AWSBackupFullAccess
Last Modified
Mar 12, 2026
March 12, 2026 at 09:25 PM UTC
Version
v30
Total Versions
24
Created
Feb 12, 2026
Actions
121
Risk
HighAn unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- High
Can take over existing resources that run as another role
Grants every action of 1 documented escalation path on any resource with no condition.
Use with caution: List the roles attached to the functions, instances, pipelines or notebooks it can modify: the holder effectively has them too.
- Medium
Can rewrite resource policies and sharing
Grants 4 permissions management actions across 1 service (backup) on any resource, enough to share resources outside the account.
backup:deletebackupvaultaccesspolicybackup:deletebackupvaultsharingpolicybackup:putbackupvaultaccesspolicybackup:putbackupvaultsharingpolicyUse with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.
- Medium
Full access to 2 services on every resource
Uses backup:*, backup-storage:* with Resource "*" and no condition, so every action AWS adds to those services later is granted too.
backup:*backup-storage:*Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AwsBackupAllAccessPermissions",
"Effect": "Allow",
"Action": "backup:*",
"Resource": "*"
},
{
"Sid": "AwsBackupStorageAllAccessPermissions",
"Effect": "Allow",
"Action": "backup-storage:*",
"Resource": "*"
},
{
"Sid": "RdsPermissions",
"Effect": "Allow",
"Action": [
"rds:DescribeDBSnapshots",
"rds:ListTagsForResource",
"rds:DescribeDBInstances",
"rds:describeDBEngineVersions",
"rds:describeOptionGroups",
"rds:describeOrderableDBInstanceOptions",
"rds:describeDBSubnetGroups",
"rds:describeDBClusterSnapshots",
"rds:describeDBClusters",
"rds:describeDBParameterGroups",
"rds:DescribeDBClusterParameterGroups",
"rds:DescribeDBInstanceAutomatedBackups",
"rds:DescribeDBClusterAutomatedBackups"
],
"Resource": "*"
},
{
"Sid": "RdsDeletePermissions",
"Effect": "Allow",
"Action": [
"rds:DeleteDBSnapshot",
"rds:DeleteDBClusterSnapshot"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"backup.amazonaws.com"
]
}
}
},
{
"Sid": "DynamoDbPermissions",
"Effect": "Allow",
"Action": [
"dynamodb:ListBackups",
"dynamodb:ListTables"
],
"Resource": "*"
},
{
"Sid": "DynamoDbDeleteBackupPermissions",
"Effect": "Allow",
"Action": [
"dynamodb:DeleteBackup"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"backup.amazonaws.com"
]
}
}
},
{
"Sid": "EfsFileSystemPermissions",
"Effect": "Allow",
"Action": [
"elasticfilesystem:DescribeFilesystems"
],
"Resource": "arn:aws:elasticfilesystem:*:*:file-system/*"
},
{
"Sid": "Ec2Permissions",
"Effect": "Allow",
"Action": [
"ec2:DescribeSnapshots",
"ec2:DescribeVolumes",
"ec2:describeAvailabilityZones",
"ec2:DescribeVpcs",
"ec2:DescribeAccountAttributes",
"ec2:DescribeSecurityGroups",
"ec2:DescribeImages",
"ec2:DescribeSubnets",
"ec2:DescribePlacementGroups",
"ec2:DescribeInstances",
"ec2:DescribeInstanceTypes",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeAddresses"
],
"Resource": "*"
},
{
"Sid": "Ec2DeletePermissions",
"Effect": "Allow",
"Action": [
"ec2:DeleteSnapshot",
"ec2:DeregisterImage"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"backup.amazonaws.com"
]
}
}
},
{
"Sid": "ResourceGroupTaggingPermissions",
"Effect": "Allow",
"Action": [
"tag:GetTagKeys",
"tag:GetTagValues",
"tag:GetResources"
],
"Resource": "*"
},
{
"Sid": "StorageGatewayVolumePermissions",
"Effect": "Allow",
"Action": [
"storagegateway:DescribeCachediSCSIVolumes",
"storagegateway:DescribeStorediSCSIVolumes"
],
"Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*"
},
{
"Sid": "StorageGatewayPermissions",
"Effect": "Allow",
"Action": [
"storagegateway:ListGateways"
],
"Resource": "arn:aws:storagegateway:*:*:*"
},
{
"Sid": "StorageGatewayGatewayPermissions",
"Effect": "Allow",
"Action": [
"storagegateway:DescribeGatewayInformation",
"storagegateway:ListLocalDisks"
],
"Resource": "arn:aws:storagegateway:*:*:gateway/*"
},
{
"Sid": "StorageGatewayGatewayStarPermissions",
"Effect": "Allow",
"Action": [
"storagegateway:ListVolumes"
],
"Resource": "*"
},
{
"Sid": "IamRolePermissions",
"Effect": "Allow",
"Action": [
"iam:ListRoles",
"iam:GetRole"
],
"Resource": "*"
},
{
"Sid": "IamPassRolePermissions",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": [
"arn:aws:iam::*:role/*AwsBackup*",
"arn:aws:iam::*:role/*AWSBackup*"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"backup.amazonaws.com",
"restore-testing.backup.amazonaws.com"
]
}
}
},
{
"Sid": "AwsOrganizationsPermissions",
"Effect": "Allow",
"Action": "organizations:DescribeOrganization",
"Resource": "*"
},
{
"Sid": "KmsPermissions",
"Effect": "Allow",
"Action": [
"kms:ListKeys",
"kms:DescribeKey",
"kms:GenerateDataKey",
"kms:ListAliases"
],
"Resource": "*"
},
{
"Sid": "KmsCreateGrantPermissions",
"Effect": "Allow",
"Action": [
"kms:CreateGrant"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"kms:EncryptionContextKeys": "aws:backup:backup-vault"
},
"Bool": {
"kms:GrantIsForAWSResource": true
},
"StringLike": {
"kms:ViaService": "backup.*.amazonaws.com"
}
}
},
{
"Sid": "SystemManagerCommandPermissions",
"Effect": "Allow",
"Action": [
"ssm:CancelCommand",
"ssm:GetCommandInvocation"
],
"Resource": "*"
},
{
"Sid": "SystemManagerSendCommandPermissions",
"Effect": "Allow",
"Action": "ssm:SendCommand",
"Resource": [
"arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot",
"arn:aws:ec2:*:*:instance/*"
]
},
{
"Sid": "FsxPermissions",
"Effect": "Allow",
"Action": [
"fsx:DescribeFileSystems",
"fsx:DescribeBackups",
"fsx:DescribeVolumes",
"fsx:DescribeStorageVirtualMachines"
],
"Resource": "*"
},
{
"Sid": "FsxDeletePermissions",
"Effect": "Allow",
"Action": "fsx:DeleteBackup",
"Resource": "arn:aws:fsx:*:*:backup/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"backup.amazonaws.com"
]
}
}
},
{
"Sid": "DirectoryServicePermissions",
"Effect": "Allow",
"Action": "ds:DescribeDirectories",
"Resource": "*"
},
{
"Sid": "IamCreateServiceLinkedRolePermissions",
"Effect": "Allow",
"Action": "iam:CreateServiceLinkedRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"iam:AWSServiceName": [
"backup.amazonaws.com",
"restore-testing.backup.amazonaws.com"
]
}
}
},
{
"Sid": "BackupGatewayPermissions",
"Effect": "Allow",
"Action": [
"backup-gateway:AssociateGatewayToServer",
"backup-gateway:CreateGateway",
"backup-gateway:DeleteGateway",
"backup-gateway:DeleteHypervisor",
"backup-gateway:DisassociateGatewayFromServer",
"backup-gateway:ImportHypervisorConfiguration",
"backup-gateway:ListGateways",
"backup-gateway:ListHypervisors",
"backup-gateway:ListTagsForResource",
"backup-gateway:ListVirtualMachines",
"backup-gateway:PutMaintenanceStartTime",
"backup-gateway:TagResource",
"backup-gateway:TestHypervisorConfiguration",
"backup-gateway:UntagResource",
"backup-gateway:UpdateGatewayInformation",
"backup-gateway:UpdateHypervisor"
],
"Resource": "*"
},
{
"Sid": "BackupGatewayHypervisorPermissions",
"Effect": "Allow",
"Action": [
"backup-gateway:GetHypervisor",
"backup-gateway:GetHypervisorPropertyMappings",
"backup-gateway:PutHypervisorPropertyMappings",
"backup-gateway:StartVirtualMachinesMetadataSync"
],
"Resource": "arn:aws:backup-gateway:*:*:hypervisor/*"
},
{
"Sid": "BackupGatewayVirtualMachinePermissions",
"Effect": "Allow",
"Action": [
"backup-gateway:GetVirtualMachine"
],
"Resource": "arn:aws:backup-gateway:*:*:vm/*"
},
{
"Sid": "BackupGatewayGatewayPermissions",
"Effect": "Allow",
"Action": [
"backup-gateway:GetBandwidthRateLimitSchedule",
"backup-gateway:GetGateway",
"backup-gateway:PutBandwidthRateLimitSchedule"
],
"Resource": "arn:aws:backup-gateway:*:*:gateway/*"
},
{
"Sid": "CloudWatchPermissions",
"Effect": "Allow",
"Action": "cloudwatch:GetMetricData",
"Resource": "*"
},
{
"Sid": "TimestreamDatabasePermissions",
"Effect": "Allow",
"Action": [
"timestream:ListTables",
"timestream:ListDatabases"
],
"Resource": [
"arn:aws:timestream:*:*:database/*"
]
},
{
"Sid": "TimestreamPermissions",
"Effect": "Allow",
"Action": [
"timestream:DescribeEndpoints"
],
"Resource": "*"
},
{
"Sid": "S3BucketPermissions",
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets"
],
"Resource": "arn:aws:s3:::*"
},
{
"Sid": "RedshiftResourcesPermissions",
"Effect": "Allow",
"Action": [
"redshift:DescribeClusters",
"redshift:DescribeClusterSubnetGroups",
"redshift:DescribeClusterSnapshots",
"redshift:DescribeSnapshotSchedules"
],
"Resource": [
"arn:aws:redshift:*:*:cluster:*",
"arn:aws:redshift:*:*:subnetgroup:*",
"arn:aws:redshift:*:*:snapshot:*/*",
"arn:aws:redshift:*:*:snapshotschedule:*"
]
},
{
"Sid": "RedshiftPermissions",
"Effect": "Allow",
"Action": [
"redshift:DescribeNodeConfigurationOptions",
"redshift:DescribeOrderableClusterOptions",
"redshift:DescribeClusterParameterGroups",
"redshift:DescribeClusterTracks"
],
"Resource": "*"
},
{
"Sid": "RedshiftServerlessListPermissions",
"Effect": "Allow",
"Action": [
"redshift-serverless:ListNamespaces",
"redshift-serverless:ListSnapshots",
"redshift-serverless:ListWorkgroups"
],
"Resource": [
"*"
]
},
{
"Sid": "RedshiftServerlessGetPermissions",
"Effect": "Allow",
"Action": [
"redshift-serverless:GetNamespace",
"redshift-serverless:GetSnapshot",
"redshift-serverless:GetWorkgroup"
],
"Resource": [
"arn:aws:redshift-serverless:*:*:namespace/*",
"arn:aws:redshift-serverless:*:*:workgroup/*",
"arn:aws:redshift-serverless:*:*:snapshot/*"
]
},
{
"Sid": "RedshiftServerlessDeletetPermissions",
"Effect": "Allow",
"Action": [
"redshift-serverless:DeleteSnapshot"
],
"Resource": [
"arn:aws:redshift-serverless:*:*:snapshot/*"
],
"Condition": {
"Null": {
"aws:ResourceTag/aws:backup:source-resource": "false"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"backup.amazonaws.com"
]
}
}
},
{
"Sid": "CloudFormationStackPermissions",
"Effect": "Allow",
"Action": [
"cloudformation:ListStacks"
],
"Resource": [
"arn:aws:cloudformation:*:*:stack/*"
]
},
{
"Sid": "SystemsManagerForSapPermissions",
"Effect": "Allow",
"Action": [
"ssm-sap:GetOperation",
"ssm-sap:ListDatabases",
"ssm-sap:GetDatabase",
"ssm-sap:ListTagsForResource"
],
"Resource": "*"
},
{
"Sid": "ResourceAccessManagerPermissions",
"Effect": "Allow",
"Action": [
"ram:GetResourceShareAssociations"
],
"Resource": "*"
},
{
"Sid": "DSQLDescribePermissions",
"Effect": "Allow",
"Action": [
"dsql:GetCluster",
"dsql:ListClusters",
"dsql:ListTagsForResource"
],
"Resource": "*"
},
{
"Sid": "EKSClusterPermissions",
"Effect": "Allow",
"Action": [
"eks:ListClusters",
"eks:ListTagsForResource",
"eks:DescribeCluster"
],
"Resource": "arn:aws:eks:*:*:cluster/*"
},
{
"Sid": "IamPassRolePermissionsForGuardDuty",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": [
"arn:aws:iam::*:role/*AwsBackupGuardDuty*",
"arn:aws:iam::*:role/*AWSBackupGuardDuty*"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "malware-protection.guardduty.amazonaws.com"
}
}
}
]
},
"VersionId": "v30",
"IsDefaultVersion": true,
"CreateDate": "2026-02-12T18:02:46+00:00"
}
}Version History (29 recorded)
Raw historyAWSBackupFullAccess - Policy Version v30
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
910ac33AWSBackupFullAccess - Policy Version v30
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
9a81985AWSBackupFullAccess - Policy Version v26
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
8fe64f3AWSBackupFullAccess - Policy Version v22
No recorded action delta - this version predates the change index. View the raw diff.
Nov 20, 2025
57b0f7eAWSBackupFullAccess - Policy Version v21
No recorded action delta - this version predates the change index. View the raw diff.
Nov 10, 2025
295137eUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
May 22, 2025
e10cfecUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 27, 2025
ee2eaabUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 26, 2024
c4ee33bUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 27, 2023
c0252e1Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 27, 2023
79c41c1Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 6, 2023
8ac10c9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 8, 2023
e55b1adUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Dec 15, 2022
b2c36a3Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 10, 2022
c6a1fbbUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 25, 2022
c8f1c74Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 24, 2022
b6e4243Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jun 1, 2022
7917628Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2022
c848525