AWS managed policy: AWSElasticDisasterRecoveryReplicationServerPolicy

This policy is attached to the AWS Elastic Disaster Recovery replication server’s instance role.

This policy allows the AWS Elastic Disaster Recovery (AWS DRS) replication servers, which are Amazon EC2 instances launched by Elastic Disaster Recovery, to communicate with the DRS service, and to create EBS snapshots in your AWS account. An IAM role with this policy is attached (as an EC2 instance profile) by AWS DRS to the AWS DRS replication servers which are automatically launched and terminated by AWS DRS, as needed. AWS DRS replication servers are used to facilitate data replication from your external servers to AWS, as part of the recovery process managed by AWS DRS. We do not recommend that you attach this policy to your users or roles.

Permissions details

This policy includes the following permissions.

{
	"Version": "2012-10-17",
	"Statement": [
		{
		        "Sid": "DRSReplicationServerPolicy1",
			"Effect": "Allow",
			"Action": [
				"drs:SendClientMetricsForDrs",
				"drs:SendClientLogsForDrs"
			],
			"Resource": "*"
		},
		{
		        "Sid": "DRSReplicationServerPolicy2",
			"Effect": "Allow",
			"Action": [
				"drs:GetChannelCommandsForDrs",
				"drs:SendChannelCommandResultForDrs"
			],
			"Resource": "*"
		},
		{
		        "Sid": "DRSReplicationServerPolicy3",
			"Effect": "Allow",
			"Action": [
				"drs:GetAgentSnapshotCreditsForDrs",
				"drs:DescribeReplicationServerAssociationsForDrs",
				"drs:DescribeSnapshotRequestsForDrs",
				"drs:BatchDeleteSnapshotRequestForDrs",
				"drs:NotifyAgentAuthenticationForDrs",
				"drs:BatchCreateVolumeSnapshotGroupForDrs",
				"drs:UpdateAgentReplicationProcessStateForDrs",
				"drs:NotifyAgentReplicationProgressForDrs",
				"drs:NotifyAgentConnectedForDrs",
				"drs:NotifyAgentDisconnectedForDrs",
				"drs:NotifyVolumeEventForDrs",
				"drs:SendVolumeStatsForDrs"
			],
			"Resource": "*"
		},
		{
		        "Sid": "DRSReplicationServerPolicy4",
			"Effect": "Allow",
			"Action": [
				"ec2:DescribeInstances",
				"ec2:DescribeSnapshots"
			],
			"Resource": "*"
		},
		{
		        "Sid": "DRSReplicationServerPolicy5",
			"Effect": "Allow",
			"Action": [
				"ec2:CreateSnapshot"
			],
			"Resource": "arn:aws:ec2:*:*:volume/*",
			"Condition": {
				"Null": {
					"aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false"
				}
			}
		},
		{
		        "Sid": "DRSReplicationServerPolicy6",
			"Effect": "Allow",
			"Action": [
				"ec2:CreateSnapshot"
			],
			"Resource": "arn:aws:ec2:*:*:snapshot/*",
			"Condition": {
				"Null": {
					"aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false"
				}
			}
		},
		{
		        "Sid": "DRSReplicationServerPolicy7",
			"Effect": "Allow",
			"Action": "ec2:CreateTags",
			"Resource": "*",
			"Condition": {
				"StringEquals": {
					"ec2:CreateAction": "CreateSnapshot"
				}
			}
		}
	]
}