AWS Backup - S3 failed: access denied

Question

we've a S3 bucket with policy enabled to permit access to specific IAM user only.
then we create a backup plan to run a daily backup job for this S3 resource.
i added the following statement in our existing bucket policy to allow also the  **AWS default backup role** that was setup in the backup plan's resource selection

"Sid": "Stmt1663835336196",
      "Action": "s3:*",
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::",
        "arn:aws:s3:::/*"
      ],
      "Principal": {
        "AWS": [
          "arn:aws:iam:::role/service-role/AWSBackupDefaultServiceRole"
        ]
 
However, we are getting a failed (access denied) backup job.

hope someone can guide me to verify concern

TIA

Answer

we are using the AWSBackupDefaultServiceRole with the following attached AWS managed policies
- AWSBackupServiceRolePolicyForBackup
- AWSBackupServiceRolePolicyForRestores
- AWSBackupServiceRolePolicyForS3Backup
- AWSBackupServiceRolePolicyForS3Restore

however, still getting a failed backup job with access denied error

Answer

Did you follow this document for creating the roles?  https://docs.aws.amazon.com/aws-backup/latest/devguide/iam-service-roles.html

Answer

my posted concern here is now resolved, I updated the bucket policy and added a statement with the following condition

condition:  ArnLike

Key: aws:SourceArn

Value:  arn:aws:iam::**:role/service-role/AWSBackupDefaultServiceRole

our backup job is now running.

Answer

If my answer helped you, please accept the answer or upvote it.  It will help others that way, too.  Thanks.

Answer

I upload my backups to my S3 bucket regularly and it works just fine.  I think you need the s3:PutObject permission.  I also have other ones, like                 s3:PutObjectAcl, but I'm not sure you need that.  You might want s3:GetObject permissions, too, if you want to download it or read it.  Let me know how it goes.

Answer

There is a way to generate a policy based on Cloud Trail logs.  That might help you.  See this article.  Hope it helps.  https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-generation.html

AWS Backup - S3 failed: access denied

Relevant content