How do I resolve "insufficient privileges" and "access denied" errors when I use AWS Backup to perform an Amazon EFS restore?

Resolution

Confirm that your IAM identity has the required permissions

Check the policy of the AWS Identity and Access Management (IAM) role that creates the restore job to confirm that it has the backup:StartRestoreJob action.

If you turned on encryption, then make sure that your IAM policy or AWS Key Management Service (AWS KMS) key policy has the following actions:

• "kms:DescribeKey"
• "kms:GenerateDataKeyWithoutPlaintext"
• "kms:CreateGrant"

Confirm that you included the required Amazon EFS actions

The IAM policy that's attached to the IAM role that's in the restore request must include the following Amazon EFS actions:

• "elasticfilesystem:Restore"
• "elasticfilesystem:CreateFilesystem"
• "elasticfilesystem:DescribeFilesystems"
• "elasticfilesystem:DeleteFilesystem"

Remove Deny statements

Remove Deny statements for the backup:StartRestoreJob action in the vault access policy. For example, the following access policy for the default Amazon EFS aws/efs/automatic-backup-vault vault denies the backup:StartRestoreJob action:

{  
    "Version": "2012-10-17",  
    "Statement": [{  
        "Effect": "Deny",  
        "Principal": {  
            "AWS": "*"  
        },  
        "Action": [  
            "backup:DeleteBackupVault",  
            "backup:DeleteBackupVaultAccessPolicy",  
            "backup:DeleteRecoveryPoint",  
            "backup:StartCopyJob",  
            "backup:StartRestoreJob",  
            "backup:UpdateRecoveryPointLifecycle"  
        ],  
        "Resource": "*"  
    }]  
}

Also, remove Deny statements from your IAM policies and AWS Organizations service control policies (SCPs) that deny required actions for the following services:

• AWS Backup
• Amazon EFS
• AWS KMS