AWSBackupServiceLinkedRolePolicyForBackup
Last Modified
Mar 12, 2026
March 12, 2026 at 09:25 PM UTC
Version
v31
Total Versions
23
Created
Feb 12, 2026
Actions
102
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "EFSResourcePermissions",
"Effect": "Allow",
"Action": [
"elasticfilesystem:Backup",
"elasticfilesystem:DescribeTags"
],
"Resource": "arn:aws:elasticfilesystem:*:*:file-system/*",
"Condition": {
"StringLike": {
"aws:ResourceTag/aws:elasticfilesystem:default-backup": "enabled"
}
}
},
{
"Sid": "DescribePermissions",
"Effect": "Allow",
"Action": [
"tag:GetResources",
"elasticfilesystem:DescribeFileSystems",
"dynamodb:ListTables",
"storagegateway:ListVolumes",
"ec2:DescribeVolumes",
"ec2:DescribeInstances",
"rds:DescribeDBInstances",
"rds:DescribeDBClusters",
"fsx:DescribeFileSystems",
"fsx:DescribeVolumes",
"s3:ListAllMyBuckets",
"s3:GetBucketTagging"
],
"Resource": "*"
},
{
"Sid": "SnapshotCopyTagPermissions",
"Effect": "Allow",
"Action": "ec2:CreateTags",
"Resource": "arn:aws:ec2:*::snapshot/*",
"Condition": {
"StringEquals": {
"ec2:CreateAction": "CopySnapshot"
}
}
},
{
"Sid": "EC2CreateBackupTagPermissions",
"Effect": "Allow",
"Action": "ec2:CreateTags",
"Resource": [
"arn:aws:ec2:*::image/*",
"arn:aws:ec2:*::snapshot/*"
],
"Condition": {
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"AWSBackupManagedResource"
]
}
}
},
{
"Sid": "EC2CreateTagsPermissions",
"Effect": "Allow",
"Action": "ec2:CreateTags",
"Resource": [
"arn:aws:ec2:*::image/*",
"arn:aws:ec2:*::snapshot/*"
],
"Condition": {
"Null": {
"ec2:ResourceTag/AWSBackupManagedResource": "false"
}
}
},
{
"Sid": "EC2RDSDescribePermissions",
"Effect": "Allow",
"Action": [
"ec2:DescribeSnapshots",
"ec2:DescribeSnapshotTierStatus",
"ec2:DescribeImages",
"rds:DescribeDBSnapshots",
"rds:DescribeDBClusterSnapshots"
],
"Resource": "*"
},
{
"Sid": "EBSCopyPermissions",
"Effect": "Allow",
"Action": "ec2:CopySnapshot",
"Resource": "arn:aws:ec2:*::snapshot/*"
},
{
"Sid": "EC2CopyPermissions",
"Effect": "Allow",
"Action": "ec2:CopyImage",
"Resource": "*"
},
{
"Sid": "EC2ModifyPermissions",
"Effect": "Allow",
"Action": [
"ec2:DeregisterImage",
"ec2:DeleteSnapshot",
"ec2:ModifySnapshotTier"
],
"Resource": "*",
"Condition": {
"Null": {
"ec2:ResourceTag/AWSBackupManagedResource": "false"
}
}
},
{
"Sid": "RDSInstanceAndSnashotPermissions",
"Effect": "Allow",
"Action": [
"rds:AddTagsToResource",
"rds:CopyDBSnapshot",
"rds:DeleteDBSnapshot",
"rds:DeleteDBInstanceAutomatedBackup"
],
"Resource": "arn:aws:rds:*:*:snapshot:awsbackup:*"
},
{
"Sid": "RDSClusterPermissions",
"Effect": "Allow",
"Action": [
"rds:AddTagsToResource",
"rds:CopyDBClusterSnapshot",
"rds:DeleteDBClusterSnapshot"
],
"Resource": "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*"
},
{
"Sid": "RDSSnapshotTenantDatabasePermissions",
"Effect": "Allow",
"Action": [
"rds:AddTagsToResource"
],
"Resource": [
"arn:aws:rds:*:*:snapshot-tenant-database:awsbackup:*"
]
},
{
"Sid": "KMSDescribePermissions",
"Effect": "Allow",
"Action": "kms:DescribeKey",
"Resource": "*"
},
{
"Sid": "KMSGrantPermissions",
"Effect": "Allow",
"Action": [
"kms:ListGrants",
"kms:ReEncryptFrom",
"kms:GenerateDataKeyWithoutPlaintext"
],
"Resource": "*",
"Condition": {
"StringLike": {
"kms:ViaService": [
"ec2.*.amazonaws.com",
"rds.*.amazonaws.com",
"fsx.*.amazonaws.com"
]
}
}
},
{
"Sid": "KMSCreateGrantPermissions",
"Effect": "Allow",
"Action": "kms:CreateGrant",
"Resource": "*",
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": "true"
},
"StringLike": {
"kms:ViaService": [
"ec2.*.amazonaws.com",
"rds.*.amazonaws.com",
"fsx.*.amazonaws.com"
]
}
}
},
{
"Sid": "FsxPermissions",
"Effect": "Allow",
"Action": [
"fsx:CopyBackup",
"fsx:TagResource",
"fsx:DescribeBackups",
"fsx:DeleteBackup"
],
"Resource": "arn:aws:fsx:*:*:backup/*"
},
{
"Sid": "DynamoDBDeletePermissions",
"Effect": "Allow",
"Action": "dynamodb:DeleteBackup",
"Resource": "arn:aws:dynamodb:*:*:table/*/backup/*"
},
{
"Sid": "BackupGateway",
"Effect": "Allow",
"Action": [
"backup-gateway:ListVirtualMachines"
],
"Resource": "*"
},
{
"Sid": "ListTagsForBackupGateway",
"Effect": "Allow",
"Action": [
"backup-gateway:ListTagsForResource"
],
"Resource": "arn:aws:backup-gateway:*:*:vm/*"
},
{
"Sid": "DynamoDBPermissions",
"Effect": "Allow",
"Action": [
"dynamodb:ListTagsOfResource",
"dynamodb:DescribeTable"
],
"Resource": "arn:aws:dynamodb:*:*:table/*"
},
{
"Sid": "StorageGatewayPermissions",
"Effect": "Allow",
"Action": [
"storagegateway:DescribeCachediSCSIVolumes",
"storagegateway:DescribeStorediSCSIVolumes"
],
"Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*"
},
{
"Sid": "EventBridgePermissions",
"Effect": "Allow",
"Action": [
"events:DeleteRule",
"events:PutTargets",
"events:DescribeRule",
"events:EnableRule",
"events:PutRule",
"events:RemoveTargets",
"events:ListTargetsByRule",
"events:DisableRule"
],
"Resource": [
"arn:aws:events:*:*:rule/AwsBackupManagedRule*"
]
},
{
"Sid": "EventBridgeRulesPermissions",
"Effect": "Allow",
"Action": "events:ListRules",
"Resource": "*"
},
{
"Sid": "SSMSAPPermissions",
"Effect": "Allow",
"Action": [
"ssm-sap:GetOperation",
"ssm-sap:UpdateHANABackupSettings"
],
"Resource": "*"
},
{
"Sid": "TimestreamResourcePermissions",
"Effect": "Allow",
"Action": [
"timestream:ListDatabases",
"timestream:ListTables",
"timestream:ListTagsForResource",
"timestream:DescribeDatabase",
"timestream:DescribeTable",
"timestream:GetAwsBackupStatus",
"timestream:GetAwsRestoreStatus"
],
"Resource": [
"arn:aws:timestream:*:*:database/*"
]
},
{
"Sid": "TimestreamPermissions",
"Effect": "Allow",
"Action": [
"timestream:DescribeEndpoints"
],
"Resource": "*"
},
{
"Sid": "RedshiftDescribePermissions",
"Effect": "Allow",
"Action": [
"redshift:DescribeClusterSnapshots",
"redshift:DescribeTags"
],
"Resource": [
"arn:aws:redshift:*:*:snapshot:*/*",
"arn:aws:redshift:*:*:cluster:*"
]
},
{
"Sid": "RedshiftClusterSnapshotPermissions",
"Effect": "Allow",
"Action": [
"redshift:DeleteClusterSnapshot"
],
"Resource": [
"arn:aws:redshift:*:*:snapshot:*/*"
]
},
{
"Sid": "RedshiftClusterPermissions",
"Effect": "Allow",
"Action": [
"redshift:DescribeClusters"
],
"Resource": [
"arn:aws:redshift:*:*:cluster:*"
]
},
{
"Sid": "RedshiftServerlessGetPermissions",
"Effect": "Allow",
"Action": [
"redshift-serverless:GetNamespace",
"redshift-serverless:GetSnapshot",
"redshift-serverless:GetWorkgroup"
],
"Resource": [
"arn:aws:redshift-serverless:*:*:namespace/*",
"arn:aws:redshift-serverless:*:*:workgroup/*",
"arn:aws:redshift-serverless:*:*:snapshot/*"
]
},
{
"Sid": "RedshiftServerlessDeleteSnapshotPermissions",
"Effect": "Allow",
"Action": [
"redshift-serverless:DeleteSnapshot"
],
"Resource": [
"arn:aws:redshift-serverless:*:*:snapshot/*"
],
"Condition": {
"Null": {
"aws:ResourceTag/aws:backup:source-resource": "false"
}
}
},
{
"Sid": "RedshiftServerlessListPermissions",
"Effect": "Allow",
"Action": [
"redshift-serverless:ListNamespaces",
"redshift-serverless:ListSnapshots",
"redshift-serverless:ListTagsForResource",
"redshift-serverless:ListWorkgroups"
],
"Resource": [
"*"
]
},
{
"Sid": "CloudformationStackPermissions",
"Effect": "Allow",
"Action": [
"cloudformation:ListStacks"
],
"Resource": [
"arn:aws:cloudformation:*:*:stack/*"
]
},
{
"Sid": "RecoveryPointTaggingPermissions",
"Effect": "Allow",
"Action": [
"backup:TagResource"
],
"Resource": "arn:aws:backup:*:*:recovery-point:*",
"Condition": {
"StringEquals": {
"aws:PrincipalAccount": "${aws:ResourceAccount}"
}
}
},
{
"Sid": "DSQLListPermissions",
"Effect": "Allow",
"Action": [
"dsql:ListClusters",
"dsql:ListTagsForResource"
],
"Resource": "*"
},
{
"Sid": "OrgsListDelegatedAdmins",
"Effect": "Allow",
"Action": [
"organizations:ListDelegatedAdministrators"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"organizations:ServicePrincipal": [
"backup.amazonaws.com"
]
}
}
},
{
"Sid": "EKSClusterConfigurationBackup",
"Effect": "Allow",
"Action": [
"eks:ListClusters",
"eks:ListTagsForResource",
"eks:DescribeCluster",
"eks:ListAddons",
"eks:DescribeAddon",
"eks:ListNodegroups",
"eks:DescribeNodegroup",
"eks:ListPodIdentityAssociations",
"eks:DescribePodIdentityAssociation",
"eks:ListAccessEntries",
"eks:DescribeAccessEntry",
"eks:ListAssociatedAccessPolicies",
"eks:ListFargateProfiles",
"eks:DescribeFargateProfile",
"ec2:DescribeLaunchTemplateVersions"
],
"Resource": "*"
}
]
},
"VersionId": "v31",
"IsDefaultVersion": true,
"CreateDate": "2026-02-12T17:59:36+00:00"
}
}Version History (28 recorded)
Raw historyAWSBackupServiceLinkedRolePolicyForBackup - Policy Version v31
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
8db6beaAWSBackupServiceLinkedRolePolicyForBackup - Policy Version v31
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
f67a954AWSBackupServiceLinkedRolePolicyForBackup - Policy Version v26
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
b433644AWSBackupServiceLinkedRolePolicyForBackup - Policy Version v21
No recorded action delta - this version predates the change index. View the raw diff.
Nov 10, 2025
2d8d22aAWSBackupServiceLinkedRolePolicyForBackup - Policy Version v20
No recorded action delta - this version predates the change index. View the raw diff.
Sep 9, 2025
d7b000bUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
May 22, 2025
e10cfecUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 22, 2025
e850beeUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Jan 7, 2025
e7e83b4Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 17, 2024
1bd1789Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Dec 15, 2023
ed5d947Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Dec 15, 2023
6966287Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 27, 2023
aac6895Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 24, 2023
cda66e2Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 10, 2022
c6a1fbbUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Jul 28, 2022
2300d96Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 17, 2022
51974a5Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 5, 2022
f834fd2Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Feb 18, 2022
2165bad