---
title: "Veeam v13 Using Wasabi IAM and STS Authentication"
slug: "veeam-v13-using-wasabi-iam-and-sts-authentication"
updated: 2026-05-10T21:04:06Z
published: 2026-05-10T21:04:06Z
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wasabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Veeam v13 Using Wasabi IAM and STS Authentication

Wasabi is a member of Veeam's cloud partner ecosystem. We have worked closely with Veeam to offer both a seamless implementation and a smooth transition to cloud storage. [Veeam with Wasabi Solution Overview](https://wasabi.com/veeam/) provides more information on the Wasabi-Veeam partnership and solutions. Veeam's Backup and Replication software version 13 provides direct to Wasabi object storage functionality for backup and backup copy jobs.

This article provides the procedure to utilize Wasabi’s [Identity and Access Management (IAM)](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html) service and [Security Token Service (STS)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) for authentication so Veeam can access your Wasabi data . Wasabi’s STS is a service that lets a client such as Veeam create temporary credentials for an IAM user to access your Wasabi resources.

> The data restoration process is handled by your specific backup software application. As there are many potential variables that will affect your unique environment, Wasabi strongly recommends that you seek the guidance of your backup software's technical support team in the event that you encounter difficulty or have application-specific inquiries.

> If you are going to leverage immutable Veeam backups, follow the steps in [Object Lock: Enabling](https://docs.wasabi.com/docs/object-locking). Enabling bucket versioning only is not a proper configuration for immutable Veeam backups and can cause problems. If you are simply going to use regular Veeam backups with Wasabi buckets, bucket versioning is not required.

## Prerequisites

- Active Wasabi Storage account.
- Wasabi bucket created. Using Object Lock on your bucket is highly recommended from a security perspective so your data will be immutable for the amount of time configured in Veeam. Object Lock protects your data against malicious or accidental deletion. For more information, review [Working With Buckets and Objects](https://docs.wasabi.com/docs/working-with-buckets-and-objects).
- Veeam Backup and Replication version 13 software installed and licensed. This solution was most recently tested with v13.0.1.
- A valid Veeam license that supports capabilities for object storage.
- Virtual machines to be backed up added to the Veeam B&R application.

> Since the Veeam web user interface (UI) does not yet support creating object storage repositories, you must use the Veeam Windows client. If you’re using the Veeam Software Appliance, this is downloadable from your Veeam Software Appliance login page by clicking “Download Windows-based backup console for full experience” as shown in the following screenshot.
> 
> One Linux-based virtual machine (VM) runs the Veeam Software Appliance, and another Windows-based VM (or any Windows computer) runs the client software.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2025-12-04_at_10_31_06%E2%80%AFAM(2).png)

  

## Creating Wasabi Policies

In Veeam version 13, Veeam Backup and Replication software can backup to Wasabi cloud object storage utilizing IAM and STS authentication. The first step is to create Wasabi policies to restrict access to your Veeam data.

1. Log in to the [Wasabi Console](https://console.wasabisys.com).
2. Click **Policies** and then **Create Policy**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_30_39 AM.png)
3. Give the policy a name.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_32_06 AM_1.png)
4. Paste the following policy into the policy editor. Replace YOUR_BUCKET_NAME with the name of your bucket that will be used for Veeam data.

```json
{
                "Version": "2012-10-17",
                "Statement": [
                {
                "Effect": "Allow",
                "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:GetBucketVersioning",
                "s3:GetBucketObjectLockConfiguration",
                "s3:ListBucketVersions",
                "s3:GetObjectVersion",
                "s3:GetObjectRetention",
                "s3:GetObjectLegalHold",
                "s3:PutObjectRetention",
                "s3:PutObjectLegalHold",
                "s3:DeleteObjectVersion",
                "s3:GetBucketLocation"
                ],
                "Resource": [
                "arn:aws:s3:::YOUR_BUCKET_NAME/*",
                "arn:aws:s3:::YOUR_BUCKET_NAME"
                ]
                },
                {
                "Effect": "Allow",
                "Action": [
                "s3:ListAllMyBuckets",
                "s3:ListBucket"
                ],
                "Resource": "*"
                }
                ]
                }
```
5. Click **Create Policy**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_32_06 AM_2.png)
6. Create another policy with a name such as “VeeamIamPolicy” by pasting the following into the policy editor. Replace YOUR_ACCOUNT_NUMBER with your account ID that can be found under Settings in the Wasabi Console. The “veeam” user referenced in the policy will be created next.

```json
{
                "Version": "2012-10-17",
                "Statement": [
                {
                "Effect": "Allow",
                "Action": [
                "iam:AttachUserPolicy",
                "iam:CreateAccessKey",
                "iam:CreatePolicy",
                "iam:CreatePolicyVersion",
                "iam:CreateUser",
                "iam:DeleteAccessKey",
                "iam:DeletePolicy",
                "iam:DeleteUser",
                "iam:DeleteUserPolicy",
                "iam:DeletePolicyVersion",
                "iam:DetachUserPolicy",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetUser",
                "iam:GetUserPolicy",
                "iam:ListAccessKeys",
                "iam:ListAttachedUserPolicies",
                "iam:ListPolicyVersions",
                "iam:ListGroupsForUser",
                "iam:ListUserPolicies",
                "iam:PutUserPolicy",
                "iam:AddUserToGroup",
                "iam:RemoveUserFromGroup",
                "iam:SetDefaultPolicyVersion",
                "sts:GetCallerIdentity",
                "sts:AssumeRole"
                ],
                "Resource": "arn:aws:iam::YOUR_ACCOUNT_NUMBER:user/veeam"
                }
                ]
                }
```

## Creating a Wasabi User

1. In the Wasabi Console, click **Users**, then click **Create User**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_34_41 AM.png)
2. Name the user “veeam”, give them Programmatic access, and click **Next**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_35_32 AM.png)
3. It is not necessary to assign the user to a group. Click **Next**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_35_45 AM.png)
4. Select the two previously created policies from the drop-down menu by clicking them one at a time. They will appear at the bottom of the window.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_36_10 AM.png)
5. After the two policies are attached to the user, click **Next**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_36_29 AM.png)
6. Review the user details and click **Create User**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_36_43 AM.png)
7. Click **Download Keys** and save the file in a secure location. These keys will be used later in Veeam.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_37_23 AM(1).png)
8. Click the X at the top of the window to close.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_37_23 AM-2(1).png)
9. Click **Close**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_37_44 AM.png)
10. You will now see the “veeam” user in the users list.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_38_16 AM.png)

## Creating Wasabi as an Object Repository

1. Log in to your Veeam console. The Windows console must be used to create object storage repositories.
2. Under **Backup Infrastructure**, select **Backup Repositories**, then click **Add Repository**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_10_54_18 AM.png)
3. Click **Object Storage**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_10_54_30 AM.png)
4. Click **Additional Providers**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_10_54_41 AM.png)
5. Click **Wasabi Cloud Storage**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_10_54_54 AM.png)
6. Give the repo a name and click **Next**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_10_55_11 AM.png)
7. Enter the proper region for your bucket and click **Add******next to Credentials.

> This configuration example discusses the use of Wasabi's us-east-2 storage region. Use the region your bucket is located in. For a list of regions, see [Available Storage Regions](https://docs.wasabi.com/docs/en/where-is-my-data-stored-and-how-are-wasabis-storage-regions-secured?highlight=regions#available-storage-regions).

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_10_55_27 AM.png)
8. Enter the Access and Secret keys from the “veeam” user created above. Click **OK**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_10_55_58 AM.png)
9. Click **Next**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_10_56_14 AM(1).png)
10. Click **Browse** next to the Bucket field.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_10_56_30 AM.png)
11. Select your bucket and click **OK**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_10_56_55 AM.png)
12. Click **Browse** next to the Folder field.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_10_57_09 AM.png)
13. Click **New Folder** and give the folder a name. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_10_57_24 AM.png)
14. Select the folder and click **OK**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_10_59_14 AM.png)
15. It is highly recommended to check**“Make backups immutable”.** By default, the minimum immutability period is “entire retention period,” and you may click the link to change it if desired. Click**Next**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_10_59_28 AM.png)
16. In the Mount Server tab, keep the default values and click **Next**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_10_59_44 AM.png)
17. Click **Apply**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_01_34 AM.png)
18. Click **Next**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_02_13 AM.png)
19. Click **Finish**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_02_27 AM.png)
20. You will now see the Wasabi repository in the repo list.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_02_48 AM.png)

## Enabling IAM/STS in Veeam

1. Login to your Veeam console. The Windows console must be used.
2. Under **Backup Infrastructure**click **Backup Repositories** select the Wasabi repository created above. This must be the Wasabi repo using the veeam user’s Access and Secret keys.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_02_48 AM-2.png)
3. Right-click on the Wasabi repo. Click **Access permissions…**

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_03_03 AM.png)
4. Select the radio button next to **Provided by IAM/STS object storage capabilities (direct to object)**. Keep the default values of “iam.wasabisys.com” and “sts.wasabisys.com”. Click **OK**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_11_03_22 AM.png)

## Associating the Wasabi Repo With a Backup Job

Follow the sections in the appropriate article for your environment to create a new backup job, backup copy job, or Scale-out Backup Repository (SOBR) and associate the Wasabi repo with it. An existing job may be used instead. Select **Run the job when I click Finish** to run a test backup.

[Creating a Backup Job](https://docs.wasabi.com/docs/create-a-backup-job-in-veeam-v13-to-backup-to-wasabi#creating-a-backup-job) [Creating a Backup Copy Job](https://docs.wasabi.com/docs/create-a-backup-copy-job-in-veeam-v13-with-wasabi#creating-a-backup-copy-job) [Creating a Scale-out Backup Repository](https://docs.wasabi.com/docs/create-a-backup-job-in-veeam-v13-to-backup-to-wasabi-using-a-scale-out-backup-repository#creating-a-scaleout-backup-repository) followed by [Creating a Backup Job](https://docs.wasabi.com/docs/create-a-backup-job-in-veeam-v13-to-backup-to-wasabi-using-a-scale-out-backup-repository#creating-a-backup-job)

## Running a Test Restore

In this section we will run an example test restore of a virtual machine (VM) that was backed up with a backup job.

1. On the Home tab, click **Backups**, and then **Object Storage**. Under the job that created the backup, select the virtual machine or other disks, files, and so on that you want to restore (a VM is selected in this example). Since a VM is being restored in this example, click **Entire VM**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_52_11 PM.png)
2. Select the appropriate option from the menu. In our example we selected **VMware vSphere** since this is where the VM was backed up from.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_52_53 PM.png)
3. Click **Point…**

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_53_13 PM.png)
4. Select the appropriate restore point and click **OK**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_53_38 PM.png)
5. Click **Next**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_53_13 PMa.png)
6. Select the appropriate restore mode. Since this is just a test, we selected Restore to a new location, or with different settings. Click **Next.**

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_54_02 PM.png)
7. Change the**Host** if needed and click **Next**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_54_16 PM.png)
8. Change the Resource Pool if needed and click **Next**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_54_21 PM.png)
9. Select a different Datastore if needed and click **Next**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_54_48 PM.png)
10. Click **Name** to change the name of the restored VM so as not to conflict with the original.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_55_03 PM.png)
11. Click the checkbox next to Add suffix and change the name if needed to be unique on your network. Click **OK**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_55_20 PM.png)
12. Click **Next**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_55_38 PM.png)
13. Select the line for your VM to highlight it and click **Disconnect**. This will prevent an IP address conflict on your network.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_55_53 PM.png)
14. Click **Next**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_56_11 PM.png)
15. On the next screen click **Next**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_56_31 PM.png)
16. Optionally enter a restore reason and click **Next**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_56_43 PM.png)
17. Select the checkbox next to **Power on target VM after restoring**. Click **Finish**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_2_57_03 PM.png)
18. Ensure the Status shows “Success” and click **Close**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/Screenshot_2026-01-22_at_3_34_30 PM.png)
19. Log in to your VM’s console via its hypervisor to ensure the VM is operational.
20. Optionally, delete the restored VM. Do NOT delete the original VM.