AWS Backup API responds with AccessDeniedException instead of ResourceNotFoundException

Question

Attempting to describe an AWS Backup vault with AWS CLI results in an `AccessDeniedException` rather than a `ResourceNotFoundException` error if the vault does _not_ exist:

```
$ aws backup describe-backup-vault --region eu-west-2 --backup-vault-name non-existent

An error occurred (AccessDeniedException) when calling the DescribeBackupVault operation: Insufficient privileges to perform this action.
```

This happens despite the credentials being used having full access to AWS Backup.

---

Similarly, when making authenticated [DescribeBackupVault ](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeBackupVault.html) requests for a non-existent vault using `curl`:

```shell
curl -vvv \
     --aws-sigv4 "aws:amz::backup" \
     --user ":" \
     https://backup.eu-west-2.amazonaws.com/backup-vaults/non-existent?backupVaultAccountId=
```

The response indicates an `AccessDeniedException` error rather than a `ResourceNotFoundException`:

```
...
* Request completely sent off
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/2 403
< date: Tue, 27 Aug 2024 21:27:58 GMT
< content-type: application/json
< content-length: 61
< x-amzn-requestid: 
< x-amzn-errortype: AccessDeniedException
<
* Connection #0 to host backup.eu-west-2.amazonaws.com left intact
{"Message":"Insufficient privileges to perform this action."}
```
---

Is this behaviour intentional or should the correct response error be `ResourceNotFoundException` when the backup vault does not exist? This also impacts external tools such as the [AWS Provider for Terraform](https://github.com/hashicorp/terraform-provider-aws), which appears to treat both an `AccessDeniedException` and `ResourceNotFoundException` as simply a `ResourceNotFoundException` (see [internal/service/backup/find.go](https://github.com/hashicorp/terraform-provider-aws/blob/main/internal/service/backup/find.go#L101-L106)), leading to scenarios where Terraform will attempt to create a backup vault when one already exists (e.g. if the Terraform state file already contains metadata for a backup vault previously created, but the credentials being used to generate a new Terraform plan are legitimately denied the `DescribeBackupVault` action, then Terraform will assume the resource does not exist and attempt to create it rather than reporting a permissions issue).

Didier_Durand · Answer

Hi,

Given the fact that you have full access to AWS Backup resources, I would tend to agree with you re.  the expectation of ResourceNotFoundException rather than AccessDeniedException.

So, I'd suggest you to open a ticket via the console of your AWS account: service teams do not monitor re:Post as a community site to surface and handle such issues.

Best,

Didier

Deeksha · Answer

1. When you receive an AccessDeniedException, AWS is indicating that the credentials used do not have the necessary permissions to 
    perform the requested operation (DescribeBackupVault in this case).

AWS often prefers to return AccessDeniedException instead of ResourceNotFoundException when there are permission issues. This is a 
    security measure to prevent unauthorized users from probing the existence of resources in an AWS account. If an unauthorized user 
    were to receive a ResourceNotFoundException, it would confirm the non-existence of the resource, which can be considered sensitive 
    information.

2. This behavior is by design to ensure that users without proper permissions do not get hints about the existence or non-existence of resources. This way, AWS protects against potential information disclosure through error messages.

3. Tools like Terraform might interpret AccessDeniedException as ResourceNotFoundException, leading to unintended behavior, such as trying to create a resource that already exists but cannot be accessed due to insufficient permissions.

To avoid this, it's essential to ensure that the IAM policies associated with the credentials used by such tools are appropriately configured to have the necessary permissions for the operations being performed.

1. Review IAM Permissions:

Ensure that the IAM policy associated with the credentials has the necessary permissions for the DescribeBackupVault action. 
   For example:

```
   {
     "Effect": "Allow",
     "Action": "backup:DescribeBackupVault",
     "Resource": "*"
   }

```
   Ensure the credentials have the necessary permissions to list and describe backup vaults.

2. Handle Errors Appropriately:

When integrating with external tools like Terraform, handle AccessDeniedException errors separately from ResourceNotFoundException 
   to ensure that you can differentiate between genuine permission issues and non-existent resources.

3. Custom Error Handling in Automation:

In your scripts or automation workflows, explicitly check for permission issues (AccessDeniedException) and handle them appropriately, 
   such as logging a permissions issue rather than assuming the resource doesn't exist.

AWS Backup API responds with AccessDeniedException instead of ResourceNotFoundException

Relevant content