3:GetBucketLocation",
"s3:DeleteBucket",
"s3:GetBucketPolicy"
],
"Resource": "arn:aws:s3:::zerto*"
},
{
"Sid": "VisualEditor3",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupIngress",
"ec2:CreateSecurityGroup",
"ec2:DeleteSecurityGroup"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/ZERTO_TAG": "ZERTO_VPC_RESOURCE"
}
}
}
]
}