Unable to delete aws/efs/automatic-backup-vault

Question

I am currently logged in as the root user. I am trying to delete the following EFS backup vault:

aws/efs/automatic-backup-vault

When I do I receive the following error:

Insufficient privileges to perform this action. Please consult with the account administrator for necessary permissions.

When I try and go to the policies to give myself the ability to do this, enter the following policy:

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Principal": "*",
        "Action": "*",
        "Resource": "*"
    }]
}

The json enter shares the following error:

This policy JSON contains 3 errors that require attention starting on line 7 See the individual validation errors in the JSON editor for more information.

Additionally, I used AWS-Nuke to try and clear everything out, and this little bit of configuration remained. Previously I was getting:

The specified policy cannot be added to the vault due to cross-account sharing restrictions. Amend the policy or the vault's settings, then retry request.

I am unsure of what to do next or if the second error is still relevant here as the JSON is being denied. I also was having an error around Thanks!

Rafael · Accepted Answer · 2023-09-20 13:41:16Z

5

You need to Fix the Policy in Backup Vault in two steps. 1 - Change the AWS Principal: "*" to "arn:aws:iam::[AWSAccountID]:root" 2 - After that, you can change the policy: Deny to Allow.

Is this a necessary because you can't change the effect with single account actions with a principal "*".

answered Sep 20, 2023 at 13:41

Rafael

511 bronze badge

Sign up to request clarification or add additional context in comments.

2 Comments

milan Over a year ago

does this work for someone?

bwl1289 Dec 20, 2024 at 0:52

yes, this works.

alex · Accepted Answer · 2024-01-05 18:52:12Z

1

I also struggled with deleting this vault; AWS would not let me change the backup vault access policy according to this answer.

Note that aws/efs/automatic-backup-vault is an AWS-managed backup vault that gets created automatically when you toggle Automatic backups: Enabled on a given EFS file system.

To disable these backups themselves, take a look at the recovery points present in this vault to determine which EFS file systems are targeted (it should be all EFS file systems with the aws:elasticfilesystem:default-backup: enabled tag) and modify those EFS file systems to disable Automatic backup.

answered Jan 5, 2024 at 18:52

alex

7,59812 gold badges62 silver badges116 bronze badges

3 Comments

milan Over a year ago

fyi i can change the access policy but still cannot delete the vault

alex Over a year ago

@milan Do you have any EFS file systems with the aws:elasticfilesystem:default-backup: enabled tag, or that are otherwise configured to automatically back up? Are you getting any particular errors?

milan Over a year ago

nope, zero EFS instances atm. I had them some years ago and AWS probably created these vaults then. Now I cant remove them.

Collectives™ on Stack Overflow

Unable to delete aws/efs/automatic-backup-vault

2 Answers 2

2 Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related