AWS aws-backup medium security documentation change
Summary
Added a new section 'Considerations for security auto-remediation' and a troubleshooting entry for EC2 AMI copy job failures due to auto-remediation logic interfering with AWS Backup operations.
Security assessment
The change documents a specific operational issue where security auto-remediation tools (e.g., EventBridge rules with Lambda) can inadvertently revoke temporary permissions granted by AWS Backup during copy jobs, causing failures. This addresses a security configuration conflict that can impact backup integrity and availability, providing explicit guidance to exclude backup.amazonaws.com events.
Diff
diff --git a/aws-backup/latest/devguide/logicallyairgappedvault.md b/aws-backup/latest/devguide/logicallyairgappedvault.md index e3f23eb67..cb1a1f923 100644 --- a//aws-backup/latest/devguide/logicallyairgappedvault.md +++ b//aws-backup/latest/devguide/logicallyairgappedvault.md @@ -5 +5 @@ -Overview of logically air-gapped vaultsUse case for logically air-gapped vaultsCompare and contrast with a standard backup vaultCreate a logically air-gapped vaultView logically air-gapped vault detailsCreating backups in a logically air-gapped vaultShare a logically air-gapped vaultRestore a backup from a logically air-gapped vaultDelete a logically air-gapped vaultAdditional programmatic options for logically air-gapped vaultsUnderstanding encryption key types for logically air-gapped vaultsUsage of service-owned keyTroubleshoot a logically air-gapped vault issue +Overview of logically air-gapped vaultsUse case for logically air-gapped vaultsCompare and contrast with a standard backup vaultCreate a logically air-gapped vaultView logically air-gapped vault detailsCreating backups in a logically air-gapped vaultShare a logically air-gapped vaultRestore a backup from a logically air-gapped vaultDelete a logically air-gapped vaultAdditional programmatic options for logically air-gapped vaultsUnderstanding encryption key types for logically air-gapped vaultsUsage of service-owned keyConsiderations for security auto-remediationTroubleshoot a logically air-gapped vault issue @@ -48,0 +49,2 @@ See [Feature availability by resource](./backup-feature-availability.html#featur + * Considerations for security auto-remediation + @@ -814,0 +817,25 @@ Visit the [AWS KMS documentation](https://docs.aws.amazon.com/kms/latest/develop +## Considerations for security auto-remediation + +When AWS Backup copies an EC2 (AMI) backup to a logically air-gapped vault, it temporarily grants `launchPermission` (on the AMI) and `createVolumePermission` (on associated EBS snapshots) to a service-owned account. These permissions are automatically revoked after the copy completes. + +These operations generate `ModifyImageAttribute` and `ModifySnapshotAttribute` events in your AWS CloudTrail logs, with `userIdentity.invokedBy` set to `backup.amazonaws.com`. + +If you have security auto-remediation logic (e.g., Amazon EventBridge rules with AWS Lambda) that monitors these events and revokes cross-account sharing, you must exclude events where `userIdentity.invokedBy` is `backup.amazonaws.com`. Otherwise, copy jobs to logically air-gapped vaults will fail with: "You do not have permission to access the storage of this ami." + +This exclusion is safe because the copy is authorized by your vault access policies (`backup:CopyFromBackupVault` on the source vault and `backup:CopyIntoBackupVault` on the destination vault), which are evaluated before any EC2 attribute modifications occur. The temporary permissions are granted only to a fixed AWS service-owned account and are automatically revoked after the copy completes. + +Example EventBridge rule event pattern that excludes AWS Backup operations: + + + { + "source": ["aws.ec2"], + "detail-type": ["AWS API Call via CloudTrail"], + "detail": { + "eventSource": ["ec2.amazonaws.com"], + "eventName": ["ModifySnapshotAttribute", "ModifyImageAttribute"], + "userIdentity": { + "invokedBy": [{"anything-but": "backup.amazonaws.com"}] + } + } + } + @@ -818,0 +846,12 @@ If you encounter errors during your workflow, consult the following example erro +### `EC2 AMI copy job to logically air-gapped vault fails with permission error` + +**Error:** `Copy job fails with "You do not have permission to access the storage of this ami."` + +**Possible cause:** During an EC2 AMI copy job to a logically air-gapped vault, AWS Backup temporarily grants launch permission (AMI) and create volume permission (EBS snapshot) to a service-owned account, generating `ModifyImageAttribute` and `ModifySnapshotAttribute` events in your AWS CloudTrail logs. If you have security auto-remediation logic (such as EventBridge rules with Lambda) that monitors these events and automatically revokes cross-account sharing permissions, it can remove the temporary access before the copy completes. + +###### Note + +This can similarly happen for copy jobs for other resources like Amazon FSx. + +**Resolution:** Update your EventBridge rule event pattern to exclude operations performed by AWS Backup. Specifically, exclude events where `userIdentity.invokedBy` is `backup.amazonaws.com` to ensure your auto-remediation logic does not revoke the temporary cross-account permissions that AWS Backup grants during the copy process. +