How do I delete recovery points in an EXPIRED state in AWS Backup?

Resolution

AWS Backup automatically deletes recovery points based on the lifecycle retention period defined in the backup plan or backup job. If AWS Backup can't remove recovery points, then recovery points remain in an EXPIRED state.

To delete a recovery point that's stuck in an EXPIRED state, update the permissions of your AWS Identity and Access Management (IAM) role for your recovery point. Or, you can manually delete a recovery point at any time if you have the DeleteRecoveryPoint permissions.

Note: If the IAM role for your recovery point no longer exists, then create a new IAM role for the recovery point. AWS Backup removes recovery points only if the IAM role has the required permissions to delete recovery points for the respective resource types. For more information on the required permissions, see AWSBackupServiceRolePolicyForBackup.

To update the permissions of your IAM role, complete the following steps:

1. Open the IAM console.
2. In the navigation pane, choose Policies.
3. Select the policy for the recovery point that's stuck in an EXPIRED state.
4. On the Permissions tab for your policy, choose JSON, and then choose Edit.
5. Attach the following permissions to your IAM role:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "backup:DeleteRecoveryPoint",
                   "backup:DescribeRecoveryPoint"
               ],
                "Resource": "arn:aws:backup:*:*:backup-vault:*"
           }
       ]
   }

   Note: If you use an Amazon Simple Storage Service (Amazon S3) backup, then also attach the policies AWSBackupServiceRolePolicyForS3Backup and AWSBackupServiceRolePolicyForS3Restore to your IAM role.
6. Choose Save changes.

Note: To delete a recovery point from a backup vault in AWS Backup, you must have the backup:DeleteRecoveryPoint permission in your IAM role. For more information, see How do I delete a recovery point from a backup vault in AWS Backup?