Why can’t I delete my AWS Backup recovery points?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

To delete AWS Backup recovery points, you must have the required permissions for your AWS Identity and Access Management (IAM) role. Confirm that you also have unrestricted vault access policies and unrestricted service control policies (SCPs). Also, verify that your recovery points don't have a legal hold and aren't stored in a locked backup vault.

To resolve "Access denied" errors, take the following actions.

Verify that your IAM role has the required permissions

Confirm that you have the DeleteRecoveryPoint permission attached to your IAM role.

Example IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "backup:DeleteRecoveryPoint",
        "backup:DescribeRecoveryPoint",
        "backup:ListRecoveryPoints"
      ],
      "Resource": "*"
    }
  ]
}

Remove access policy restrictions

If your backup vault has a resource-based access policy that denies the backup:DeleteRecoveryPoint action, you must remove this restriction.

Example of a restrictive policy that prevents deletion:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyDeleteRecoveryPoint",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "backup:DeleteRecoveryPoint",
      "Resource": "*"
    }
  ]
}

To remove the access policy restriction and allow deletion of recovery points, run the following delete-backup-vault-access-policy AWS CLI command:

aws backup delete-backup-vault-access-policy --backup-vault-name your-vault-name

Note: Replace your-vault-name with your backup vault name.

Alternatively, you can update the policy to explicitly allow the backup:DeleteRecoveryPoint action:

Example policy that allows recovery point deletion:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowDeleteRecoveryPoint",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::account-id:root"
      },
      "Action": [
        "backup:DeleteRecoveryPoint",
        "backup:DescribeRecoveryPoint"
      ],
      "Resource": "*"
    }
  ]
}

Remove SCP restrictions

If your service control policy (SCP) denies the backup:DeleteRecoveryPoint action, then you must update the SCP to allow this action.

Example SCP that prevents recovery point deletion:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PreventBackupRecoveryPointDeletion",
      "Effect": "Deny",
      "Action": [
        "backup:DeleteRecoveryPoint"
      ],
      "Resource": "*"
    }
  ]
}

To resolve this issue, update your SCP to remove the backup:DeleteRecoveryPoint action from the deny statement. Or, add an explicit allow statement for the required principals.

Delete recovery points under a legal hold or in a locked backup vault

If your recovery points have a legal hold or are stored in a locked backup vault, then address these restrictions before deletion. For instructions, see How do I delete recovery points that are under a legal hold or stored in a locked backup vault for AWS Backup?

Related information

Backup deletion

AWS Backup Vault Lock