How do I resolve the Access Denied error when I try to create an AWS Backup vault?

Short description

You get an Access Denied error when the AWS Identity and Access Management (IAM) entity that creates the backup vault is missing required AWS Backup or AWS Key Management Service (AWS KMS) permissions. To resolve this error, review and validate your IAM policies, permissions boundaries, service control policies (SCPs), and AWS KMS key policy.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Confirm the required IAM permissions

Check that you have the IAM policies required to create a backup vault.

If you're logged into the AWS Backup console, then confirm the permissions on the logged-in user or role. If you use the AWS CLI or AWS SDK, then check the permissions attached to the configured IAM entity.

If the required permissions are missing, then attach a policy that includes the necessary actions. The following example policy grants the necessary permissions in AWS Backup and AWS KMS to create a vault:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ExampleStmt1",
      "Effect": "Allow",
      "Action": [
        "kms:CreateGrant",
        "kms:DescribeKey",
        "kms:RetireGrant",
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "arn:aws:kms:us-west-2:444455556666:key/1234abcd-12ab-34cd-56ef-1234567890ab"
    },
    {
      "Sid": "ExampleStmt2",
      "Effect": "Allow",
      "Action": [
        "backup:CreateBackupVault"
      ],
      "Resource": "arn:aws:backup:us-west-2:444455556666:backup-vault:*"
    },
    {
      "Sid": "ExampleStmt3",
      "Effect": "Allow",
      "Action": [
        "backup-storage:MountCapsule"
      ],
      "Resource": "*"
    }
  ]
}

Note: The example policy uses a wildcard ( * ) for the backup-storage:MountCapsule action resource. This action doesn't support resource-level permissions, so the wildcard is required. For the AWS KMS and backup:CreateBackupVault actions, restrict the resource Amazon Resource Name (ARN) to the specific key and vault that you need.

The AWS KMS key encrypts the backups stored in your vault.

Resolve backup vault creation failures in AWS Control Tower deployments

You might use AWS Control Tower to deploy backup vaults through AWS CloudFormation StackSets. In this case, the AWSControlTowerExecution role might not have the required backup-storage:MountCapsule or AWS KMS permissions.

The AWSControlTowerExecution role has AdministratorAccess by default. However, the following conditions can restrict its effective permissions and block backup vault creation:

• A permissions boundary applied to the role restricts backup-storage:MountCapsule or AWS KMS actions.
• An SCP attached to the member account's organizational unit (OU) denies backup or AWS KMS actions.
• The AWS KMS key policy doesn't grant the AWSControlTowerExecution role access to the encryption key.

To troubleshoot this issue, complete the following steps:

1. Confirm that the AWSControlTowerExecution role exists in the target member account. If the role is missing, then re-register the OU in AWS Control Tower or manually create the role.
2. Confirm that the role's IAM policy includes backup:CreateBackupVault, backup-storage:MountCapsule, and the required AWS KMS actions.
3. Check for a permissions boundary on the role. If a boundary exists, then confirm that it allows all required backup and AWS KMS actions.
4. Review the SCPs attached to the member account's OU. Confirm that no SCP denies backup:CreateBackupVault, backup-storage:MountCapsule, or AWS KMS actions.
5. Confirm that the key policy grants the AWSControlTowerExecution role access to kms:CreateGrant, kms:DescribeKey, kms:GenerateDataKey, kms:Decrypt, and kms:RetireGrant.
6. Review the CloudFormation StackSet operation history for the specific error message. Open the AWS CloudFormation console, choose StackSets, select your stack set, and review the Operations tab for failed instances. Use the error message to identify the specific permission or policy that blocks vault creation.

Note: If you activated AWS Backup after your initial AWS Control Tower landing zone deployment, then the AWSControlTowerExecution role's effective permissions might not include backup-related actions. Permissions boundaries or SCPs configured in the original setup can block these actions.

Review IAM permissions boundaries

Review the IAM permissions boundaries for the IAM entity that you use to create a backup vault. If the permissions boundary doesn't include the required backup and AWS KMS actions, then update the boundary policy to allow these actions.

Review AWS Organizations SCPs

If you use AWS Organizations, then review your organization's SCPs.

AWS Organizations attaches an AWS managed SCP named FullAWSAccess to every root and OU when it's created. This policy allows all services and actions. Check the SCP policies attached to your account. Look for policies with a Deny effect that block backup:CreateBackupVault, backup-storage:MountCapsule, or AWS KMS actions.

If you find a restrictive SCP, then work with your organization administrator to either remove the Deny statement or add an exception for the IAM entity that creates the backup vault.

Confirm that the AWS KMS key policy grants access to the IAM entity

When you create an AWS KMS key, the key policy begins with a policy statement. This policy statement allows the AWS account to use IAM policies to manage key access. The default key policy statement is critical. Without this statement, IAM policies that allow access to the key have no effect. However, IAM policies that deny access to the key still take effect.

Make sure that the AWS KMS key policy statements don't deny the IAM entity that you use to create the vault. If the key policy denies access, then update the policy to allow the required AWS KMS actions for your IAM entity.

Related information

API permissions: actions, resources, and conditions reference

Backup vault creation and deletion