Skip to main content

EC2 AirGap backups failed with "Failed to ListSnapshotBlocksBasic" API error.

EC2 AirGap backups are failing due to a persistent "Failed to ListSnapshotBlocksBasic" API error.

Updated over a month ago

Problem Description

EC2 AirGap backup jobs are failing during the snapshot processing phase. The system is unable to complete the backup due to a persistent error.

Cause

The logs indicate an Access Denied error while attempting to assume a role via AWS STS (Security Token Service). This is typically due to:

  • An outdated CloudFormation stack, missing the latest permissions.

  • SCP (Service Control Policy) or IAM permission restrictions blocking necessary API calls.

Traceback

operation error EBS: ListSnapshotBlocks, failed to sign request: failed to retrieve credentials:

failed to refresh cached credentials, operation error STS: AssumeRole,

https response error StatusCode: 403, api error AccessDenied:

User: arn:aws:sts::839660473589:assumed-role/cr-prod-data-processing-role-ec2data-Role/i-0b3a330906c46a3d2

is not authorized to perform: sts:AssumeRole on resource:

arn:aws:iam::673397230705:role/Druva-CloudRanger-Prod-CloudRangerDataRole-1LQL85241ABEW

Verification

  1. Confirm CloudFormation Template Version

    • Check whether the customer's deployed stack is running the latest CloudFormation template provided by Druva.

  2. Review IAM Roles and Permissions

    • Validate that the IAM roles involved in the backup process have the required permissions to perform sts:AssumeRole.

  3. Inspect SCPs or Organizational Restrictions

    • Look for any Service Control Policies or IAM boundaries that might block the sts:AssumeRole or ebs:ListSnapshotBlocks permissions.

Resolution

  1. Update CloudFormation Stack

    • Request the customer to update their Druva CloudFormation stack to the latest version, which includes all necessary permissions.

    • Refer to Documentation for step-by-step upgrade instructions.

  2. Check and Modify SCP or IAM Restrictions

    • If updating the stack doesn't resolve the issue, verify and adjust any SCPs or IAM permission boundaries that may be preventing:

      • sts:AssumeRole

      • ebs:ListSnapshotBlocks

    • Ensure the backup role has cross-account trust permissions configured correctly.

  3. Re-run the Backup Job

    • Once the stack and permissions are corrected, reinitiate the AirGap backup job and monitor for success.

Related Articles
VPC Cloning fails
Backup Failure Error: "Failed to Sign Request: Unable to Retrieve Credentials"
Nutanix Backups Failing with Error Code AHV51 Due to API Authentication Failure.
DRaaS Failover Fails Due to boot failed. error = You are not authorized to perform this operation.
EC2 Airgap Architecture
Did this answer your question?