The balancer must be stopped (ensuring there are no chunk migrations) to be able to take a consistent snapshots across the shards of a cluster. To accomplish this, the backup role needs find, insert, and update permissions on db: config, collection: settings.