Debugging AWS Backup Error

My S3 backups, automated and on-demand, were failing with this error:

IAM Role arn:aws:iam::<role-id>:role/service-role/AWSBackupDefaultServiceRole does not have sufficient permissions to execute the backup

This happened even when using the default role, which should automatically receive the required permissions:

Eventually, I realized that the default role should receive all of the following permissions:

  • AWSBackupServiceRolePolicyForRestores
  • AWSBackupServiceRolePolicyForBackup
  • AWSBackupServiceRolePolicyForS3Backup
  • AWSBackupServiceRolePolicyForS3Restore

In my case, the last two permissions, that is AWSBackupServiceRolePolicyForS3Backup and AWSBackupServiceRolePolicyForS3Restore were, for reasons that are unknown to me, missing. I manually created these missing permissions and assigned them to a new role:

With these new permissions, the backup succeeded.

2 comments

Other posts you might like

Fixing AWS Timestream query

My 'ago' function had been failing with "The query syntax is invalid" error on the following clause:

time BETWEEN ago(24h5m) AND ago(24h) AND

I fixed it by changing converting the hours to minutes:

time BETWEEN ago(1445m) AND ago(1440m) AND

programmingaws timestreamsqlawsamazon web services
reply

How I fixed @aws-crypto build error

I've been getting the following error when building my Next.js app:

Failed to compile.

./node_modules/.pnpm/@aws-crypto+sha256-js@5.2.0/node_modules/@aws-crypto/sha256-js/build/module/index.js + 12 modules Cannot get final name for export 'fromUtf8' of ./node_modules/.pnpm/@smithy+util-utf8@2.0.2/node_modules/@smithy/util-utf8/dist-es/index.js

I narrowed the source down to the following piece of code:

import { createServerRunner } from "@aws-amplify/adapter-nextjs";
import { AWS_AMPLIFY_CONFIG } from "./utils";
import { cookies } from "next/headers";
import { getCurrentUser } from "aws-amplify/auth/server";

export const { runWithAmplifyServerContext } = createServerRunner({
  config: AWS_AMPLIFY_CONFIG,
});
awsnext.js@aws-cryptoamplifyprogramming
reply

How to use AWS Amplify Authentication with Next.js Server Actions

No next-auth required:

// amplifyServerUtils.ts

import { createServerRunner } from '@aws-amplify/adapter-nextjs';
import config from '@/amplifyconfiguration.json';

export const { runWithAmplifyServerContext } = createServerRunner({
  config
});
// actions.ts

"use server";
import { cookies } from "next/headers";
programmingawsamplifynext.jsamplify v6cognito
reply

How I struggled to fix votes on Sanity

Ever since I implemented upvotes a few months ago, I had been struggling with user upvotes/downvotes request occasionly timing out. The bug persisted for a few months and the few times I tried to debug it, I had no success. Is it the database schema? Nope, I use similar schemas for other collections and they work fine. An inefficient MongoDB query? Same thing. No indexing? I indexed the DB even though there are barely any votes in the collection. An issue with Vercel cold start? Also not it, everything within the norm.

Last Friday the rest of the app was finally ready and I wanted to start inviting some users, so I gave up and decided to pay $20/month for Vercel Pro to increase the timeout from 10 to 60 seconds and worry about the bug another day. And then I checked the logs on Vercel Pro...

Unhandled error: MongooseError: Operation `userVotes.findOne()` buffering timed out after 10000ms
    at Timeout.<anonymous> (/var/task/sanity_client/node_modules/mongoose/lib/drivers/node-mongodb-native/collection.js:175:23)
    at listOnTimeout (node:internal/timers:569:17)
    at process.processTimers (node:internal/timers:512:7)

Because Mongoose timeout is 10000ms and Vercel's timeout is also 10000ms but this includes the cold start time, this error never popped up on my free plan....

sanityprogrammingvercelmongodbbuilding in public
reply

Is there a secure way to use Redis with Vercel?

I spent a couple of hours yesterday trying to find a way to use Redis with Sanity, which currently runs on Vercel. According to Redis docs on security, it is not a good idea to expose a Redis instance directly to the internet:

Redis is designed to be accessed by trusted clients inside trusted environments. This means that usually it is not a good idea to expose the Redis instance directly to the internet or, in general, to an environment where untrusted clients can directly access the Redis TCP port or UNIX socket.

I wanted to use Digital Ocean's trusted sources to restrict the incoming connections to those coming from my Vercel server but looks like that won't be possible because of Vercel's use of dynamic IP addresses. According to Vercel docs:

To ensure your Vercel deployment is able to access the external resource, you should allow connections from all IP addresses. Typically this can be achieved by entering an IP address of (0.0.0.0).

While allowing connections from all IP addresses may be a concern, relying on IP allowlisting for security is generally ineffective and can lead to poor security practices.

To properly secure your database, we recommend using a randomly generated password, stored as an environment variable, at least 32 characters in length, and to rotate this password on a regular basi...

1 comment

Feature announcement - image upload

You can now add images to your Sanity posts 📷 Important caveat: For now, you need to save your post as a draft first to be able to access this feature.

Here is a picture of a couple of boars I took outside of my house yesterday. Plenty of boars here in Gdynia, I see them almost every day 🐗

building in publicgdyniaboarswildlifeanimals
reply

How I improved my sleep and my Fitbit sleep score - 12 tips 😴

At some point in my mid-to-late twenties, I realised that my sleep isn't what it used to be. I first remember noticing something isn't quite right when I got my Fitbit and consistently had higher-than-average light sleep and lower-than-average deep sleep and REM. I would often wake up early in the morning and not be able to fall back asleep. My Fitbit sleep score would be poor, hovering somewhere between 68 and 75.

After a lot of trial and error, I developed some strategies that helped me get my deep and REM sleep back to normal. The main question that I asked myself throughout this process was: If I lived in a tribal society 10,000 years ago, would this be natural for me? If the answer was yes, I'd try that change. I now have, according to Fitbit, perfectly average amounts of deep sleep and REM. My sleep score is usually somewhere between 77 and 84 and it's been steadily going up month after month. More importantly, I wake up fully rested and find it easy to get out of bed in the morning. Here are the winning techniques.

How to improve your sleep

  • Don't use an alarm clock. I know that not everyone has the same luxury but I have relatively flexible working hours so unless there's an early flight to catch, I let my body wake up when it needs to. Waking up to a jarring alarm sound elevates your stress levels - your ancestors would most likely be abruptly woken if they or their family were in physical...
fitbitsleepself improvementhealthdeep sleep
reply

Let it go by Elsa the Icequeen

A few days ago my boss told me „to let go“. Like don’t be too harsh to myself and others. Especially the children at my workplace. I think he meant something like don’t feel responsible for everyone and everything. But how can I do this if I have this feeling in my gut that I can do better than a lot of other colleagues. It’s like finding a thin line between responsibility and let five be straight (weird to translate German sayings into English). I’m really trying my best and I know I‘m really good at my job, but it leaves me exhausted at hell. So as part of a homework for myself I try to let it go. Leave the opportunity for others to do shit I always do.

1 comment
feedback