Perform AWS Backup on S3 with access restricted to VPC

Question

I have a S3 bucket with the following permission added to the bucket permission:

```
{
            "Sid": "DenyAllExceptSpecifiedVPC",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::s3-document",
                "arn:aws:s3:::s3-document/*"
            ],
            "Condition": {
                "StringNotEquals": {
                    "aws:sourceVpc": ""
                }
            }
 }
```
Together with an VPC endpoint to S3, I successfully restricted access to my bucket objects only to my AWS resources in the specified VPC.

I then would like to create a AWS backup plan to perform AWS backup on the S3 bucket. For testing, I tried to create an on-demand backup with a user role for AWS backup with AmazonS3FullAccess and AWSBackupServiceRolePolicyForS3Backup managed policies, but I am still with insufficient permission to perform the backup. I was able to perform the backup if I remove the above S3 bucket permission.

My question is: Is it possible to perform AWS backup on my S3 bucket if I want to keep the above S3 bucket permission to restrict access to my VPC? If it is possible, how should I specify the permissions of user role used for running the AWS backup?

Riku_Kobayashi · Accepted Answer

Hello.

You can obtain a backup by registering the IAM role used by AWS Backup as an exception as shown below.  
By modifying the bucket policy as follows, you can allow access from AWS Backup and obtain a backup.  
```
{
            "Sid": "DenyAllExceptSpecifiedVPC",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::s3-document",
                "arn:aws:s3:::s3-document/*"
            ],
            "Condition": {
                "StringNotLike": {  
                    "aws:userid": "AROASAMPLESAMPLESAMPL:*"  
                },  
                "StringNotEquals": {
                    "aws:sourceVpc": ""
                }
            }
 }
```

You can check the "RoleId" set in the bucket policy using the following AWS CLI command.  
```
aws iam get-role --role-name AWSBackupDefaultServiceRole
{
    "Role": {
        "Path": "/service-role/",
        "RoleName": "AWSBackupDefaultServiceRole",
        "RoleId": "AROASAMPLESAMPLESAMPL",
        "Arn": "arn:aws:iam:::role/service-role/AWSBackupDefaultServiceRole",
        "CreateDate": "2022-08-15T07:46:37+00:00",
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "backup.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                }
            ]
        },
        "Description": "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services",
        "MaxSessionDuration": 3600,
        "RoleLastUsed": {}
    }
}
```

Perform AWS Backup on S3 with access restricted to VPC

Add your answer

Relevant content