By using AWS re:Post, you agree to the Terms of Use

AWS Backup - S3 failed: access denied

0

we've a S3 bucket with policy enabled to permit access to specific IAM user only. then we create a backup plan to run a daily backup job for this S3 resource. i added the following statement in our existing bucket policy to allow also the AWS default backup role that was setup in the backup plan's resource selection

   "Sid": "Stmt1663835336196",
  "Action": "s3:*",
  "Effect": "Allow",
  "Resource": [
    "arn:aws:s3:::<BucketName>",
    "arn:aws:s3:::<Bucketname>/*"
  ],
  "Principal": {
    "AWS": [
      "arn:aws:iam::<AccountNumber>:role/service-role/AWSBackupDefaultServiceRole"
    ]

However, we are getting a failed (access denied) backup job.

hope someone can guide me to verify concern

TIA

asked 15 days ago54 views
6 Answers
0

I upload my backups to my S3 bucket regularly and it works just fine. I think you need the s3:PutObject permission. I also have other ones, like s3:PutObjectAcl, but I'm not sure you need that. You might want s3:GetObject permissions, too, if you want to download it or read it. Let me know how it goes.

answered 15 days ago
  • If this answer helped you, please accept my answer or upvote it. It will help others know it worked that way.

  • Hi, thank you for you reply.. we don't have issue reading & writing files / object to S3 from our application. the problem is, we intend to create a regular backup job for that particular bucket using AWS Backup Service however the AWS Backup Service job fails and getting access denied due to S3 bucket policy. we tried to follow this documentation, and add the RoleID of the default backup role but to no avail https://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/

0

Did you follow this document for creating the roles? https://docs.aws.amazon.com/aws-backup/latest/devguide/iam-service-roles.html

answered 8 days ago
  • Thanks for your reply Sir I believe the AWSBackupDefaultServiceRole is automatically created when we make a backup plan and choose the default role.

0

If my answer helped you, please accept the answer or upvote it. It will help others that way, too. Thanks.

answered 14 days ago
0

There is a way to generate a policy based on Cloud Trail logs. That might help you. See this article. Hope it helps. https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-generation.html

answered 13 days ago
0

we are using the AWSBackupDefaultServiceRole with the following attached AWS managed policies

  • AWSBackupServiceRolePolicyForBackup
  • AWSBackupServiceRolePolicyForRestores
  • AWSBackupServiceRolePolicyForS3Backup
  • AWSBackupServiceRolePolicyForS3Restore

however, still getting a failed backup job with access denied error

answered 9 days ago
0

my posted concern here is now resolved, I updated the bucket policy and added a statement with the following condition

condition: ArnLike

Key: aws:SourceArn

Value: arn:aws:iam::<Account Number>:role/service-role/AWSBackupDefaultServiceRole

our backup job is now running.

answered 7 days ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions