Managed policies for AWS Backup

Managed policies are standalone identity-based policies that you can attach to multiple users, groups, and roles in your AWS account. When you attach a policy to a principal entity, you give the entity the permissions that are defined in the policy.

AWS managed policies are created and administered by AWS. You can't change the permissions defined in AWS managed policies. If AWS updates the permissions defined in an AWS managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to.

Customer managed policies give you fine-grained controls to set access to backups in AWS Backup. For example, you can use them to give your database backup administrator access to Amazon RDS backups but not Amazon EFS ones.

For more information, see Managed policies in the IAM User Guide.

AWS managed policies

AWS Backup provides the following AWS managed policies for common use cases. These policies make it easier to define the right permissions and control access to your backups. There are two types of managed policies. One type is designed to be assigned to users to control their access to AWS Backup. The other type of managed policy is designed to be attached to roles that you pass to AWS Backup. The following table lists all the managed policies that AWS Backup provides and describes how they are defined. You can find these managed policies in the Policies section of the IAM console.

AWSBackupAuditAccess

This policy grants permissions for users to create controls and frameworks that define their expectations for AWS Backup resources and activities, and to audit AWS Backup resources and activities against their defined controls and frameworks. This policy grants permissions to AWS Config and similar services to describe user expectations perform the audits.

This policy also grants permissions to deliver audit reports to Amazon S3 and similar services, and enables users to find and open their audit reports.

To view the permissions for this policy, see AWSBackupAuditAccess in the AWS Managed Policy Reference.

AWSBackupAccessPointOperatorAccess

Access point operators are users who need to access backup data in recovery points without performing a full restore. Access point operators have permissions to create, describe, delete, and list backup access points.

This policy contains the necessary permissions for those functions.

To view the permissions for this policy, see AWSBackupAccessPointOperatorAccess in the AWS Managed Policy Reference.

AWSBackupDataTransferAccess

This policy provides permissions for the AWS Backup storage plane data transfer APIs, allowing the AWS Backint agent to complete backup data transfer with the AWS Backup storage plane. You can attach this policy to roles assumed by Amazon EC2 instances running SAP HANA with the Backint agent.

To view the permissions for this policy, see AWSBackupDataTransferAccess in the AWS Managed Policy Reference.

AWSBackupFullAccess

The backup administrator has full access to AWS Backup operations, including creating or editing backup plans, assigning AWS resources to backup plans, and restoring backups. Backup administrators are responsible for determining and enforcing backup compliance by defining backup plans that meet their organization's business and regulatory requirements. Backup administrators also ensure that their organization's AWS resources are assigned to the appropriate plan.

To view the permissions for this policy, see AWSBackupFullAccess in the AWS Managed Policy Reference.

AWSBackupGatewayServiceRolePolicyForVirtualMachineMetadataSync

This policy provides Backup gateway permission to sync the metadata of Virtual Machines on your behalf

To view the permissions for this policy, see AWSBackupGatewayServiceRolePolicyForVirtualMachineMetadataSync in the AWS Managed Policy Reference.

AWSBackupGuardDutyRolePolicyForScans

This policy must be added to a new scanning role that grants Amazon GuardDuty permission to read and scan your backups. You'll need to attach this scanning role to your backup plan within the malware protection or scan settings. When AWS Backup initiates a scan, it passes this scanning role to Amazon GuardDuty.

To view the permissions for this policy, see AWSBackupGuardDutyRolePolicyForScans in the AWS Managed Policy Reference.

AWSBackupOperatorAccess

Backup operators are users that are responsible for ensuring the resources that they are responsible for are properly backed up. Backup operators have permissions to assign AWS resources to the backup plans that the backup administrator creates. They also have permissions to create on-demand backups of their AWS resources and to configure the retention period of on-demand backups. Backup operators do not have permissions to create or edit backup plans or to delete scheduled backups after they are created. Backup operators can restore backups. You can limit the resource types that a backup operator can assign to a backup plan or restore from a backup. You do this by allowing only certain service roles to be passed to AWS Backup that have permissions for a certain resource type.

To view the permissions for this policy, see AWSBackupOperatorAccess in the AWS Managed Policy Reference.

AWSBackupOrganizationAdminAccess

The organization administrator has full access to AWS Organizations operations, including creating, editing, or deleting backup policies, assigning backup policies to accounts and organizational units, and monitoring backup activities within the organization. Organization administrators are responsible for protecting accounts in their organization by defining and assigning backup policies that meet their organization's business and regulatory requirements.

To view the permissions for this policy, see AWSBackupOrganizationAdminAccess in the AWS Managed Policy Reference.

AWSBackupRestoreAccessForSAPHANA

This policy provides AWS Backup permission to restore a backup of SAP HANA on Amazon EC2.

To view the permissions for this policy, see AWSBackupRestoreAccessForSAPHANA in the AWS Managed Policy Reference.

AWSBackupSearchOperatorAccess

The search operator role has access to create backup indexes and to create searches of indexed backup metadata.

This policy contains the necessary permissions for those functions.

To view the permissions for this policy, see AWSBackupSearchOperatorAccess in the AWS Managed Policy Reference.

AWSBackupServiceLinkedRolePolicyForBackup

This policy is attached to the service-linked role named AWSServiceRoleforBackup to allow AWS Backup to call AWS services on your behalf to manage your backups. For more information, see Using roles to back up and copy.

To view the permissions for this policy, see AWSBackupServiceLinkedRolePolicyforBackup in the AWS Managed Policy Reference.

AWSBackupServiceLinkedRolePolicyForBackupTest

To view the permissions for this policy, see AWSBackupServiceLinkedRolePolicyForBackupTest in the AWS Managed Policy Reference.

AWSBackupServiceRolePolicyForBackup

Provides AWS Backup permissions to create backups of all supported resource types on your behalf.

To view the permissions for this policy, see AWSBackupServiceRolePolicyForBackup in the AWS Managed Policy Reference.

AWSBackupServiceRolePolicyForItemRestores

Description

This policy grants users permissions to restore individual files and items in a snapshot (periodic backup recovery point) to a new or existing Amazon S3 bucket or new Amazon EBS volume. These permissions include: read permissions to Amazon EBS for snapshots managed by AWS Backup read/write permissions to Amazon S3 buckets, and generate and describe permissions for AWS KMS keys.

Using this policy

You can attach AWSBackupServiceRolePolicyForItemRestores to your users, groups, and roles.

Policy details

Policy version: v1 (default)

This policy’s version defines the permissions for the policy. When the user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request or not.

JSON policy document:

AWSBackupServiceRolePolicyForIndexing

Description

This policy grants users permissions to index snapshot, also known as periodic, recovery points. These permissions include: read permissions to Amazon EBS for snapshots managed by AWS Backup read/write permissions to Amazon S3 buckets, and generate and describe permissions for AWS KMS keys.

Using this policy

You can attach AWSBackupServiceRolePolicyForIndexing to your users, groups, and roles.

Policy details

Policy version: v1 (default)

This policy’s version defines the permissions for the policy. When the user or or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request or not.

JSON policy document:

AWSBackupServiceRolePolicyForRestores

Provides AWS Backup permissions to restore backups of all supported resource types on your behalf.

To view the permissions for this policy, see AWSBackupServiceRolePolicyForRestores in the AWS Managed Policy Reference.

For EC2 instance restores, you must also include the following permissions to launch the EC2 instance:

AWSBackupServiceRolePolicyForS3Backup

This policy contains the permissions necessary for AWS Backup to back up any S3 bucket. This includes access to all objects in a bucket and any associated AWS KMS key.

To view the permissions for this policy, see AWSBackupServiceRolePolicyForS3Backup in the AWS Managed Policy Reference.

AWSBackupServiceRolePolicyForS3Restore

This policy contains permissions necessary for AWS Backup to restore an S3 backup to a bucket. This includes read and write permissions to the buckets and the usage of any AWS KMS key in regards to S3 operations.

To view the permissions for this policy, see AWSBackupServiceRolePolicyForS3Restore in the AWS Managed Policy Reference.

AWSBackupServiceRolePolicyForScans

The policy should be attached to the IAM role that you use in your backup plan's resource selection. This role grants AWS Backup permission to initiate scans in Amazon GuardDuty.

To view the permissions for this policy, see AWSBackupServiceRolePolicyForScans in the AWS Managed Policy Reference.

AWSServiceRolePolicyForBackupReports

AWS Backup uses this policy for the AWSServiceRoleForBackupReports service-linked role. This service-linked role gives AWS Backup permissions to monitor and report on the compliance of your backup settings, jobs, and resources with your frameworks.

To view the permissions for this policy, see AWSServiceRolePolicyForBackupReports in the AWS Managed Policy Reference.

AWSServiceRolePolicyForBackupRestoreTesting

To view the permissions for this policy, see AWSServiceRolePolicyForBackupRestoreTesting in the AWS Managed Policy Reference.

Customer managed policies

The following sections describe the recommended backup and restore permissions for the AWS services and third-party application supported by AWS Backup. You can use the existing AWS managed policies as a model as you create your own policy documents, and then customize them to further restrict access to your AWS resources.

How to build a customer managed policy from managed policy statements

Each service section below lists the specific statement names (Sids) you need from the AWS Backup managed policies. To build a least-privilege customer managed policy for a specific service, follow these steps:

Alternatively, you can retrieve the full policy JSON using the AWS CLI:

aws iam get-policy-version \
    --policy-arn arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup \
    --version-id $(aws iam get-policy --policy-arn arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup --query "Policy.DefaultVersionId" --output text) \
    --query "PolicyVersion.Document" \
    --output json

This returns the complete policy document, from which you can extract the statements you need by matching the Sid values listed in the service sections below.

{
      "Effect":"Allow",
      "Action": [
        "ec2:DescribeSnapshots",
        "ec2:DescribeVolumes"
      ],
      "Resource":"*"
},

{
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::account-id:role/role-name"
},

{
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeSnapshots"
      ],
      "Resource":"*"
},

Encrypted backup

Policy updates for AWS Backup

View details about updates to AWS managed policies for AWS Backup since this service began tracking these changes.