How do I troubleshoot issues that occur when I back up Amazon EBS volumes in AWS Backup?

Resolution

AccessDeniedException error

You get the following error message when an EBS volume doesn't have the required AWS Identity and Access Management (IAM) permissions for AWS Backup:

"AccessDeniedException: User: arn:aws:sts::123456789012:role/AWSBackupIAMRole is not authorized to perform: ec2:CreateSnapshot on resource: arn:aws:ec2:region:account:volume/vol-####"

To resolve this issue, complete the following steps:

Edit your IAM policy to include the following ec2:CreateSnapshot, ec2:DeleteSnapshot, ec2:DescribeVolumes, and ec2:DescribeSnapshots permissions:

    {
      "Sid" : "EBSResourcePermissions",
      "Effect" : "Allow",
      "Action" : [
        "ec2:CreateSnapshot",
        "ec2:DeleteSnapshot",
        "ec2:DescribeVolumes",
        "ec2:DescribeSnapshots"
      ],
      "Resource" : [
        "arn:aws:ec2:*::snapshot/*",
        "arn:aws:ec2:*:*:volume/*"
      ]
    },

For encrypted volumes, add the following AWS Key Management Service (AWS KMS) permissions to your IAM policy:

     "kms:Decrypt",
     "kms:Encrypt",
     "kms:GenerateDataKey",
     "kms:ReEncryptTo",
     "kms:ReEncryptFrom",
     "kms:GenerateDataKeyWithoutPlaintext",
     "kms:DescribeKey",
     "kms:CreateGrant"

Retry the backup job.

ResourceNotFoundException error

You get the "ResourceNotFoundException: Unable to locate resource volume/vol-####" error message in the following scenarios:

• You deleted the EBS volume.
• The EBS volume is located in an AWS Region or AWS account that's different from the Region or account where your backup job runs.

If you deleted the EBS volume, then create a new EBS volume. Make sure to create your volume in the Region or account where your backup job runs.

If your EBS volume isn't in the Region or account where your backup job runs, then take the following actions:

Verify whether your EBS volume is in a different Region or account than your backup job

To check whether your EBS volume is in the same Region as your backup job, complete the following steps:

1. Open the Amazon Elastic Compute Cloud (Amazon EC2) console.
2. In the navigation pane, choose Volumes.
3. In the navigation bar, select the Region that matches the Region of your backup job.
4. In the search box, enter your volume ID.
5. Confirm that the volume exists and is in the Available or In-use state.

To check whether your EBS volume is in the same account as your backup job, complete the following steps:

1. Open the Amazon EC2 console.
2. In the navigation pane, choose Snapshots.
3. On the menu in the Snapshots section, choose Owned by me.
4. Check for the EBS resource.

To move your EBS volume to the same Region or account as your backup job, complete the following steps:

1. Create a snapshot of your EBS volume.
2. Copy the snapshot to the Region or account where your backup job runs.
3. Create a new volume from the copied snapshot.
4. Attach the new volume to your instance.

Stuck or failed backup jobs

To resolve a stuck or failed backup job, take the following actions:

• Check the total number of EBS snapshots in your Region to determine whether you reached the snapshot quota for the Region. Amazon EBS has a quota of 100,000 backups for each Region and each account.
• Make sure that your AWS KMS key allows AWS Backup to use your backup vault. The AWS KMS key policy requires the following AWS KMS permissions: kms:createGrant, kms:generateDataKey, and kms:decrypt.
• Confirm that you have available volumes. AWS Backup can create snapshots of only available or in-use volumes.

To troubleshoot other issues that cause a stuck or failed backup job, see How do I troubleshoot failed backup jobs in AWS Backup?

EBS snapshot throttling errors

You get the following error messages when you take too many EBS backups in parallel and exceed the maximum number of concurrent snapshot service quotas:

• "ThrottlingException: Rate exceeded"
• "Image creation throttled due to maximum number of concurrent snapshots on an EBS volume error."

To resolve this issue and avoid burst traffic, take the following actions to stagger or reschedule your backup jobs:

• To spread the load, assign resources to different backup plans. For example, you can split resources by tag, environment, or priority.
• Run on-demand backups in non-conflicting time slots to avoid interference with scheduled backup jobs.
• Monitor concurrency to detect snapshot bursts.

To identify concurrency bursts, complete the following steps:

1. Open the AWS Backup console.
2. In the navigation pane, choose Jobs, and then choose the Backup jobs tab.
3. In the search filter, enter Resource type : EBS.
4. Review the Creation time column for your backup jobs and see how many snapshot jobs begin at the same time.
5. If many jobs start within the same minute, adjust your backup window or cron expressions so that backup plans start at different times.

To identify snapshot creation requests from AWS Backup and other automation sources (such as scripts), query AWS CloudTrail for CreateSnapshot and CreateSnapshots events.

Related information

Troubleshooting AWS Backup

Using AWS roles to control access to backups

Encryption for backups in AWS Backup