AWS Backup - S3 failed: access denied


we've a S3 bucket with policy enabled to permit access to specific IAM user only. then we create a backup plan to run a daily backup job for this S3 resource. i added the following statement in our existing bucket policy to allow also the AWS default backup role that was setup in the backup plan's resource selection

   "Sid": "Stmt1663835336196",
  "Action": "s3:*",
  "Effect": "Allow",
  "Resource": [
  "Principal": {
    "AWS": [

However, we are getting a failed (access denied) backup job.

hope someone can guide me to verify concern


asked 2 years ago1572 views
6 Answers

we are using the AWSBackupDefaultServiceRole with the following attached AWS managed policies

  • AWSBackupServiceRolePolicyForBackup
  • AWSBackupServiceRolePolicyForRestores
  • AWSBackupServiceRolePolicyForS3Backup
  • AWSBackupServiceRolePolicyForS3Restore

however, still getting a failed backup job with access denied error

answered 2 years ago

I upload my backups to my S3 bucket regularly and it works just fine. I think you need the s3:PutObject permission. I also have other ones, like s3:PutObjectAcl, but I'm not sure you need that. You might want s3:GetObject permissions, too, if you want to download it or read it. Let me know how it goes.

answered 2 years ago
  • If this answer helped you, please accept my answer or upvote it. It will help others know it worked that way.

  • Hi, thank you for you reply.. we don't have issue reading & writing files / object to S3 from our application. the problem is, we intend to create a regular backup job for that particular bucket using AWS Backup Service however the AWS Backup Service job fails and getting access denied due to S3 bucket policy. we tried to follow this documentation, and add the RoleID of the default backup role but to no avail


Did you follow this document for creating the roles?

answered 2 years ago
  • Thanks for your reply Sir I believe the AWSBackupDefaultServiceRole is automatically created when we make a backup plan and choose the default role.


If my answer helped you, please accept the answer or upvote it. It will help others that way, too. Thanks.

answered 2 years ago

There is a way to generate a policy based on Cloud Trail logs. That might help you. See this article. Hope it helps.

answered 2 years ago

my posted concern here is now resolved, I updated the bucket policy and added a statement with the following condition

condition: ArnLike

Key: aws:SourceArn

Value: arn:aws:iam::<Account Number>:role/service-role/AWSBackupDefaultServiceRole

our backup job is now running.

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions