I asked this on the AWS forum but not getting much traction. My root problem is that I'm trying to restore a MS SQL Server RDS database and getting the error message "Database backup/restore option is not enabled yet or is in the process of being enabled. Please try again later." I found this thread about this problem:


Which suggests to add an option to the database's option group. However, the "Add Option" button on the option group is disabled, and the drop-down to select an option group for the database is also disabled. So I can't add an option to the option group, and I can't make a new option group and choose that. I learned that you cannot add options to a default option group, so I definitely need to create an option group. I still don't know why I can't change the option group of an existing RDS instance.

So I made a new option group, no problem. I made a brand new RDS instance so I could pick a different option group. On the new option group I created I can click Add Option, but can't successfully complete the process. I created an IAM role with the RDS full access permission, and when attempting to add the backup/restore option with that role to the option group, I get this:

"IAM role ARN value is invalid or does not include the required permissions for: SQLSERVER_BACKUP_RESTORE (Service: AmazonRDS; Status Code: 400; Error Code: InvalidParameterValue; Request ID: 3824d081-648a-11e6-9c94-87e171d2e1f8)"

I don't know a lot about IAM so I'm not sure what to do with this. Ideas?


I got another response on the AWS forum. Here's the suggestion and my results.

Please try the following steps -

  1. Select Option Groups from the left hand side panel in RDS Console
  2. Select the Option group you created and click on the Add Option button
  3. Select SQL_SERVER_BACKUP_RESTORE in the Option drop-down.
  4. Click the text Create a New Role under the IAM Role drop-down. This will show you options for IAM Role creation.
  5. Add a name for the IAM Role, select the S3 bucket you want to use and check Yes for the Apply Immediately radio button.
  6. Click the Add Option button.


That sounded good! But after I click Add Option at the bottom of the form, the button disabled for a few seconds and then the IAM Role Name field was surrounded by red. I've attached a screenshot. Clicking on the exclamation mark or anywhere in the red doesn't bring up any additional information. I've tried a couple of different names with the same result. Are there rules about the name that the page doesn't specify? Thanks again for your help.

enter image description here

  • 2
    What did AWS support say about this? If you don't have a support plan, just pay for a month and then cancel after you get your question answered. It's well worth the cost.
    – EEAA
    Aug 22, 2016 at 16:01
  • I will suggest that to my boss if I don't get an answer another way.
    – nasch
    Aug 22, 2016 at 16:04
  • Don't enter a name in that field. Try the IAM Role select box instead, Aug 29, 2016 at 9:00
  • When I do that I get the same error as before: IAM role ARN value is invalid or does not include the required permissions for: SQLSERVER_BACKUP_RESTORE (Service: AmazonRDS; Status Code: 400; Error Code: InvalidParameterValue; Request ID: ab04cad7-6df2-11e6-bae8-737d9f5a0a02)
    – nasch
    Aug 29, 2016 at 14:13
  • It looks like the IAM role has to have permissions for the s3 bucket from which the restore will occur, not just permissions on the database. Aug 31, 2016 at 12:12

2 Answers 2


I signed up for paid support and here's the answer, in case it helps anyone else. I had to edit the trust policy on the IAM role like so:

    "Version": "2012-10-17",
        "Effect": "Allow",
        "Principal": {"Service":  "rds.amazonaws.com"},
        "Action": "sts:AssumeRole"

Then I was able to add the option to the option group and the restore worked. Note that the trust policy is called "trust relationship" on the web console.


Below is the policy for a role with the permissions that should work:

  "Version": "2012-10-17",
  "Statement": [
      "Sid": "Stmt1472672338000",
      "Effect": "Allow",
      "Action": [
      "Resource": [
  • I don't understand. By "my IAM user" do you mean the credentials I'm using to log in to the dashboard? If so, I'm using the root credentials and I can create roles just fine. Do you mean the IAM role that I'm trying to put on the option? If so, why does that role need to create other roles? Can you point me to where I would need to save this policy to get this working? Do I need to create a custom policy and then set it on the role I created?
    – nasch
    Aug 31, 2016 at 20:00
  • Maybe this IAM role (highlighted with red) already exist? Aug 31, 2016 at 22:16
  • No, I've tried it at least three times with names that don't already exist.
    – nasch
    Aug 31, 2016 at 22:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .