来自 S3 访问的 AWS 备份被拒绝

Question

I am trying to setup a simple on-demand backup of an s3 bucket in AWS and anything I try I always get an access denied. See screenshot:

I have tried create a new bucket which is completely public, I've tried setting the access policy on the Vault, I've tried in different regions, all have the same result. Access Denied!

The messaging doesn't advise anything other than Access Denied, really helpful!

Can anyone give me some insight into what this message is referring to and more over how I can resolve this issue.

Answer 1

For aws backup, you need to set up a service role. Traditionally you need 2 policies attached.

[AWSBackupServiceRolePolicyForBackup] 
[AWSBackupServiceRolePolicyForRestore]

For S3, it seems there is a separate policy that you need to attach to your service role.

[AWSBackupServiceRolePolicyForS3Backup]
[AWSBackupServiceRolePolicyForS3Restore]

Answer 2

Just putting this here for those who will be looking for this answer.

To solve this problem for AWS CDK (javascript/typescript) you can use the following examples:

https://github.com/SimonJang/blog-aws-backup-s3/blob/68a05f8cb443411a23f02aa0c188adfe15bab0ff/infrastructure/lib/infrastructure-stack.ts#L63-L200

or this:

https://github.com/finnishtransportagency/hassu/blob/8adc0bea3193ff016a9aaa6abe0411292714bbb8/deployment/lib/hassu-database.ts#L230-L312