AWS Backup账户Terraform创建策略遇AccessDeniedException问题

账号说明 #

• 主账号ID：111111111111
• AWS Backup委派管理员账号ID：000000000000

问题详情 #

已将AWS Organizations管理员权限委派至Backup账户，通过AWS控制台可正常创建、修改AWS Backup策略，但使用该账户内的Terraform用户执行创建操作时，收到错误提示：

AccessDeniedException: You don't have permissions to access this resource.

已在主账号中为Backup账户的root用户及Terraform用户配置了以下IAM策略，请求排查权限问题：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowOrganizationsRead",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::000000000000:user/Terraform",
          "arn:aws:iam::000000000000:root"
        ]
      },
      "Action": [
        "organizations:Describe*",
        "organizations:List*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowBackupPoliciesCreation",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::000000000000:user/Terraform",
          "arn:aws:iam::000000000000:root"
        ]
      },
      "Action": "organizations:CreatePolicy",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "organizations:PolicyType": "BACKUP_POLICY"
        }
      }
    },
    {
      "Sid": "AllowBackupPoliciesModification",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::000000000000:user/Terraform",
          "arn:aws:iam::000000000000:root"
        ]
      },
      "Action": [
        "organizations:DescribePolicy",
        "organizations:UpdatePolicy",
        "organizations:DeletePolicy"
      ],
      "Resource": "arn:aws:organizations::352286888395:policy/*/backup_policy/*",
      "Condition": {
        "StringEquals": {
          "organizations:PolicyType": "BACKUP_POLICY"
        }
      }
    },
    {
      "Sid": "AllowBackupPoliciesAttachmentAndDetachmentToAllAccountsAndOUs",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::000000000000:user/Terraform",
          "arn:aws:iam::000000000000:root"
        ]
      },
      "Action": [
        "organizations:AttachPolicy",
        "organizations:DetachPolicy"
      ],
      "Resource": [
        "arn:aws:organizations::111111111111:root/*",
        "arn:aws:organizations::111111111111:ou/*",
        "arn:aws:organizations::111111111111:account/*",
        "arn:aws:organizations::111111111111:policy/*/backup_policy/*"
      ],
      "Condition": {
        "StringEquals": {
          "organizations:PolicyType": "BACKUP_POLICY"
        }
      }
    }
  ]
}

排查方向 #

• 资源ARN不匹配：AllowBackupPoliciesModification语句中的Resource ARN使用了错误的账号ID（352286888395），需替换为主账号ID111111111111，否则修改策略时会触发权限拒绝。
• Terraform额外权限需求：控制台操作可能自动处理隐式权限，但Terraform会调用更多细粒度API，需确认是否缺少organizations:TagResource等Terraform执行时可能触发的操作权限。
• 委派权限完整性：检查主账号是否完成EnableAWSServiceAccess（针对backup.amazonaws.com）和RegisterDelegatedAdministrator的正确配置，确保Backup账户的委派权限覆盖Backup策略全生命周期管理。
• 策略应用方式：跨账户IAM策略需要正确配置信任关系，若该策略是主账号的IAM策略，需确认Backup账户的Terraform用户是否通过角色信任获取权限；更推荐的方式是在Backup账户的Terraform用户上直接附加针对Organizations的权限策略（需主账号SCP允许该操作）。
• 身份验证正确性：确认Terraform使用的是Backup账户内Terraform用户的凭证，避免因使用主账号或其他账户凭证导致身份不符。

内容的提问来源于stack exchange，提问作者Math