AWS EFS Backup and Restore: Step-by-Step Guide & Best Practices

Search for a command to run...

No comments yet. Be the first to comment.
The Ops Fix Hub is a dynamic series designed to tackle real-world challenges in the DevOps and CloudOps domains. "Breaking Down Barriers, One Ops Fix at a Time."
Problem Statement I'm encountering an error while running Performance Insights CLI commands or making API calls via Python. My account has the AdministratorAccess AWS-managed policy, and I can successfully execute CLI commands and API calls for other...
This migration was performed on a production workload where cost reduction was prioritized over zone-level high availability.

1. Overview What I Designed I designed a hybrid infrastructure architecture: Terraform → Foundation Layer Crossplane → Dynamic Lifecycle Layer ArgoCD → GitOps Enforcement This created a continuou

Cross-cloud VM migration is not a disk copy task. It is: An access model transformation A replication lifecycle management exercise A downtime control operation A cost boundary decision We execu

When AWS introduced AWS DevOps Agent, I was less interested in feature lists and more interested in one practical question. Can it actually reduce investigation time during real production-style failu

Migrating object storage across cloud providers is not a copy task.It is a cost, network, and security boundary problem. We migrated 10+ TB of object data from Google Cloud Storage to Amazon S3 under

Scenario: We encountered an issue while attempting to restore an EFS backup using AWS Backup.
User: arn:aws:sts::123456789012:assumed-role/devops/dummy.com is not authorized to perform: backup:StartRestoreJob on resource: arn:aws:backup:ap-south-1:123456789012:recovery-point:f73af96d-5b4b-4f3c-b01d-24f0036c56ec with an explicit deny in a resource-based policy
Explanation: By default, when an Elastic File System (EFS) is created, automatic backups are enabled. As part of this process, AWS Backup automatically generates a backup policy and creates backup vaults. These backup vaults include a resource-based policy with an explicit deny rule. Below is an example of the default deny policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Action": [
"backup:DeleteBackupVault",
"backup:DeleteBackupVaultAccessPolicy",
"backup:DeleteRecoveryPoint",
"backup:StartCopyJob",
"backup:StartRestoreJob",
"backup:UpdateRecoveryPointLifecycle"
],
"Resource": "*"
}
]
}
Resolution Steps: To restore a backup successfully, you need to modify the resource-based policy associated with the backup vault and remove the explicit deny for the backup:StartRestoreJob action. Follow the steps below:
Identify the Backup Vault:
Navigate to the AWS Backup Console.
Locate the backup vault associated with the recovery point mentioned in the error.
Modify the Policy:
Open the backup vault’s resource-based policy.
Remove the backup:StartRestoreJob action from the "Action" array in the deny statement.
Example modified policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Action": [
"backup:DeleteBackupVault",
"backup:DeleteBackupVaultAccessPolicy",
"backup:DeleteRecoveryPoint",
"backup:StartCopyJob",
"backup:UpdateRecoveryPointLifecycle"
],
"Resource": "*"
}
]
}
Save and Apply Changes:
Save the updated policy.
Ensure the changes are applied to the backup vault.
Restore the Backup:
Reference Documentation: For more details on restoring EFS file systems, refer to the official AWS documentation: