Setup guide

Prints the account id and caller ARN before any mutation so the skill can refuse to run in the wrong account.

↳ Always allowed by default for any authenticated principal; cannot be narrowed further.

Rehearses whether the caller is allowed to perform a mutating action before attempting it, without side effects.

↳ Restrict Resource to the caller's own ARN so the principal cannot simulate other roles.

Inventories bucket configuration and reads existing lifecycle rules before replacing them.

↳ s3:ListAllMyBuckets requires Resource "*"; scope the remaining Get* actions to the specific bucket ARNs.

Applies bucket hardening: versioning, default SSE-KMS, lifecycle transitions and Block Public Access.

↳ Scope Resource to arn:aws:s3:::<bucket> for the specific buckets in scope; omit entirely in audit-only mode.

Copies objects during migration and verifies object size and SHA-256 checksums afterwards.

↳ Grant Get* only on the source bucket/prefix and Put* only on the destination bucket/prefix.

Inventories EBS volumes and tracks snapshot and modification progress via waiters.

↳ EC2 Describe* actions do not support resource-level permissions; they require Resource "*".

Takes pre-change EBS snapshots, copies them cross-region/encrypted, restores volumes and resizes or retypes volumes.

↳ Constrain with a Condition on aws:ResourceTag or ec2:CreateAction; scope ec2:CreateTags to snapshot and volume creation only.

Reads and sets EFS IA/Archive tiering policies and enables automatic EFS backups.

↳ Scope Resource to arn:aws:elasticfilesystem:<region>:<account>:file-system/fs-xxxx.

Creates manual RDS snapshots, restores snapshots or point-in-time copies to new identifiers, and adjusts backup retention.

↳ Scope to arn:aws:rds:<region>:<account>:db:<identifier> and snapshot ARNs; deliberately exclude rds:DeleteDBInstance.

Enables PITR, takes on-demand backups, exports tables to S3 and restores tables under new names.

↳ Scope to arn:aws:dynamodb:<region>:<account>:table/<name>; exclude dynamodb:DeleteTable and dynamodb:DeleteBackup.

Required for SSE-KMS buckets, encrypted EBS snapshot copies, and encrypted RDS snapshot copies across regions or accounts.

↳ Scope to the specific key ARN and add Condition kms:ViaService (for example s3.us-east-2.amazonaws.com) so the key is usable only through the intended service.

Optional path for centralized backup and restore through AWS Backup vaults instead of per-service snapshot APIs.

↳ Scope iam:PassRole to the single AWSBackupDefaultServiceRole ARN with Condition iam:PassedToService = backup.amazonaws.com; omit this block entirely if AWS Backup is not used.

Sufficient for audit-only runs that report on bucket, volume, file system, database and table configuration without changing anything.

↳ Preferred starting point: attach this alone first, run the inventory step, and add write actions only for the specific resources the task must change.

Cause: The attached policy lacks s3:PutLifecycleConfiguration for that bucket ARN, or an SCP / bucket policy explicitly denies it.

Fix: Add s3:PutLifecycleConfiguration on arn:aws:s3:::<bucket>, then confirm with 'aws iam simulate-principal-policy --policy-source-arn <caller-arn> --action-names s3:PutLifecycleConfiguration --resource-arns arn:aws:s3:::<bucket>'. Check for an organization SCP if the simulation says allowed but the call still fails.

Cause: Missing ec2:CreateSnapshot, or a Condition (tag, region) on the policy that the request does not satisfy.

Fix: Grant ec2:CreateSnapshot and ec2:CreateTags. Re-run with --dry-run; a successful rehearsal returns DryRunOperation instead. Decode the encoded message with 'aws sts decode-authorization-message --encoded-message <value>'.

Cause: Not a failure. This is the expected success signal from an EC2 dry run.

Fix: Treat it as authorization proof, report it, and re-run without --dry-run only after explicit user confirmation.

Cause: IAM Identity Center session or assume-role session credentials aged out (default 1 hour for AssumeRole, 8 hours for SSO).

Fix: Run 'aws sso login --profile storage-admin', or re-issue 'aws sts assume-role' and refresh AWS_SESSION_TOKEN. Long jobs should refresh credentials rather than start a copy that will die halfway.

Cause: Deleted or rotated access key, a typo in AWS_ACCESS_KEY_ID, or ASIA temporary keys supplied without AWS_SESSION_TOKEN.

Fix: Re-check the key in IAM > Users > Security credentials. If the key starts with ASIA you must also export AWS_SESSION_TOKEN.

Cause: The destination KMS key policy does not trust the calling principal, or a cross-region copy referenced a key ARN from the source region.

Fix: Use a key that exists in the destination region and add kms:Decrypt, kms:GenerateDataKey and kms:CreateGrant for the caller in that key's key policy. Same fix applies to ec2 copy-snapshot.

Cause: The snapshot identifier is already used in this account and region; identifiers must be unique and are not reused after deletion within the retention window.

Fix: Append a UTC timestamp: --db-snapshot-identifier "$DB-manual-$(date -u +%Y%m%d%H%M%S)".

Cause: Both a fixed restore timestamp and the latest-restorable flag were passed.

Fix: Pass exactly one: --restore-time 2026-07-20T03:15:00Z or --use-latest-restorable-time. Check the valid window first with 'aws rds describe-db-instances --query "DBInstances[].LatestRestorableTime"'.

Cause: PITR is still being enabled or disabled on the table; the setting is not instantaneous.

Fix: Poll 'aws dynamodb describe-continuous-backups --table-name <table>' until ContinuousBackupsStatus is ENABLED, then retry.

Cause: Too many concurrent table control-plane operations (restores, creates, deletes) in the region.

Fix: Serialize restores, wait for TableStatus to reach ACTIVE via 'aws dynamodb wait table-exists --table-name <target>', then start the next one.

Cause: An EBS volume was modified again inside the mandatory cooldown after the previous modification.

Fix: Check 'aws ec2 describe-volumes-modifications --volume-ids <vol>' until ModificationState is completed, then wait out the cooldown (up to 6 hours) before the next change.

Cause: The destination bucket uses Bucket owner enforced object ownership, but the copy passed --acl.

Fix: Drop the --acl flag from the s3 cp/sync command and control access with a bucket policy instead.

Cause: The bucket already exists in your account; create-bucket is not idempotent outside us-east-1.

Fix: Skip creation and proceed to configuration. Detect first with 'aws s3api head-bucket --bucket <name>'.

Cause: Request rate exceeded the per-prefix S3 limit during a large sync.

Fix: Lower concurrency with 'aws configure set default.s3.max_concurrent_requests 10', spread keys across prefixes, and rely on the CLI's adaptive retries rather than restarting the whole sync.