How do I troubleshoot the “not authorized to perform this operation" error in AWS Backup when I restore an Amazon EC2 instance?

Resolution

You receive an authorization error in the following scenarios:

• The original Amazon EC2 instance has an instance profile attached to it.
• The restore role doesn't have the iam:PassRole permission.
• You restored the instance from the original AWS Identity and Access Management (IAM) role in the AWS Backup console.

Run the restore job in the AWS Backup console

Complete the following steps:

1. Open the AWS Backup console.
2. In the navigation pane, choose Protected resources, and then choose the ID of your instance.
3. In the Recovery points section, select the ID of the recovery point that you want to restore, and then choose Restore.
4. In the Network settings section, for Instance IAM role, choose one of the following options:
   Choose Proceed with no IAM role to restore the instance without an instance profile. After the restore completes, attach the instance profile to the restored instance.
   Choose Restore with original IAM role to restore the instance with the original instance profile. For Restore role, choose either the default role AWSBackupDefaultServiceRole or a customer managed role that includes the iam:PassRole permission.
5. Configure the rest of your settings, and then choose Restore backup.

Verify the iam:PassRole permission on your restore role

When you first use the AWS Backup console, AWS Backup automatically creates AWSBackupDefaultServiceRole with the attached managed policies AWSBackupServiceRolePolicyForBackup and AWSBackupServiceRolePolicyForRestores. These policies include the iam:PassRole permission. If the AWSBackupServiceRolePolicyForRestores managed policy is no longer attached to the role, then reattach the policy or manually add the iam:PassRole permission.

Important: If you use the original instance profile, then you must grant AWS Backup the iam:PassRole permission. The resource Amazon Resource Name (ARN) is the ARN of the IAM role associated with the instance profile. The role isn't the AWS Backup service role, but rather the IAM role that provides permissions to applications running on the instance.

Add the iam:PassRole permission to your restore role

Note: If you don't know what role you used for the restore, then you must decode the authorization error message.

Complete the following steps:

1. Open the IAM console.
2. In the navigation pane, choose Roles.
3. In the search box, enter the name of your restore role and then choose it from the results list.
4. Choose the Permissions tab.
5. Choose Add permissions, then choose Create inline policy.
6. Choose the JSON tab.
7. In the policy editor, enter the following policy:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "iam:PassRole",
               "Resource": "arn:aws:iam::111122223333:role/role-name"
           }
       ]
   }

   Note: Replace 111122223333 with your AWS account ID and role-name with the name of the instance profile role that you will attach to the restored instance.
8. Choose Next.
9. For Policy name, enter a name for the policy.
10. Choose Create policy.

Run the restore job again.

Related information

Access control

Restore an Amazon EC2 instance

How do I resolve the IAM user error "not authorized to perform iam:PassRole"?