Error while trying to do CreateBackupVault

The "AccessDenied" error you're encountering when trying to create a backup vault suggests a permissions issue. This is a common error when working with AWS Backup operations.

There are several potential causes for this error:

1. Insufficient IAM permissions: The IAM role or user you're using might not have the necessary permissions to create a backup vault. Ensure your IAM policy includes permissions for the backup:CreateBackupVault action.

2. Resource-based policy restrictions: There might be explicit deny statements in policies that are preventing the creation of the backup vault.

3. Service Control Policies (SCPs): If you're working within an AWS Organization, SCPs might be restricting the backup vault creation.

To troubleshoot this issue:

1. Check your IAM permissions to ensure you have the proper access to create backup vaults.

2. Review any applicable bucket policies or resource-based policies that might be restricting access.

3. Check CloudTrail event history for more detailed error messages that can help pinpoint the exact permission issue.

4. Verify that you're not hitting any service limits for AWS Backup.

Note that AWS Backup API sometimes returns "AccessDenied" errors instead of more specific error types as a security measure. This behavior is designed to prevent unauthorized users from probing the existence of resources in an AWS account.

If you continue to face issues after checking these areas, you may need to open a support ticket with AWS for more specific guidance related to your account configuration.
Sources
AWS Backup API responds with AccessDeniedException instead of ResourceNotFoundException | AWS re:Post
AWS Backup error: Failed to save policy. You don't have permissions to access this resource. | AWS re:Post
CreateBackupVault - AWS Backup

Hello,

As I understand, you were getting Access denied error when trying to create a backup vault.

The "AccessDenied" error you're encountering when trying to create a backup vault suggests a permissions issue. There are several reasons for this error which include IAM permissions issue, Resource-based policy restrictions and Service Control Policy restriction. You can refer above answer to troubleshoot further at your end.

Also while going through the AWS Backup documentation, when you create a backup vault “CreateBackupVault” API is called [1]. Moving further, for performing this API operation, following IAM permissions are required [2] on specific resources as mentioned in the documentation.

backup:CreateBackupVault
backup-storage:MountCapsule
kms:CreateGrant
kms:GenerateDataKey
kms:Decrypt
kms:RetireGrant
kms:DescribeKey

Hence I kindly request you to check if above all mentioned permissions were added to your user/role and see that they were not restricted anywhere. Once you add all the above mentioned actions you will be able to call the CreateBackupVault successfully.

After adding above permissions, if you are still encountering with an access denied error you may need to open a support ticket with AWS for more specific guidance related to your account configuration.

Have a Great Day ahead!

References:

[1] CreateBackupVault - https://docs.aws.amazon.com/aws-backup/latest/devguide/API_CreateBackupVault.html
[2] Backup API permissions - https://docs.aws.amazon.com/aws-backup/latest/devguide/access-control.html#backup-api-permissions-ref

I added all the above permissions and still getting same error. Please help