Problem Summary
During failover, a virtual machine failed to boot with an authorization error related to the creation of an EC2 security group. The error was caused by an AWS Service Control Policy (SCP) that explicitly denied the required permission to the IAM role used during failover.
Traceback
<VM Name> boot failed. error = You are not authorized to perform this operation.
User:arn:aws:sts::<account-id>:assumed-role/<IAM-role-name>/<session-name> is not authorized to perform: ec2:CreateSecurityGroup
on resource: arn:aws:ec2:<region>:<account-id>:vpc/<vpc-id>
with an explicit deny in a service control policy.
Cause
DRaaS failover requires temporary infrastructure setup in the recovery region, including the creation of a temporary security group in the target VPC, same mentioned in the document under section Failover EC2 instance.
In this scenario, an explicit deny configured in the AWS Service Control Policy (SCP) blocked the ec2:CreateSecurityGroup API call. As a result, the failover operation could not proceed.
Resolution Steps
Review AWS SCPs:
Check if there is a Service Control Policy at the organizational or account level that explicitly denies ec2:CreateSecurityGroup. This permission is required by the IAM role used by the DRaaS process.
Create an Exception or Update Policy:
If such a restriction exists, update the SCP to allow ec2:CreateSecurityGroup for the IAM role assumed by the DRaaS service(DruvaIAMrolePL), or create a targeted exception for that role.
Re-run the Failover:
Once the necessary permissions are granted, retry the failover operation. The process should complete successfully if no other restrictions are in place.
Best Practices
Ensure the IAM role used by DRaaS has all required permissions as outlined in Druva’s IAM policy documentation.
Avoid using broad explicit denies in SCPs unless necessary. Where used, confirm they don’t impact critical disaster recovery workflows.
Document and test failover permissions during DR planning or onboarding to catch such issues proactively.
Additional Resources