Troubleshooting failures due to missing Amazon IAM permissions
If the AWS credential provided in NetBackup cloud configuration does not have S3 or Glacier related permission, you could see failures or errors at various stages of configuration, backup, and restore.
Some error messages are clearly described and identifiable in the NetBackup Administrator console, while others are vague.
Amazon displays the AccessDeniedException error message. To decipher this error message, you need to check the log files to check for the missing permission.
List Vault or List Bucket permission (
glacier:ListVaults) missing.The following error is displayed:
This error occurs while creating a storage server. If you are using the CLI, tpcommand to add credential fails.
Check the
tpcommandlogs for AccessDeniedException, for example,amazon: Json: {"code":"","type":"Client","message":"User: arn:aws:iam::326221795898:user/Readonly_user is not authorized to perform: glacier:ListVaults on resource: arn:aws:glacier:ap-south-1:326221795898:vaults/"} 16:17:52.139 [7388.4424] <2> magmavm1.abc.xyz.qwe.com: AmzVaultApi: json_string({"code":"AccessDeniedException","type":"Client","message":"User: arn:aws:iam::326221795898:user/Readonly_user is not authorized to perform: glacier:ListVaults on resource: arn:aws:glacier:ap-south-1:326221795898:vaults/"}) 16:17:52.139 [7388.4424] <16> magmavm1.abc.xyz.qwe.com:
Create Vault or Create Bucket permission (glacier:CreateVault or glacier:DescribeVault) missing.
The following error is displayed:
This error occurs while creating a disk pool using the NetBackup Administrator console. If you are using the CLI, nbdevconfig command fails.
Check the
nbrrmslog for AccessDeniedException, for example,amazon_raw:: AmzVaultApi: Error: server error code , User: arn:aws:iam::326221795898:user/Readonly_user is not authorized to perform: glacier:CreateVault on resource: arn:aws:glacier:ap-south-1:326221795898:vaults/fail-to-create, httpcode [403] returning [2060037],11:STS Service,1Post Archive or S3 Object permission missing - backup will fail in activity monitor.
Upload archives permission (glacier:UploadArchive) missing.
The following error is displayed:
This error occurs while backing up archives. The backup jobs fail with permission error.
Check the
bptmlog for details, for example,"code":"","type":"Client","message":"User: arn:aws:iam::3234415151:user/XYZ is not authorized to perform: glacier:UploadArchive on resource: LSTR-gtwy-00076(debug).
Retrieve job after archive permission (glacier:InitiateJob) missing.
The following error is displayed:
This errors occurs after you start a restore.
Check the
bptmlog for details, for example,"code":"","type":"Client","message":"User: arn:aws:iam::3234415151:user/XYZ is not authorized to perform: glacier:InitiateJob on resource: LSTR-gtwy-00076(debug).
Retrieve Archive or retrieve Object permission missing (glacier:GetJobOutput) missing.
The following error is displayed:
This missing permission causes the restore job to be in incomplete state if NetBackup cannot download archives after posting jobs.
Check the
bptmlog for details, for example,"code":"","type":"Client","message":"User: arn:aws:iam::3234415151:user/XYZ is not authorized to perform: glacier:GetJobOutput on resource: LSTR-gtwy-00076(debug).
Delete Archive or Delete Object permission (glacier:DeleteArchive) missing.
The following error is displayed:
This missing permission causes the image cleanup or image expiry process to fail.
Check the
bpdmlog for details, for example,"code":"","type":"Client","message":"User: arn:aws:iam::3234415151:user/XYZ is not authorized to perform: glacier:DeleteArchive on resource: LSTR-gtwy-00076(debug).
