How do I troubleshoot Amazon S3 backup errors in AWS Backup?

Resolution

Important: Before you troubleshoot, confirm that you meet the prerequisites to create an Amazon S3 backup.

Attach required IAM permissions

You receive the following error message:

"Your backup job failed as AWS Backup does not have permission to describe resource arn:aws:s3:::test-bucket. Please review your IAM policies to ensure AWS Backup can protect your resources."

This error occurs because the backup AWS Identity and Access Management (IAM) role lacks the permissions to back up an S3 bucket. The backup role is either the AWSBackupDefaultServiceRole role or a custom IAM role that you assigned to the backup job.

To resolve this error, complete the following steps:

1. Open the IAM console.
2. In the navigation pane, choose Roles.
3. Select the IAM role that you use for AWS Backup.
4. Select the AWSBackupServiceRolePolicyForS3Backup and AWSBackupServiceRolePolicyForS3Restore policies.
5. Choose Add permissions, and then choose Attach policies. For more information, see Permissions and policies for Amazon S3 backup and restore.

Note: If you use the IAM role for backup operations only, attach only the AWSBackupServiceRolePolicyForS3Backup policy. Attach the AWSBackupServiceRolePolicyForS3Restore policy if you also use the role for restore operations. The default role that you create for AWS Backup doesn't include the S3 backup or restore policies.

Review the S3 bucket policy for explicit deny statements

A backup can fail with a permissions error even if you have the correct policies attached to the IAM role. This failure occurs when an explicit deny statement in the S3 bucket policy blocks AWS Backup. If you add an explicit deny statement in a bucket policy, then the statement overrides allow permissions in the IAM role's policy.

To resolve this issue, complete the following steps:

1. Open the Amazon S3 console.
2. Choose the bucket that you want to back up.
3. Choose the Permissions tab.
4. In the Bucket policy section, review the policy for "Effect": "Deny" statements.
5. If a deny statement blocks actions that AWS Backup requires, then add a condition to the deny statement that excludes the AWS Backup role.
   Note: AWS Backup can require actions such as s3:GetObject, s3:ListBucket, s3:GetBucketVersioning, and s3:PutBucketNotification.
   For example, add an ArnNotLike condition to the deny statement that excludes your AWS Backup IAM role:

   {
     "Effect": "Deny",
     "Principal": "*",
     "Action": "s3:*",
     "Resource": [
       "arn:aws:s3:::example-bucket",
       "arn:aws:s3:::example-bucket/*"
     ],
     "Condition": {
       "ArnNotLike": {
         "aws:PrincipalArn": "arn:aws:iam::111111111111:role/service-role/AWSBackupDefaultServiceRole"
       }
     }
   }

   Note: Replace 111111111111 with your AWS account ID and AWSBackupDefaultServiceRole with the name of your AWS Backup IAM role.
6. Retry the backup job to confirm that the explicit deny statement no longer blocks AWS Backup.

Activate S3 bucket Versioning

You receive the following error message:

"Versioning is not enabled on test-bucket. The backup job failed to create a recovery point for your resource arn:aws:s3:::test-bucket due to missing permissions on role arn:aws:iam::111111111111:role/service-role/AWSBackupDefaultServiceRole."

This error occurs because Versioning is deactivated for the S3 bucket. AWS Backup requires S3 Versioning to create backups.

To resolve this error, complete the following steps:

1. Open the Amazon S3 console.
2. Choose the bucket that you want to back up.
3. Choose the Properties tab.
4. In the Bucket Versioning section, choose Edit.
5. Select Enable, and then choose Save changes.
6. Retry the backup job.

Use the same vault for continuous and periodic backups

You receive the following error message:

"Bucket testing-s3-backup already has continuous backup enabled for another vault The backup job failed to create a recovery point for your resource arn:aws:s3:::test-bucket due to missing permissions on role arn:aws:iam::111111111111:role/service-role/AWSBackupDefaultServiceRole."

This error occurs because the continuous and periodic backups for the S3 bucket use different vaults.

To resolve this error, update your backup plan to write both continuous and periodic Amazon S3 recovery points to the same backup vault. You can't store continuous and periodic backups for the same S3 bucket in different vaults.

Fix the s3:PutBucketNotification action

AWS Backup uses event notifications for Amazon S3 backups. During the backup, AWS Backup calls the s3:PutBucketNotification action on the bucket. You receive the following error message:

"Unable to perform s3:PutBucketNotification on test-bucket The backup job failed to create a recovery point for your resource arn:aws:s3:::test-bucket due to missing permissions on role arn:aws:iam::111111111111:role/service-role/AWSBackupDefaultServiceRole."

This error occurs in the following situations:

• The event notification destination on the S3 bucket isn't correct or valid.
• The S3 bucket policy or service control policies (SCPs) deny the s3:PutBucketNotification action.

To resolve this error, complete the following steps:

1. Open the Amazon S3 console.
2. Choose your bucket, and then choose the Properties tab.
3. In the Event notifications section, verify that all event notification destinations are valid and correct.
4. In the Amazon EventBridge section, choose Edit.
5. For Send notifications to Amazon EventBridge for all events in this bucket, choose On, and then choose Save changes.
6. Review the bucket policy and SCPs for deny statements that block the s3:PutBucketNotification permission. If the backup role lacks the s3:PutBucketNotification permission, then the job fails. For more information, see PutBucketNotificationConfiguration.

Resolve object-level backup failures

When you back up objects in Amazon S3, some objects might not back up because of permissions issues. You receive either of the following status messages:

• "Completed with issues"
• "One or more objects failed to be backed up from the source bucket testing-s3-backup. You can enable vault based SNS notifications for S3 events S3_BACKUP_OBJECT_FAILED and S3_RESTORE_OBJECT_FAILED to receive SNS notifications whenever a object fails to backup or restore."

To resolve these errors, complete the following steps:

1. Attach the AWSBackupServiceRolePolicyForS3Backup and AWSBackupServiceRolePolicyForS3Restore managed policies to the backup's IAM role. For instructions, see the Attach required IAM permissions section.
2. If the objects use AWS Key Management Service (AWS KMS) encryption, add the account root or AWS Backup role as a key user in the key policy.
3. Activate Amazon Simple Notification Service (Amazon SNS) vault-based notifications for the S3_BACKUP_OBJECT_FAILED and S3_RESTORE_OBJECT_FAILED events. These notifications alert you when individual objects fail to back up or restore.