跨账号AWS Backup复制与恢复因权限不足失败求助

问题描述 #

在源账号A的备份库X中存储DynamoDB表的AWS Backup恢复点，尝试从目标账号B发起复制任务到备份库Y时，触发以下403错误：

software.amazon.awssdk.services.backup.model.BackupException: Insufficient privileges to perform this action. (Service: Backup, Status Code: 403)

已配置的策略：

• 源账号A备份库X的访问策略：允许账号B root执行backup:CopyFromBackupVault
• 目标账号B备份库Y的访问策略：允许账号A root和账号B root执行backup:CopyIntoBackupVault

核心问题分析 #

当前策略存在两个关键缺陷：

1. 权限主体不匹配：使用账号root作为Principal，但实际执行复制操作的是账号B中的IAM角色/用户，而非root账号。直接使用root作为权限主体不符合AWS最佳实践，且可能导致权限评估不匹配。
2. 资源范围与权限不全：
   • 源备份库策略仅授权backup:CopyFromBackupVault，但复制操作还需要读取恢复点元数据的backup:DescribeRecoveryPoint权限
   • 资源使用*过于宽泛，未明确指向具体的恢复点或备份库，可能触发AWS权限评估的严格校验

修正后的策略配置 #

1. 源账号A - 备份库X访问策略 #

将Principal替换为账号B中执行复制任务的IAM角色ARN，并补充必要权限：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::account_B_id:role/your-copy-execution-role"
      },
      "Action": [
        "backup:CopyFromBackupVault",
        "backup:DescribeRecoveryPoint"
      ],
      "Resource": [
        "arn:aws:backup:region:account_A_id:recovery-point:your-recovery-point-id",
        "arn:aws:backup:region:account_A_id:backup-vault:X"
      ]
    }
  ]
}

2. 目标账号B - 备份库Y访问策略 #

确保授权账号B的执行角色能写入备份库，同时保留源账号的必要权限：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::account_A_id:root",
          "arn:aws:iam::account_B_id:role/your-copy-execution-role"
        ]
      },
      "Action": [
        "backup:CopyIntoBackupVault",
        "backup:PutBackupVaultAccessPolicy"
      ],
      "Resource": "arn:aws:backup:region:account_B_id:backup-vault:Y"
    }
  ]
}

3. 账号B执行复制的IAM角色权限 #

确认角色已附加以下权限策略（补充可能缺失的权限）：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "backup:CopyBackup",
        "backup:DescribeRecoveryPoint",
        "backup:ListRecoveryPointsByBackupVault"
      ],
      "Resource": [
        "arn:aws:backup:region:account_A_id:recovery-point:*",
        "arn:aws:backup:region:account_A_id:backup-vault:X"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "backup:CopyIntoBackupVault",
        "backup:DescribeBackupVault"
      ],
      "Resource": "arn:aws:backup:region:account_B_id:backup-vault:Y"
    }
  ]
}

额外验证步骤 #

• 确认恢复点处于可用状态（未被删除或处于创建中）
• 检查AWS区域一致性：源备份库、目标备份库和执行操作的区域必须完全一致
• 使用AWS IAM Access Analyzer检查策略是否存在权限配置错误或冲突

内容的提问来源于stack exchange，提问作者Shivansh Kaldaik