AWS S3のBackup環境構築

詳細

はじめまして。 私は現在、以下の要件をすべて満たす、S3環境を構築しています。

1. 特定のIPアドレスからしか、アクセスできない
2. 特定のIAMユーザからしか、アクセスできない 上記を満たすS3環境は構築できました。

しかし、AWS Backupサービスを用いて、定期的にBackupを取得する環境が構築できません。 具体的には、バックアッププランにおいてリソースを割り当てる際に、作成したbucketが表示されません。 解決するにあたって試みたことは以下の通りです。

1. IAMポリシーの確認
2. Bucketポリシーの確認
3. リージョンが一致しているかの確認 ※各ポリシーについては、文末に記載します。

理想の状態

「特定のIPアドレスからしか、アクセスできない」 かつ 「特定のIAMユーザからしか、アクセスできない」 を満たし、更に、AWS Backupで定期的にBackupを取得するようにする。

IAMポリシー

「AmazonS3FullAccess」「AWSBackupFullAccess」を割り当てました。 また、以下の.jsonを追加でアタッチしています。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::{bucket_name}",
                "arn:aws:s3:::{bucket_name}/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "backup:*"
            ],
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::{bucket_name}t",
                "arn:aws:s3:::{bucket_name}/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "backup:*"
            ],
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:PutBucketAcl",
                "s3:GetBucketLocation",
                "s3:GetBucketVersioning"
            ],
            "Resource": [
                "arn:aws:s3:::{bucket_name}",
                "arn:aws:s3:::{bucket_name}/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:GetBucketVersioning"
            ],
            "Resource": [
                "arn:aws:s3:::{bucket_name}",
                "arn:aws:s3:::{bucket_name}/*"
            ]
        }
    ]
}

Bucketポリシー

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::{bucket_name}",
                "arn:aws:s3:::{bucket_name}/*"
            ],
            "Condition": {
                "StringNotEquals": {
                    "aws:username": "{created_iam_user_name}"
                }
            }
        },
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::{bucket_name}",
                "arn:aws:s3:::{bucket_name}/*"
            ],
            "Condition": {
                "NotIpAddress": {
                    "aws:VpcSourceIp": [
                        "124.215.101.111/32",
                        "60.112.161.29/32"
                    ]
                }
            }
        }
    ]
}

＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

In English：

Details

I am currently building an S3 environment that meets all of the following requirements.

1. Access is only possible from a specific IP address
2. Access is only possible from a specific IAM user I have built an S3 environment that meets the above requirements.

However, I am unable to build an environment that uses the AWS Backup service to periodically obtain backups. Specifically, when allocating resources in a backup plan, the bucket I created is not displayed. The following are the steps I have tried to resolve the issue.

1. Check the IAM policy
2. Check the bucket policy
3. Check that the region matches *Please check each policies that written above " in English ".

Ideal state

Meet the requirements of "access is only possible from a specific IP address" and "access is only possible from a specific IAM user" and also use AWS Backup to periodically obtain backups.

I am sorry my bad english. Thanks.