AWSBackupOperatorAccess
Last Modified
Mar 12, 2026
March 12, 2026 at 09:25 PM UTC
Version
v28
Total Versions
21
Created
Feb 12, 2026
Actions
100
Risk
HighAn unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- High
Can take over existing resources that run as another role
Grants every action of 1 documented escalation path on any resource with no condition.
Use with caution: List the roles attached to the functions, instances, pipelines or notebooks it can modify: the holder effectively has them too.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AwsBackupAllAccess",
"Effect": "Allow",
"Action": [
"backup:Get*",
"backup:List*",
"backup:Describe*",
"backup:CreateBackupSelection",
"backup:DeleteBackupSelection",
"backup:StartBackupJob",
"backup:StartRestoreJob",
"backup:StartCopyJob",
"backup:StartScanJob"
],
"Resource": "*"
},
{
"Sid": "RDSDescribeAccess",
"Effect": "Allow",
"Action": [
"rds:DescribeDBSnapshots",
"rds:ListTagsForResource",
"rds:DescribeDBInstances",
"rds:describeDBEngineVersions",
"rds:describeOptionGroups",
"rds:describeOrderableDBInstanceOptions",
"rds:describeDBSubnetGroups",
"rds:DescribeDBClusterSnapshots",
"rds:DescribeDBClusters",
"rds:DescribeDBParameterGroups",
"rds:DescribeDBClusterParameterGroups",
"rds:DescribeDBInstanceAutomatedBackups",
"rds:DescribeDBClusterAutomatedBackups"
],
"Resource": "*"
},
{
"Sid": "DynamoDBAccess",
"Effect": "Allow",
"Action": [
"dynamodb:ListBackups",
"dynamodb:ListTables"
],
"Resource": "*"
},
{
"Sid": "EFSAccess",
"Effect": "Allow",
"Action": [
"elasticfilesystem:DescribeFilesystems"
],
"Resource": "arn:aws:elasticfilesystem:*:*:file-system/*"
},
{
"Sid": "EC2Access",
"Effect": "Allow",
"Action": [
"ec2:DescribeSnapshots",
"ec2:DescribeVolumes",
"ec2:describeAvailabilityZones",
"ec2:DescribeVpcs",
"ec2:DescribeAccountAttributes",
"ec2:DescribeSecurityGroups",
"ec2:DescribeImages",
"ec2:DescribeSubnets",
"ec2:DescribePlacementGroups",
"ec2:DescribeInstances",
"ec2:DescribeInstanceTypes",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeAddresses"
],
"Resource": "*"
},
{
"Sid": "TagReadAccess",
"Effect": "Allow",
"Action": [
"tag:GetTagKeys",
"tag:GetTagValues",
"tag:GetResources"
],
"Resource": "*"
},
{
"Sid": "StorageGatewaySCSIAccess",
"Effect": "Allow",
"Action": [
"storagegateway:DescribeCachediSCSIVolumes",
"storagegateway:DescribeStorediSCSIVolumes"
],
"Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*"
},
{
"Sid": "StorageGatewayReadAccess",
"Effect": "Allow",
"Action": [
"storagegateway:ListGateways"
],
"Resource": "arn:aws:storagegateway:*:*:*"
},
{
"Sid": "StorageGatewayDiskReadAccess",
"Effect": "Allow",
"Action": [
"storagegateway:DescribeGatewayInformation",
"storagegateway:ListLocalDisks"
],
"Resource": "arn:aws:storagegateway:*:*:gateway/*"
},
{
"Sid": "StorageGatewayVolumeReadAccess",
"Effect": "Allow",
"Action": [
"storagegateway:ListVolumes"
],
"Resource": "*"
},
{
"Sid": "IAMRoleAccess",
"Effect": "Allow",
"Action": [
"iam:ListRoles",
"iam:GetRole"
],
"Resource": "*"
},
{
"Sid": "PassRoleAccess",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": [
"arn:aws:iam::*:role/*AwsBackup*",
"arn:aws:iam::*:role/*AWSBackup*"
],
"Condition": {
"StringLike": {
"iam:PassedToService": "backup.amazonaws.com"
}
}
},
{
"Sid": "OrganizationsAccess",
"Effect": "Allow",
"Action": "organizations:DescribeOrganization",
"Resource": "*"
},
{
"Sid": "SSMReadAccess",
"Effect": "Allow",
"Action": [
"ssm:CancelCommand",
"ssm:GetCommandInvocation"
],
"Resource": "*"
},
{
"Sid": "SSMComandAccess",
"Effect": "Allow",
"Action": "ssm:SendCommand",
"Resource": [
"arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot",
"arn:aws:ec2:*:*:instance/*"
]
},
{
"Sid": "FSXDescribeAccess",
"Effect": "Allow",
"Action": "fsx:DescribeBackups",
"Resource": "arn:aws:fsx:*:*:backup/*"
},
{
"Sid": "FSxFileAccess",
"Effect": "Allow",
"Action": "fsx:DescribeFileSystems",
"Resource": "arn:aws:fsx:*:*:file-system/*"
},
{
"Sid": "FSxVolumeAccess",
"Effect": "Allow",
"Action": "fsx:DescribeVolumes",
"Resource": "arn:aws:fsx:*:*:volume/*/*"
},
{
"Sid": "FSxMachineAccess",
"Effect": "Allow",
"Action": "fsx:DescribeStorageVirtualMachines",
"Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*/*"
},
{
"Sid": "DirectoryServiceAccess",
"Effect": "Allow",
"Action": "ds:DescribeDirectories",
"Resource": "*"
},
{
"Sid": "BackupGatewayListAccess",
"Effect": "Allow",
"Action": [
"backup-gateway:ListGateways",
"backup-gateway:ListHypervisors",
"backup-gateway:ListTagsForResource",
"backup-gateway:ListVirtualMachines"
],
"Resource": "*"
},
{
"Sid": "BackupGatewayHypervisorAccess",
"Effect": "Allow",
"Action": [
"backup-gateway:GetHypervisor",
"backup-gateway:GetHypervisorPropertyMappings"
],
"Resource": "arn:aws:backup-gateway:*:*:hypervisor/*"
},
{
"Sid": "BackupGatewayMachineAccess",
"Effect": "Allow",
"Action": [
"backup-gateway:GetVirtualMachine"
],
"Resource": "arn:aws:backup-gateway:*:*:vm/*"
},
{
"Sid": "BackupGatewayAccess",
"Effect": "Allow",
"Action": [
"backup-gateway:GetBandwidthRateLimitSchedule",
"backup-gateway:GetGateway"
],
"Resource": "arn:aws:backup-gateway:*:*:gateway/*"
},
{
"Sid": "CloudWatchAccess",
"Effect": "Allow",
"Action": "cloudwatch:GetMetricData",
"Resource": "*"
},
{
"Sid": "TimestreamListAccess",
"Effect": "Allow",
"Action": [
"timestream:ListDatabases",
"timestream:ListTables"
],
"Resource": [
"arn:aws:timestream:*:*:database/*"
]
},
{
"Sid": "TimestreamDescribeAccess",
"Effect": "Allow",
"Action": [
"timestream:DescribeEndpoints"
],
"Resource": "*"
},
{
"Sid": "S3ListAccess",
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets"
],
"Resource": "arn:aws:s3:::*"
},
{
"Sid": "RedshiftAccess",
"Effect": "Allow",
"Action": [
"redshift:DescribeClusters",
"redshift:DescribeClusterSubnetGroups",
"redshift:DescribeClusterSnapshots",
"redshift:DescribeSnapshotSchedules"
],
"Resource": [
"arn:aws:redshift:*:*:cluster:*",
"arn:aws:redshift:*:*:subnetgroup:*",
"arn:aws:redshift:*:*:snapshot:*/*",
"arn:aws:redshift:*:*:snapshotschedule:*"
]
},
{
"Sid": "RedshiftOptionsAccess",
"Effect": "Allow",
"Action": [
"redshift:DescribeNodeConfigurationOptions",
"redshift:DescribeOrderableClusterOptions",
"redshift:DescribeClusterParameterGroups",
"redshift:DescribeClusterTracks"
],
"Resource": "*"
},
{
"Sid": "RedshiftServerlessListPermissions",
"Effect": "Allow",
"Action": [
"redshift-serverless:ListNamespaces",
"redshift-serverless:ListSnapshots",
"redshift-serverless:ListWorkgroups"
],
"Resource": [
"*"
]
},
{
"Sid": "RedshiftServerlessGetPermissions",
"Effect": "Allow",
"Action": [
"redshift-serverless:GetNamespace",
"redshift-serverless:GetSnapshot",
"redshift-serverless:GetWorkgroup"
],
"Resource": [
"arn:aws:redshift-serverless:*:*:namespace/*",
"arn:aws:redshift-serverless:*:*:workgroup/*",
"arn:aws:redshift-serverless:*:*:snapshot/*"
]
},
{
"Sid": "CloudFormationAccess",
"Effect": "Allow",
"Action": [
"cloudformation:ListStacks"
],
"Resource": [
"arn:aws:cloudformation:*:*:stack/*"
]
},
{
"Sid": "SAPAccess",
"Effect": "Allow",
"Action": [
"ssm-sap:GetOperation",
"ssm-sap:ListDatabases"
],
"Resource": "*"
},
{
"Sid": "SAPDatabaseAccess",
"Effect": "Allow",
"Action": [
"ssm-sap:GetDatabase",
"ssm-sap:ListTagsForResource"
],
"Resource": "arn:aws:ssm-sap:*:*:*"
},
{
"Sid": "RAMAccess",
"Effect": "Allow",
"Action": [
"ram:GetResourceShareAssociations"
],
"Resource": "*"
},
{
"Sid": "DSQLDescribePermissions",
"Effect": "Allow",
"Action": [
"dsql:GetCluster",
"dsql:ListClusters",
"dsql:ListTagsForResource"
],
"Resource": "*"
},
{
"Sid": "EKSClusterPermissions",
"Effect": "Allow",
"Action": [
"eks:ListClusters",
"eks:ListTagsForResource",
"eks:DescribeCluster"
],
"Resource": "arn:aws:eks:*:*:cluster/*"
},
{
"Sid": "IamPassRolePermissionsForGuardDuty",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": [
"arn:aws:iam::*:role/*AwsBackupGuardDuty*",
"arn:aws:iam::*:role/*AWSBackupGuardDuty*"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "malware-protection.guardduty.amazonaws.com"
}
}
}
]
},
"VersionId": "v28",
"IsDefaultVersion": true,
"CreateDate": "2026-02-12T17:59:22+00:00"
}
}Version History (26 recorded)
Raw historyAWSBackupOperatorAccess - Policy Version v28
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
62b6e40AWSBackupOperatorAccess - Policy Version v28
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
a3272cfAWSBackupOperatorAccess - Policy Version v24
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
e058824AWSBackupOperatorAccess - Policy Version v20
No recorded action delta - this version predates the change index. View the raw diff.
Nov 20, 2025
68ca8c0AWSBackupOperatorAccess - Policy Version v19
No recorded action delta - this version predates the change index. View the raw diff.
Nov 10, 2025
e54496fUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
May 22, 2025
e10cfecUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 27, 2025
ee2eaabUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jul 24, 2024
18f48e4Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 6, 2023
8ac10c9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 8, 2023
e55b1adUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Dec 15, 2022
b2c36a3Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 10, 2022
c6a1fbbUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 25, 2022
c8f1c74Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 24, 2022
b6e4243Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jun 1, 2022
7917628Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2022
c848525Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 23, 2021
44e3e6aUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 10, 2021
6828157