title: Backup vault creation failed because of insufficient privileges
body: <p>I am trying to create a backup plan, rule and vault using AWS CDK. After deploying the application I receive the following error in cloudformation console.</p>
  <pre><code>Resource handler returned message: &quot;Insufficient privileges to perform this action. (Service: Backup, Status Code: 403, Request ID: xxxxxxx)&quot; (RequestToken: xxxxxxxxx, HandlerErrorCode: GeneralServiceException)
  </code></pre>
  <p>My CDK bootstrap role definitely have access to <em>backup</em>. See policy document below.</p>
  <pre><code>{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Sid&quot;: &quot;cdk&quot;,
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Action&quot;: [
          &quot;lambda:*&quot;,
          &quot;logs:*&quot;,
          &quot;serverlessrepo:*&quot;,
          &quot;servicediscovery:*&quot;,
          &quot;ssm:*&quot;,
          &quot;cloudformation:*&quot;,
          &quot;kms:*&quot;,
          &quot;iam:*&quot;,
          &quot;sns:*&quot;,
          &quot;dynamodb:*&quot;,
          &quot;codepipeline:*&quot;,
          &quot;cloudwatch:*&quot;,
          &quot;events:*&quot;,
          &quot;acm:*&quot;,
          &quot;sqs:*&quot;,
          &quot;backup:*&quot;
        ],
        &quot;Resource&quot;: &quot;*&quot;
      }
    ]
  }
  </code></pre>
  <p>Following are my CDK code snippets:</p>
  <p><strong>backup-rule</strong></p>
  <pre><code>ruleName: 'myTestRuleName',
  completionWindow: Duration.hours(1),
  startWindow: Duration.hours(1),
  scheduleExpression: events.Schedule.cron({
      day: '*',
      hour: '2'
  }),
  deleteAfter: Duration.days(90),
        
  </code></pre>
  <p><strong>backup-vault</strong>
  I tried without encryptionKey and also with a key that I have created through AWS backup web interface. None worked</p>
  <pre><code>new backup.BackupVault(this, `${id}-instance`, {
      backupVaultName: props.backupVaultName,
      // encryptionKey: this.key
  })
  </code></pre>
  <p><strong>backup-plan</strong></p>
  <pre><code>new BackupPlan(scope, `${id}-instance`, {
        backupPlanName: context.backupPlanName,
        backupPlanRules: context.backupPlanRules,
        // backupVault: context.backupVault
   });
  </code></pre>
  <p><strong>backup selection</strong>
  I also tried without creating the role and letting AWS CDK create and use the default role.
  NOTE: I have also tried created plan, rule and vault without resource selection to make sure, that the problem does not occur on the <em>resource selection</em> side.</p>
  <pre><code>const role = new iam.Role(this, 'Backup Access Role', { assumedBy: new iam.ServicePrincipal('backup.amazonaws.com') });
  const managedPolicy = iam.ManagedPolicy.fromManagedPolicyArn(this, 'AWSBackupServiceRolePolicyForBackup', 'arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup');
  role.addManagedPolicy(managedPolicy);
  plan.backupPlan.addSelection('selection',
        {
          resources: [
            BackupResource.fromDynamoDbTable(MyTable)
          ],
          //role: role
        }
  )
  ``
  </code></pre>