Minimal permissions for Kubernetes backup with Kasten on AWS S3 - kubernetes

Question

I would like to set up a Location profile for Kasten to perform backup on a S3 bucket on AWS. The documentation recommends giving minimal permissions to the user/role designated to perform the backup, but I keep getting an error when trying to add the profile only with those permissions in my IAM policy.
https://docs.kasten.io/latest/usage/configuration.html#profile-creation
When I give full S3 access to the user, the profile is added correctly, but I don't want to do that.

Answer 1

The correct minimal permissions are a combination of the permissions specified on these 2 pages in the documentation:
https://docs.kasten.io/latest/usage/configuration.html#profile-creation
https://docs.kasten.io/latest/install/aws/using_aws_iam_roles.html#using-aws-iam-roles
Here is how your minimal permissions policy should look like (just replace your bucket name at the end):
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"s3:GetBucketObjectLockConfiguration",
"s3:PutObject",
"s3:GetObject",
"s3:GetObjectRetention",
"s3:PutObjectRetention",
"s3:PutBucketPolicy",
"s3:ListBucket",
"s3:DeleteObject",
"s3:DeleteBucketPolicy",
"s3:GetBucketLocation",
"s3:GetBucketPolicy"
],
"Resource": [
"arn:aws:s3:::{BUCKET_NAME}",
"arn:aws:s3:::{BUCKET_NAME}/*"
]
}
]
}