Logically air-gapped vault

Overview of logically air-gapped vaults

AWS Backup offers a secondary type of vault which can store backups in a container with additional security features. A logically air-gapped vault is a specialized vault which provides increased security beyond a standard backup vault, as well as the ability to share vault access to other accounts so that recovery time objectives (RTOs) can be faster and more flexible in case of an incident that requires rapid restoration of resources.

Logically air-gapped vaults come equipped with additional protection features; each vault is encrypted with either an AWS owned key (default) or optionally with a customer-managed KMS key, and each vault is equipped with AWS Backup Vault Lock's compliance mode. The encryption key type information is visible through AWS Backup APIs and console for transparency and compliance reporting.

You can integrate your logically air-gapped vaults with Multi-party approval (MPA) to enable recovery of backups in the vaults even if the vault-owning account is inaccessible, which helps to maintain business continuity. Further more, you can choose to integrate with AWS Resource Access Manager (RAM) to share a logically air-gapped vault with other AWS accounts (including accounts in other organizations) so that the backups stored within the vault can be restored from an account with which the vault is shared, if needed for data loss recovery or restore testing. As part of this added security, a logically air-gapped vault stores its backups in an AWS Backup service owned account (which results in backups shown as shared outside your organization in modify attribute items in AWS CloudTrail logs).

For greater resiliency, we recommend creating cross-Region copies in logically air-gapped vaults in same or separate accounts. However, if you want to reduce storage costs by maintaining just a single copy, you can use Primary backups to logically air-gapped vaults, after onboarding to AWS MPA.

You can view the storage pricing for backups of supported services in a logically air-gapped vault on the AWS Backup pricing page.

See Feature availability by resource for resource types you can copy to a logically air-gapped vault.

Use case for logically air-gapped vaults

A logically air-gapped vault is a secondary vault that serves as part of a data protection strategy. This vault can help enhance your organization's retention strategy and recovery when you desire a vault for your backups that

Considerations and limitations

Compare and contrast with a standard backup vault

A backup vault is the primary and standard type of vault used in AWS Backup. Each backup is stored in a backup vault when the backup is created. You can assign resource-based policies to manage backups stored in the vault, such as the lifecycle of backups stored within the vault.

A logically air-gapped vault is a specialized vault with additional security and flexible sharing for faster recovery time (RTO). This vault stores primary backups or copies of backups that were initially created and stored within a standard backup vault.

Backup vaults are encrypted with a key, a security mechanism that limits access to intended users. These keys can be customer managed or AWS managed. See Copy encryption for encryption behavior during copy jobs, including copying into a logically air-gapped vault.

Additionally, a backup vault can have additional security through a vault lock; logically air-gapped vaults come equipped by a vault lock in compliance mode.

Similar to backup vaults, logically air-gapped vaults also support restricted tags for Amazon EC2 backups.

Create a logically air-gapped vault

You can create a logically air-gapped vault either through the AWS Backup console or through a combination of AWS Backup and AWS RAM CLI commands.

Each logically air-gapped comes equipped with a vault lock in compliance mode. See AWS Backup Vault Lock to help determine the retention period values most appropriate for your operation

Console

Create a logically air-gapped vault from the console

1. Open the AWS Backup console at https://console.aws.amazon.com/backup.

2. In the navigation pane, select Vaults.

3. Both types of vaults will be displayed. Select Create new vault.

4. Enter a name for your backup vault. You can name your vault to reflect what you will store in it, or to make it easier to search for the backups you need. For example, you could name it FinancialBackups.

5. Select the radio button for Logically air-gapped vault.

6. (Optional) Choose an encryption key. You can select a customer-managed KMS key for additional control over encryption, or use the default AWS-owned key (recommended).

7. Set the Minimum retention period.

   This value (in days, months, or years) is the shortest amount of time a backup can be retained in this vault. Backups with retention periods shorter than this value cannot be copied to this vault.

   The minimum value allowed is 7 days. Values for months and years meet this minimum.

8. Set the Maximum retention period.

   This value (in days, months, or years) is the longest amount of time a backup can be retained in this vault. Backups with retention periods greater than this value cannot be copied to this vault.

9. (Optional) Set the Encryption key.

   Specify the key to use with your vault. You can choose an AWS owned key (managed by AWS Backup) or enter the ARN for a Customer managed key that preferably belongs to a different account to which you have access. AWS Backup recommends using an AWS owned key.

10. (Optional) Add tags that will help you search for and identify your logically air-gapped vault. For example, you could add a BackupType:Financial tag.

11. Select Create vault.

12. Review the settings. If all settings show as you intended, select Create logically air-gapped vault.

13. The console will take you to the details page of your new vault. Verify the vault details are as expected.

14. Select Vaults to view vaults in your account. Your logically air-gapped vault will be displayed. The KMS key will be available approximately 1 to 3 minutes after the vault creation. Refresh the page to see the associated key. Once the key is visible, the vault is in an available state and can be used.

AWS CLI

Create a logically air-gapped vault from CLI

You can use AWS CLI to programmatically carry out operations for logically air-gapped vaults. Each CLI is specific to the AWS service in which it originates. Commands related to sharing are prepended with aws ram; all other commands should be prepended with aws backup.

Use the CLI command create-logically-air-gapped-backup-vault, modified with the following parameters:

aws backup create-logically-air-gapped-backup-vault
--region us-east-1 // optional
--backup-vault-name sampleName // required
--min-retention-days 7 // required Value must be an integer 7 or greater
--max-retention-days 35 // required
--encryption-key-arn arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012 // optional
--creator-request-id 123456789012-34567-8901 // optional

The optional --encryption-key-arn parameter allows you to specify a customer-managed KMS key for vault encryption. If not provided, the vault will use an AWS-owned key.

Example CLI command to create a logically air-gapped vault:

aws backup create-logically-air-gapped-backup-vault
--region us-east-1
--backup-vault-name sampleName
--min-retention-days 7
--max-retention-days 35
--creator-request-id 123456789012-34567-8901 // optional

Example CLI command to create a logically air-gapped vault with customer-managed encryption:

aws backup create-logically-air-gapped-backup-vault
--region us-east-1
--backup-vault-name sampleName
--min-retention-days 7
--max-retention-days 35
--encryption-key-arn arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012
--creator-request-id 123456789012-34567-8901 // optional

See CreateLogicallyAirGappedBackupVault API response elements for information after the create operation. If the operation was successful, the new logically air-gapped vault will have the VaultState of CREATING.

Once the creation is complete and the KMS encrypted key has been assigned, the VaultState will transition to AVAILABLE. Once available, the vault can be used. VaultState can be retrieved by calling DescribeBackupVault or ListBackupVaults.

View logically air-gapped vault details

You can see the vault details such as summary, the recovery points, the protected resources, account sharing, access policy, and tags through the AWS Backup console or the AWS Backup CLI.

Console

1. Open the AWS Backup console at https://console.aws.amazon.com/backup.

2. Select Vaults from the left-hand navigation.

3. Below the descriptions of vaults will be three lists, Vaults created by this account, Vaults shared through RAM, and Vaults accessible through Multi-party approval. Select the desired tab to view the vaults.

4. Under Vault name, click on the name of the vault to open the details page. You can see the summary, the recovery points, the protected resources, account sharing, access policy, and tag details.

   Details display depending on account type: Accounts which own a vault can view account sharing; accounts which do not own a vault will not be able to view account sharing. For shared vaults, the encryption key type (AWS-owned or customer-managed KMS key) is displayed in the vault summary.

AWS CLI

View details of a logically air-gapped vault through CLI

The CLI command describe-backup-vault can be used to obtain details about a vault. Parameter backup-vault-name is required; region is optional.

aws backup describe-backup-vault
--region us-east-1
--backup-vault-name testvaultname

Example of response:

{
"BackupVaultName": "LOG-AIR-GAP-VAULT-TEST",
"BackupVaultArn": "arn:aws:backup:us-east-1:234567890123:backup-vault:IAD-LAGV-01",
"VaultType": "LOGICALLY_AIR_GAPPED_BACKUP_VAULT",
"EncryptionKeyType": "AWS_OWNED_KMS_KEY",
"CreationDate": "2024-07-25T16:05:23.554000-07:00",
"NumberOfRecoveryPoints": 0,
"Locked": true,
"MinRetentionDays": 8,
"MaxRetentionDays": 30,
"LockDate": "2024-07-25T16:05:23.554000-07:00"
}

Creating backups in a logically air-gapped vault

Logically air-gapped vaults can be a copy job destination target in a backup plan or a target for an on-demand copy job. It can also be used as a primary backup target. See Primary backups to logically air-gapped vaults.

Compatible encryption

A successful copy job from a backup vault to a logically air-gapped vault requires an encryption key that is determined by the resource type being copied.

When you create or copy a backup of a fully managed resource type, the source resource can be encrypted by a customer managed key or by an AWS managed key.

When you create or copy a backup of other resource types (ones not fully managed), the source must be encrypted with a customer managed key. AWS managed keys for not fully managed resources are not supported.

Create or copy backups to a logically air-gapped vault through a backup plan

You can copy a backup (recovery point) from a standard backup vault to a logically air-gapped vault by creating a new backup plan or updating an existing one in the AWS Backup console or through the AWS CLI commands create-backup-plan and update-backup-plan. You can also create backups directly in a logically air-gapped vault by using it as a primary target. See Primary backups to logically air-gapped vaults for more details.

You can copy a backup from one logically air-gapped vault to another logically air-gapped vault on-demand (this type of backup cannot be scheduled in a backup plan). You can copy a backup from a logically air-gapped vault to a standard backup vault as long as the copy is encrypted with a customer managed key.

On-demand backup copy to a logically air-gapped vault

To create a one-time on-demand copy of a backup to a logically air-gapped vault, you can copy from a standard backup vault. Cross-Region or cross-account copies are available if the resource type supports the copy type.

Copy availability

A copy of a backup can be created from the account to which the vault belongs. Accounts with which the vault has been shared have the ability to view or a restore a backup, but not to create a copy.

Only resource types that support cross-Region or cross-account copy can be included.

Console

1. Open the AWS Backup console at https://console.aws.amazon.com/backup.

2. Select Vaults from the left-hand navigation.

3. In the vault detail page, all recovery points within that vault are displayed. Place a check mark next to the recovery point you wish to copy.

4. Select Actions, and then select Copy from the drop-down menu.

5. On the next screen, input the details of the destination.

   1. Specify the destination Region.

   2. Destination backup vault drop-down menu displays eligible destination vaults. Select one with the type logically air-gapped vault

6. Select Copy once all details are set to your preferences.

On the Jobs page in the console, you can select Copy jobs to see current copy jobs.

AWS CLI

Use start-copy-job to copy an existing backup in a backup vault to a logically air-gapped vault.

Sample CLI input:

aws backup start-copy-job
--region us-east-1
--recovery-point-arn arn:aws:resourcetype:region::snapshot/snap-12345678901234567
--source-backup-vault-name sourcevaultname
--destination-backup-vault-arn arn:aws:backup:us-east-1:123456789012:backup-vault:destinationvaultname
--iam-role-arn arn:aws:iam::123456789012:role/service-role/servicerole

For more information, see Copying a backup, cross-Region backup, and Cross-account backup.

Share a logically air-gapped vault

You can use AWS Resource Access Manager (RAM) to share a logically air-gapped vault with other accounts you designate. When sharing vaults, the encryption key type information (AWS-owned or customer-managed KMS key) is preserved and visible to accounts with which the vault is shared.

A vault can be shared with an account in its organization or with an account in another organization. The vault cannot be shared with an entire organization, only with accounts within the organization.

Only accounts with specific IAM privileges can share and manage the sharing of vaults.

To share using AWS RAM, ensure you have the following:

Console

1. Open the AWS Backup console at https://console.aws.amazon.com/backup.

2. Select Vaults from the left-hand navigation.

3. Below the descriptions of vaults will be two lists, Vaults owned by this account and Vaults shared with this account. Vaults owned by the account are eligible to be shared.

4. Under Vault name, select the name of the logically air-gapped vault to open the details page.

5. The Account sharing pane shows with which accounts the vault is being shared.

6. To begin sharing with another account or to edit accounts already being shared, select Manage sharing.

7. The AWS RAM console opens when Manage sharing is selected. For steps to share a resource using AWS RAM, see Creating a resource share in AWS RAM in the AWS RAM User Guide.

8. The account invited to accept an invitation to receive a share has 12 hours to accept the invitation. See Accepting and rejecting resource share invitations in the AWS RAM User Guide.

9. If the sharing steps are completed and accepted, the vault summary page will show under Account sharing = “Shared - see account sharing table below”.

AWS CLI

AWS RAM uses the CLI command create-resource-share. The access to this command is only available to accounts with sufficient permissions. See Creating a resource share in AWS RAM for CLI steps.

Steps 1 through 4 are conducted with the account that owns the logically air-gapped vault. Steps 5 through 8 are conducted with the account with which the logically air-gapped vault will be shared.

1. Log into the owning account OR request a user at your organization with sufficient credentials for accessing the source account completes these steps.

   1. If a resource share was previously created and you wish to add an additional resource to it, use CLI associate-resource-share instead with the ARN of the new vault.

2. Fetch credentials of a role with sufficient permissions to share via RAM. Input these into the CLI.

   1. The permission ram:CreateResourceShare is necessary for this procedure. The policy AWSResourceAccessManagerFullAccess contains all RAM-related permissions.

3. Use create-resource-share.

   1. Include the ARN of the logically air-gapped vault.

   2. Example input:

      aws ram create-resource-share
      --name MyLogicallyAirGappedVault
      --resource-arns arn:aws:backup:us-east-1:123456789012:backup-vault:test-vault-1
      --principals 123456789012
      --region us-east-1

   3. Example output:

      {
         "resourceShare":{
            "resourceShareArn":"arn:aws:ram:us-east-1:123456789012:resource-share/12345678-abcd-09876543",
            "name":"MyLogicallyAirGappedVault",
            "owningAccountId":"123456789012",
            "allowExternalPrincipals":true,
            "status":"ACTIVE",
            "creationTime":"2021-09-14T20:42:40.266000-07:00",
            "lastUpdatedTime":"2021-09-14T20:42:40.266000-07:00"
         }
      }

4. Copy the resource share ARN in the output (which is needed for subsequent steps). Give the ARN to the operator of account you are inviting to receive the share.

5. Obtain the resource share ARN

   1. If you did not perform steps 1 through 4, obtain the resourceShareArn from whomever did.

   2. Example: arn:aws:ram:us-east-1:123456789012:resource-share/12345678-abcd-09876543

6. In the CLI, assume credentials of the recipient account.

7. Get resource share invitation with get-resource-share-invitations. For more information, see Accepting and rejecting invitations in the AWS RAM User Guide.

8. Accept the invitation in destination (recovery) account.

   1. Use accept-resource-share-invitation (can also reject-resource-share-invitation).

You can use AWS RAM CLI commands to view shared items:

• Resources you have shared:

  aws ram list-resources --resource-owner SELF --resource-type backup:backup-vault --region us-east-1

• Show the principal:

  aws ram get-resource-share-associations --association-type PRINCIPAL --region us-east-1

• Resources shared by other accounts:

  aws ram list-resources --resource-owner OTHER-ACCOUNTS --resource-type backup:backup-vault --region us-east-1

Restore a backup from a logically air-gapped vault

You can restore a backup stored in a logically air-gapped vault from either the account that owns the vault or from any account with which the vault is shared.

See Restoring a backup for information on how to restore a recovery point through the AWS Backup console.

Once a backup has been shared from a logically air-gapped vault to your account, you can use start-restore-job to restore the backup.

A sample CLI input can include the following command and parameters:

aws backup start-restore-job
--recovery-point-arn arn:aws:backup:us-east-1:accountnumber:recovery-point:RecoveryPointID
--metadata {\"availabilityzone\":\"us-east-1d\"}
--idempotency-token TokenNumber
--resource-type ResourceType
--iam-role arn:aws:iam::number:role/service-role/servicerole
--region us-east-1

Delete a logically air-gapped vault

See delete a vault. Vaults cannot be deleted if they still contain backups (recovery points). Ensure the vault is empty of backups before you initiate a delete operation.

Deletion of a vault also deletes the key associated with the vault seven days after the vault is deleted in accordance with key deletion policy.

The following sample CLI command delete-backup-vault can be used to delete a vault.

aws backup delete-backup-vault
--region us-east-1 
--backup-vault-name testvaultname

Additional programmatic options for logically air-gapped vaults

The CLI command list-backup-vaults can be modified to list all the vaults owned by and present in the account:

aws backup list-backup-vaults
--region us-east-1

To list just the logically air-gapped vaults, add the parameter

--by-vault-type LOGICALLY_AIR_GAPPED_BACKUP_VAULT

Include the parameter by-shared to filter the returned list of vaults to show only shared logically air-gapped vaults. The response will include encryption key type information for each shared vault.

aws backup list-backup-vaults
--region us-east-1
--by-shared

Example response showing encryption key type information:

{
    "BackupVaultList": [
        {
            "BackupVaultName": "shared-logically air-gapped-vault",
            "BackupVaultArn": "arn:aws:backup:us-east-1:123456789012:backup-vault:shared-logically air-gapped-vault",
            "VaultType": "LOGICALLY_AIR_GAPPED_BACKUP_VAULT",
            "EncryptionKeyType": "AWS_OWNED_KMS_KEY",
            "CreationDate": "2024-07-25T16:05:23.554000-07:00",
            "Locked": true,
            "MinRetentionDays": 7,
            "MaxRetentionDays": 30
        }
    ]
}

Understanding encryption key types for logically air-gapped vaults

Logically air-gapped vaults support different encryption key types, and this information is visible through AWS Backup APIs and console. When vaults are shared through AWS RAM or MPA, the encryption key type information is preserved and made visible to accounts with which the vault is shared. This transparency helps you understand the encryption configuration of vaults and make informed decisions about backup and restore operations.

Encryption key type values

The EncryptionKeyType field can have the following values:

Key policy for CMK encrypted logically air-gapped vault creation

When creating a logically air-gapped vault with a customer managed key, you must apply the AWS-managed policy AWSBackupFullAccess to your account role. This policy includes Allow actions that enable AWS Backup to interact with AWS KMS for grant creation on KMS keys during backup, copy, and storage operations. Additionally, you must ensure your customer managed key (if used) policy includes specific required permissions.

{  
    "Sid": "Allow use of the key to create a logically air-gapped vault",  
    "Effect": "Allow",  
    "Principal": {  
        "AWS": "arn:aws:iam::[account-id]:role/TheRoleToAccessAccount"  
    },  
    "Action": [  
        "kms:CreateGrant",  
        "kms:DescribeKey"  
    ],  
    "Resource": "*",  
   "Condition": {  
        "StringLike": {  
            "kms:ViaService": "backup.*.amazonaws.com"  
        }  
   }  
}

Key policy for copy/restore

To prevent job failures, review your AWS KMS key policy to ensure it includes all required permissions and doesn't contain any deny statements that could block operations. The following conditions apply:

{  
    "Sid": "Allow use of the key for copy",  
    "Effect": "Allow",  
    "Principal": {  
        "AWS": "arn:aws:iam::[source-account-id]:role/service-role/AWSBackupDefaultServiceRole"      //[Source copy role]          
    },  
    "Action": [  
        "kms:Encrypt",  
        "kms:Decrypt",  
        "kms:ReEncrypt*",  
        "kms:GenerateDataKey*",  
        "kms:DescribeKey"  
    ],  
    "Resource": "*",  
   "Condition": {  
         "StringLike": {  
            "kms:ViaService": "backup.*.amazonaws.com"  
         }  
   }  
},  
{  
    "Sid": "Allow AWS Backup to create grant on the key for copy",  
    "Effect": "Allow",  
    "Principal": {  
        "AWS": "arn:aws:iam::[source-account-id]:role/service-role/AWSBackupDefaultServiceRole" //[Source copy role]   
    },  
    "Action": [  
        "kms:CreateGrant"  
    ],  
    "Resource": "*",  
    "Condition": {  
        "Bool": {  
            "kms:GrantIsForAWSResource": "true"  
        },  
        "StringLike": {  
            "kms:ViaService": "backup.*.amazonaws.com"  
        }  
    }  
}

{  
    "Sid": "Allow use of the key for copy from a CMK encrypted logically air-gapped vault to normal backup vault",
    "Effect": "Allow",  
    "Principal": {  
        "AWS": ["arn:aws:iam::[source-account-id]:role/service-role/AWSBackupDefaultServiceRole",      //[Source copy role]  
                "arn:aws:iam::[destination-account-id]:role/aws-service-role/backup.amazonaws.com/AWSServiceRoleForBackup"], //[Destination SLR]    
    },  
    "Action": [  
        "kms:Encrypt",  
        "kms:Decrypt",  
        "kms:ReEncrypt*",  
        "kms:GenerateDataKey*",  
        "kms:DescribeKey"  
    ],  
    "Resource": "*"  
},  
{  
    "Sid": "Allow AWS Backup to create grant on the key for copy",  
    "Effect": "Allow",  
    "Principal": {  
          "AWS": ["arn:aws:iam::[source-account-id]:role/service-role/AWSBackupDefaultServiceRole",      //[Source copy role]  
                  "arn:aws:iam::[destination-account-id]:role/aws-service-role/backup.amazonaws.com/AWSServiceRoleForBackup"], //[Destination SLR]   
    },  
    "Action": [  
        "kms:CreateGrant"  
    ],  
    "Resource": "*",  
    "Condition": {  
        "Bool": {  
            "kms:GrantIsForAWSResource": "true"  
        }  
    }  
}

{  
    "Sid": "Allow use of the key for copy/restore from a recovery account",  
    "Effect": "Allow",  
    "Principal": {  
        "AWS": ["arn:aws:iam::[recovery-account-id]:role/service-role/AWSBackupDefaultServiceRole", //[Recovery account copy/restore role]
                "arn:aws:iam::[destination-account-id]:role/aws-service-role/backup.amazonaws.com/AWSServiceRoleForBackup"] //[Destination SLR]    
    },  
    "Action": [  
        "kms:Encrypt",  
        "kms:Decrypt",  
        "kms:ReEncrypt*",  
        "kms:GenerateDataKey*",  
        "kms:DescribeKey"  
    ],  
    "Resource": "*"  
},  
{  
    "Sid": "Allow AWS Backup to create grant on the key for copy",  
    "Effect": "Allow",  
    "Principal": {  
        "AWS": ["arn:aws:iam::[recovery-account-id]:role/service-role/AWSBackupDefaultServiceRole" //[Recovery account copy/restore role]    
                "arn:aws:iam::[destination-account-id]:role/aws-service-role/backup.amazonaws.com/AWSServiceRoleForBackup"], //[Destination SLR]  
                  
    },  
    "Action": [  
        "kms:CreateGrant"  
    ],  
    "Resource": "*",  
    "Condition": {  
        "Bool": {  
            "kms:GrantIsForAWSResource": "true"  
        }  
    }  
}

IAM Role

When performing logically air-gapped vault copy operations, customers can utilize the AWSBackupDefaultServiceRole which includes the AWS-managed policy AWSBackupServiceRolePolicyForBackup. However, if customers prefer to implement a least-privilege policy approach, their IAM policy must include a specific requirement:

{  
    "Version": "2012-10-17"		 	 	 ,		 	 	   
    "Statement": [  
         {  
            "Sid": "KMSPermissions",  
            "Effect": "Allow",  
            "Action": "kms:DescribeKey",  
            "Resource": [  
                "arn:aws:kms:*:[source-account-id]:key/*",  - Source logically air-gapped vault CMK -   
                "arn:aws:kms:*:[destination-account-id]:key/*".  - Destination logically air-gapped vault CMK -   
            ]  
        },  
        {  
            "Sid": "KMSCreateGrantPermissions",  
            "Effect": "Allow",  
            "Action": "kms:CreateGrant",  
            "Resource": [  
                "arn:aws:kms:*:[source-account-id]:key/*",  - Source logically air-gapped vault CMK -   
                "arn:aws:kms:*:[destination-account-id]:key/*".  - Destination logically air-gapped vault CMK -   
            ]  
            "Condition": {  
                "Bool": {  
                    "kms:GrantIsForAWSResource": "true"  
                }  
            }  
        },  
    ]  
}

Consequently, one of the most common customer errors occurs during copy when customers fail to provide sufficient permissions on their CMKs and copy roles.

Viewing encryption key types

You can view encryption key type information through both the AWS Backup console and programmatically using the AWS CLI or SDKs.

Console: When viewing logically air-gapped vaults in the AWS Backup console, the encryption key type is displayed in the vault details page under the security information section.

AWS CLI/API: The encryption key type is returned in the response of the following operations when querying logically air-gapped vaults:

Considerations for vault encryption

When working with logically air-gapped vaults and encryption key types, consider the following:

Troubleshoot a logically air-gapped vault issue

If you encounter errors during your workflow, consult the following example errors and suggested resolutions:

AccessDeniedException

Error: An error occured (AccessDeniedException) when calling the [command] operation: Insufficient privileges to perform this action."

Possible cause: The parameter --backup-vault-account-id was not included when one of the following requests was run on a vault shared by RAM:

Resolution: Retry the command that returned the error, but include the parameter --backup-vault-account-id that specifies the account that owns the vault.

OperationNotPermittedException

Error: OperationNotPermittedException is returned after a CreateResourceShare call.

Possible cause: If you attempted to share a resource, such as a logically air-gapped vault, with another organization, you may get this exception. A vault can be shared with an account in another organization, but it cannot be shared with the other organization itself.

Resolution: Retry the operation, but specify an account as the value for principals instead of an organization or OU.

Encryption key type not displayed

Issue: The encryption key type is not visible when viewing a logically air-gapped vault or its recovery points.

Possible causes:

Resolution:

"FAILED" VaultState with AccessDeniedException in CloudTrail logs

Error in CloudTrail: "User: <assumed role> is not authorized to perform: kms:CreateGrant on this resource because the resource does not exist in this Region, no resource-based policies allow access, or a resource-based policy explicitly denies access"

Possible causes:

Resolution: