# AWS EFS Backup and Restore: Step-by-Step Guide & Best Practices

**Scenario:** We encountered an issue while attempting to restore an EFS backup using AWS Backup.

`User: arn:aws:sts::123456789012:`[`assumed-role/devops/dummy.com`](mailto:assumed-role/DevopsACC-TTN-devops/divya.mohan@seclore.com) `is not authorized to perform: backup:StartRestoreJob on resource: arn:aws:backup:ap-south-1:123456789012:recovery-point:f73af96d-5b4b-4f3c-b01d-24f0036c56ec with an explicit deny in a resource-based policy`

**Explanation:** By default, when an Elastic File System (EFS) is created, **automatic backups** are enabled. As part of this process, AWS Backup automatically generates a backup policy and creates backup vaults. These backup vaults include a **resource-based policy** with an explicit deny rule. Below is an example of the default deny policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "backup:DeleteBackupVault",
        "backup:DeleteBackupVaultAccessPolicy",
        "backup:DeleteRecoveryPoint",
        "backup:StartCopyJob",
        "backup:StartRestoreJob",
        "backup:UpdateRecoveryPointLifecycle"
      ],
      "Resource": "*"
    }
  ]
}
```

**Resolution Steps:** To restore a backup successfully, you need to modify the resource-based policy associated with the backup vault and remove the explicit deny for the `backup:StartRestoreJob` action. Follow the steps below:

1. **Identify the Backup Vault:**
    
    * Navigate to the AWS Backup Console.
        
    * Locate the backup vault associated with the recovery point mentioned in the error.
        
2. **Modify the Policy:**
    
    * Open the backup vault’s resource-based policy.
        
    * Remove the `backup:StartRestoreJob` action from the `"Action"` array in the deny statement.
        
    
    Example modified policy:
    
    ```json
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Deny",
          "Principal": {
            "AWS": "*"
          },
          "Action": [
            "backup:DeleteBackupVault",
            "backup:DeleteBackupVaultAccessPolicy",
            "backup:DeleteRecoveryPoint",
            "backup:StartCopyJob",
            "backup:UpdateRecoveryPointLifecycle"
          ],
          "Resource": "*"
        }
      ]
    }
    ```
    
    1. **Save and Apply Changes:**
        
        * Save the updated policy.
            
        * Ensure the changes are applied to the backup vault.
            
    2. **Restore the Backup:**
        
        * Retry the restore operation using the AWS Backup Console or CLI.
            
    
    **Reference Documentation:** For more details on restoring EFS file systems, refer to the official AWS documentation:
    
    \[1\] [Restore an Amazon EFS File System](https://docs.aws.amazon.com/aws-backup/latest/devguide/restoring-efs.html#:~:text=By%20default%2C%20Amazon%20EFS%20creates,keep%20this%20auto%2Dbackup%20active.)