AWS Backup EKS Integration - Service Role Access Entry Creation Failed

This is a known AWS Backup limitation where the AWSServiceRoleForBackup service-linked role lacks necessary EKS permissions for clusters using API_AND_CONFIG_MAP authentication mode. Since you cannot modify AWS-managed service-linked roles, you have three options:

Create a custom service role for AWS Backup instead of using the service-linked role, giving it the required eks:CreateAccessEntry permission along with your backup policies, then specify this role when configuring the backup plan.

Manually create the access entry yourself before backup runs: use eks:CreateAccessEntry to grant the AWSServiceRoleForBackup role principal ARN access to your cluster with appropriate permissions (typically eks:AccessEntryAdmin or similar).

Temporarily switch authentication modes (if possible) by recreating the cluster or specific node groups with CONFIG_MAP-only mode, though this may not be feasible for existing production clusters.