Error: Error getting Backup Vault: AccessDeniedException:

I ran into this issue using terraform. I figured this out by adding the "backup-storage:MountCapsule" permission to the policy of the role I am using to create the resource. Here is a slightly edited policy and role configuration. Hopefully, this helps someone.

data "aws_iam_policy_document" "CloudFormationServicePolicy" {
  statement {
    sid    = "AllResources"
    effect = "Allow"
    actions = [
      "backup:*",
      "backup-storage:MountCapsule",
      ...
    ]
    resources = ["*"]
  }

  statement {
    sid       = "IAM"
    effect    = "Allow"
    actions   = ["iam:PassRole"]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "CloudFormationServicePolicy" {
  name        = "${local.resource_name}-CloudFormationServicePolicy"
  description = "policy for the IAM role "
  path        = "/${local.metadata["project"]}/${local.metadata["application"]}/"
  policy      = data.aws_iam_policy_document.CloudFormationServicePolicy.json
}

resource "aws_iam_role" "CloudFormationServiceRole" {
  name                  = "${local.resource_name}-CloudFormationServiceRole"
  description           = "Allow cluster to manage node groups, fargate nodes and cloudwatch logs"
  force_detach_policies = true
  assume_role_policy = jsonencode({
    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Action" : "sts:AssumeRole",
        "Principal" : {
          "Service" : ["cloudformation.amazonaws.com", "ecs-tasks.amazonaws.com"]
        },
        "Effect" : "Allow",
        "Sid" : "TrustStatement"
      },
      {
        "Effect" : "Allow",
        "Principal" : {
          "AWS" : "arn:aws:iam::xxxxxxx:role/OrganizationAdministratorRole"
        },
        "Action" : "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "CloudFormationService_task_role_policy_attachment" {
  role       = aws_iam_role.CloudFormationServiceRole.name
  policy_arn = aws_iam_policy.CloudFormationServicePolicy.arn
}