Aws cross-account backup copy and restoration failing due to insufficient privileges

Question

I am creating backups of my DynamoDB tables using AWS Backup in my source account A and storing the recovery point ARNs in a vault named X in source account A .

I need to copy and restore the backup in another account named B. I am following the steps below, but my process is failing with the error:

software.amazon.awssdk.services.backup.model.BackupException: Insufficient privileges to perform this action. (Service: Backup, Status Code: 403)

Steps to recreate:

Create backup and store the backup in vault X in account A.
Give permission to target account B to perform action "CopyFromBackupVault" using the vault access policy for vault X of source account.

         {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::account_B_id:root"
          },
          "Action": "backup:CopyFromBackupVault",
          "Resource": "*"
        }
      ]

Give permission to source account A to perform action "CopyIntoBackupVault" using the vault access policy for vault Y of target account.

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": ["arn:aws:iam::account_A_id:root",
                    "arn:aws:iam::account_B_id:root"]
          },
          "Action": "backup:CopyIntoBackupVault",
          "Resource": "*"
        }
      ]
    }

After these steps from target account B, I am initiating the copy job but it is failing with error with error > software.amazon.awssdk.services.backup.model.BackupException: Insufficient privileges to perform this action. (Service: Backup, Status Code: 403).
Restore backup (Not able to reach this step)

Please note, the role I am using has all the permissions required to perform backup actions. I reckon the issue lies in the vault access policies . Please help. Thank you!

I have tried every step mentioned in the AWS documentation that I could find. I have checked with ChatGPT but nothing resolved my issue.

I am expecting my backup to be copied and then restored without any issue.

And in the destination account, you enabled vaults from other accounts? — Leeroy Hannigan
– Leeroy Hannigan, Commented May 6 at 19:35
Sorry, i did not understand, what do you mean by enable vaults from other accounts?? — Shivansh Kaldaik
– Shivansh Kaldaik, Commented May 6 at 19:45
Leeroy one more thing I would like to mention I am doing all the steps using java code not via aws console or cli. This info might not be very relevant but still thought of sharing. — Shivansh Kaldaik
– Shivansh Kaldaik, Commented May 6 at 19:48

PeskyPotato · Accepted Answer · 2025-05-08 07:20:41Z

0

Creating a cross-account copy of a recovery point from AWS Backup requires the correct access policies on both source and destination vault, correct IAM role with policies that allows to create a copy job and cross-account backup to be enabled within the Organization's management account.

From the details provided in the comments, you seem to have everything except enabling cross-account backup within the AWS Organization. This can be done from the Management Account, within the AWS Backup console under My account and Settings.

Lastly, two final points to check, the destination vault cannot be the default vault of the account and the copy job must be started from the source account.

edited May 8 at 7:20

answered May 7 at 12:42

PeskyPotato

96110 silver badges28 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Shivansh Kaldaik May 7 at 19:30

Hello and thank you ! Yes there were two issues actually . 1.) I didn't enable cross account backup within AWS organization . I have done this now they way you described. 2.) I was initiating my copy job from target account but it should be initiated from source account.

PeskyPotato May 8 at 7:23

@ShivanshKaldaik Glad to see you have solved the problem, and thank you for letting me know about the source account restriction. I forgot to mention that in my comment, so I've edit it with that detail for completeness.

Collectives™ on Stack Overflow

Aws cross-account backup copy and restoration failing due to insufficient privileges

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related