AWSBackupServiceRolePolicyForBackup
Last Modified
Mar 12, 2026
March 12, 2026 at 09:25 PM UTC
Version
v30
Total Versions
31
Created
Feb 23, 2026
Actions
140
Risk
HighAn unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- High
Can take over existing resources that run as another role
Grants every action of 1 documented escalation path on any resource with no condition.
Use with caution: List the roles attached to the functions, instances, pipelines or notebooks it can modify: the holder effectively has them too.
IAM Access Analyzer (1)
- Warning / POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA
The 10827 characters in the identity policy, excluding whitespace, exceed the 10240 character maximum for inline and managed policies. We recommend that you use multiple granular policies. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DynamoDBPermissions",
"Effect": "Allow",
"Action": [
"dynamodb:DescribeTable",
"dynamodb:CreateBackup"
],
"Resource": "arn:aws:dynamodb:*:*:table/*"
},
{
"Sid": "DynamoDBBackupResourcePermissions",
"Effect": "Allow",
"Action": [
"dynamodb:DescribeBackup",
"dynamodb:DeleteBackup"
],
"Resource": "arn:aws:dynamodb:*:*:table/*/backup/*"
},
{
"Sid": "DynamoDBBackupPermissions",
"Effect": "Allow",
"Action": [
"rds:AddTagsToResource",
"rds:ListTagsForResource",
"rds:DescribeDBSnapshots",
"rds:CreateDBSnapshot",
"rds:CopyDBSnapshot",
"rds:DescribeDBInstances",
"rds:CreateDBClusterSnapshot",
"rds:DescribeDBClusters",
"rds:DescribeDBClusterSnapshots",
"rds:CopyDBClusterSnapshot",
"rds:DescribeDBClusterAutomatedBackups"
],
"Resource": "*"
},
{
"Sid": "RDSInstanceAutomatedBackupPermissions",
"Effect": "Allow",
"Action": "rds:DeleteDBInstanceAutomatedBackup",
"Resource": "arn:aws:rds:*:*:auto-backup:*"
},
{
"Sid": "RDSClusterPermissions",
"Effect": "Allow",
"Action": [
"rds:ModifyDBCluster"
],
"Resource": [
"arn:aws:rds:*:*:cluster:*"
]
},
{
"Sid": "RDSClusterBackupPermissions",
"Effect": "Allow",
"Action": "rds:DeleteDBClusterAutomatedBackup",
"Resource": "arn:aws:rds:*:*:cluster-auto-backup:*"
},
{
"Sid": "RDSModifyPermissions",
"Effect": "Allow",
"Action": [
"rds:ModifyDBInstance"
],
"Resource": [
"arn:aws:rds:*:*:db:*"
]
},
{
"Sid": "RDSBackupPermissions",
"Effect": "Allow",
"Action": [
"rds:DeleteDBSnapshot",
"rds:ModifyDBSnapshotAttribute"
],
"Resource": [
"arn:aws:rds:*:*:snapshot:awsbackup:*"
]
},
{
"Sid": "RDSClusterModifyPermissions",
"Effect": "Allow",
"Action": [
"rds:DeleteDBClusterSnapshot",
"rds:ModifyDBClusterSnapshotAttribute"
],
"Resource": [
"arn:aws:rds:*:*:cluster-snapshot:awsbackup:*"
]
},
{
"Sid": "StorageGatewayPermissions",
"Effect": "Allow",
"Action": [
"storagegateway:CreateSnapshot",
"storagegateway:ListTagsForResource"
],
"Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*"
},
{
"Sid": "EBSCopyPermissions",
"Effect": "Allow",
"Action": [
"ec2:CopySnapshot"
],
"Resource": "arn:aws:ec2:*::snapshot/*"
},
{
"Sid": "EC2CopyPermissions",
"Effect": "Allow",
"Action": [
"ec2:CopyImage"
],
"Resource": "*"
},
{
"Sid": "EBSTagAndDeletePermissions",
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:DeleteSnapshot"
],
"Resource": "arn:aws:ec2:*::snapshot/*"
},
{
"Sid": "EC2Permissions",
"Effect": "Allow",
"Action": [
"ec2:CreateImage",
"ec2:DeregisterImage",
"ec2:DescribeSnapshots",
"ec2:DescribeTags",
"ec2:DescribeImages",
"ec2:DescribeInstances",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstanceCreditSpecifications",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeElasticGpus",
"ec2:DescribeSpotInstanceRequests",
"ec2:DescribeSnapshotTierStatus"
],
"Resource": "*"
},
{
"Sid": "EC2TagPermissions",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": "arn:aws:ec2:*:*:image/*"
},
{
"Sid": "EC2ModifyPermissions",
"Effect": "Allow",
"Action": [
"ec2:ModifySnapshotAttribute",
"ec2:ModifyImageAttribute"
],
"Resource": "*",
"Condition": {
"Null": {
"aws:ResourceTag/aws:backup:source-resource": "false"
}
}
},
{
"Sid": "EBSSnapshotTierPermissions",
"Effect": "Allow",
"Action": [
"ec2:ModifySnapshotTier"
],
"Resource": "arn:aws:ec2:*::snapshot/*",
"Condition": {
"Null": {
"aws:ResourceTag/aws:backup:source-resource": "false"
}
}
},
{
"Sid": "BackupVaultPermissions",
"Effect": "Allow",
"Action": [
"backup:DescribeBackupVault",
"backup:CopyIntoBackupVault"
],
"Resource": "arn:aws:backup:*:*:backup-vault:*"
},
{
"Sid": "BackupVaultCopyPermissions",
"Effect": "Allow",
"Action": [
"backup:CopyFromBackupVault"
],
"Resource": "*"
},
{
"Sid": "EFSPermissions",
"Effect": "Allow",
"Action": [
"elasticfilesystem:Backup",
"elasticfilesystem:DescribeTags"
],
"Resource": "arn:aws:elasticfilesystem:*:*:file-system/*"
},
{
"Sid": "EBSResourcePermissions",
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot",
"ec2:DeleteSnapshot",
"ec2:DescribeVolumes",
"ec2:DescribeSnapshots"
],
"Resource": "*"
},
{
"Sid": "KMSDynamoDBPermissions",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "*",
"Condition": {
"StringLike": {
"kms:ViaService": [
"dynamodb.*.amazonaws.com"
]
}
}
},
{
"Sid": "KMSPermissions",
"Effect": "Allow",
"Action": "kms:DescribeKey",
"Resource": "*"
},
{
"Sid": "KMSCreateGrantPermissions",
"Effect": "Allow",
"Action": "kms:CreateGrant",
"Resource": "*",
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": "true"
}
}
},
{
"Sid": "KMSEC2Permissions",
"Effect": "Allow",
"Action": [
"kms:GenerateDataKeyWithoutPlaintext",
"kms:ReEncryptTo",
"kms:ReEncryptFrom"
],
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"StringLike": {
"kms:ViaService": [
"ec2.*.amazonaws.com"
]
},
"ForAnyValue:StringEquals": {
"kms:EncryptionContextKeys": "aws:ebs:id"
}
}
},
{
"Sid": "GetResourcesPermissions",
"Effect": "Allow",
"Action": [
"tag:GetResources"
],
"Resource": "*"
},
{
"Sid": "SSMPermissions",
"Effect": "Allow",
"Action": [
"ssm:CancelCommand",
"ssm:GetCommandInvocation"
],
"Resource": "*"
},
{
"Sid": "SSMSendPermissions",
"Effect": "Allow",
"Action": "ssm:SendCommand",
"Resource": [
"arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot",
"arn:aws:ec2:*:*:instance/*"
]
},
{
"Sid": "FsxBackupPermissions",
"Effect": "Allow",
"Action": "fsx:DescribeBackups",
"Resource": "arn:aws:fsx:*:*:backup/*"
},
{
"Sid": "FsxCreateBackupPermissions",
"Effect": "Allow",
"Action": "fsx:CreateBackup",
"Resource": [
"arn:aws:fsx:*:*:file-system/*",
"arn:aws:fsx:*:*:backup/*",
"arn:aws:fsx:*:*:volume/*"
]
},
{
"Sid": "FsxPermissions",
"Effect": "Allow",
"Action": "fsx:DescribeFileSystems",
"Resource": "arn:aws:fsx:*:*:file-system/*"
},
{
"Sid": "FsxVolumePermissions",
"Effect": "Allow",
"Action": "fsx:DescribeVolumes",
"Resource": "arn:aws:fsx:*:*:volume/*"
},
{
"Sid": "FsxListTagsPermissions",
"Effect": "Allow",
"Action": "fsx:ListTagsForResource",
"Resource": [
"arn:aws:fsx:*:*:file-system/*",
"arn:aws:fsx:*:*:volume/*"
]
},
{
"Sid": "FsxDeletePermissions",
"Effect": "Allow",
"Action": "fsx:DeleteBackup",
"Resource": "arn:aws:fsx:*:*:backup/*"
},
{
"Sid": "FsxResourcePermissions",
"Effect": "Allow",
"Action": [
"fsx:ListTagsForResource",
"fsx:ManageBackupPrincipalAssociations",
"fsx:CopyBackup",
"fsx:TagResource"
],
"Resource": "arn:aws:fsx:*:*:backup/*"
},
{
"Sid": "DynamodbBackupPermissions",
"Effect": "Allow",
"Action": [
"dynamodb:StartAwsBackupJob",
"dynamodb:ListTagsOfResource"
],
"Resource": "arn:aws:dynamodb:*:*:table/*"
},
{
"Sid": "BackupGatewayBackupPermissions",
"Effect": "Allow",
"Action": [
"backup-gateway:Backup",
"backup-gateway:ListTagsForResource"
],
"Resource": "arn:aws:backup-gateway:*:*:vm/*"
},
{
"Sid": "CloudformationStackPermissions",
"Effect": "Allow",
"Action": [
"cloudformation:ListStacks",
"cloudformation:GetTemplate",
"cloudformation:DescribeStacks",
"cloudformation:ListStackResources"
],
"Resource": "arn:aws:cloudformation:*:*:stack/*/*"
},
{
"Sid": "RedshiftCreatePermissions",
"Effect": "Allow",
"Action": [
"redshift:CreateClusterSnapshot",
"redshift:DescribeClusterSnapshots",
"redshift:DescribeTags"
],
"Resource": [
"arn:aws:redshift:*:*:snapshot:*/*",
"arn:aws:redshift:*:*:cluster:*"
]
},
{
"Sid": "RedshiftSnapshotPermissions",
"Effect": "Allow",
"Action": [
"redshift:DeleteClusterSnapshot"
],
"Resource": [
"arn:aws:redshift:*:*:snapshot:*/*"
]
},
{
"Sid": "RedshiftPermissions",
"Effect": "Allow",
"Action": [
"redshift:DescribeClusters"
],
"Resource": [
"arn:aws:redshift:*:*:cluster:*"
]
},
{
"Sid": "RedshiftResourcePermissions",
"Effect": "Allow",
"Action": [
"redshift:CreateTags"
],
"Resource": [
"arn:aws:redshift:*:*:snapshot:*/*"
]
},
{
"Sid": "RedshiftServerlessCreatePermissions",
"Effect": "Allow",
"Action": [
"redshift-serverless:CreateSnapshot"
],
"Resource": [
"arn:aws:redshift-serverless:*:*:snapshot/*",
"arn:aws:redshift-serverless:*:*:namespace/*"
]
},
{
"Sid": "RedshiftServerlessSnapshotPermissions",
"Effect": "Allow",
"Action": [
"redshift-serverless:DeleteSnapshot"
],
"Resource": [
"arn:aws:redshift-serverless:*:*:snapshot/*"
],
"Condition": {
"Null": {
"aws:ResourceTag/aws:backup:source-resource": "false"
}
}
},
{
"Sid": "RedshiftServerlessGetPermissions",
"Effect": "Allow",
"Action": [
"redshift-serverless:GetNamespace"
],
"Resource": [
"arn:aws:redshift-serverless:*:*:namespace/*"
]
},
{
"Sid": "RedshiftServerlessResourcePermissions",
"Effect": "Allow",
"Action": [
"redshift-serverless:GetSnapshot",
"redshift-serverless:TagResource"
],
"Resource": [
"arn:aws:redshift-serverless:*:*:snapshot/*"
]
},
{
"Sid": "RedshiftServerlessListPermissions",
"Effect": "Allow",
"Action": [
"redshift-serverless:ListNamespaces",
"redshift-serverless:ListSnapshots",
"redshift-serverless:ListTagsForResource"
],
"Resource": [
"*"
]
},
{
"Sid": "TimestreamResourcePermissions",
"Effect": "Allow",
"Action": [
"timestream:StartAwsBackupJob",
"timestream:GetAwsBackupStatus",
"timestream:ListTables",
"timestream:ListDatabases",
"timestream:ListTagsForResource",
"timestream:DescribeTable",
"timestream:DescribeDatabase"
],
"Resource": [
"arn:aws:timestream:*:*:database/*"
]
},
{
"Sid": "TimestreamEndpointPermissions",
"Effect": "Allow",
"Action": [
"timestream:DescribeEndpoints"
],
"Resource": "*"
},
{
"Sid": "SSMSAPPermissions",
"Effect": "Allow",
"Action": [
"ssm-sap:GetOperation",
"ssm-sap:ListDatabases"
],
"Resource": "*"
},
{
"Sid": "SSMSAPResourcePermissions",
"Effect": "Allow",
"Action": [
"ssm-sap:BackupDatabase",
"ssm-sap:UpdateHanaBackupSettings",
"ssm-sap:GetDatabase",
"ssm-sap:ListTagsForResource"
],
"Resource": "arn:aws:ssm-sap:*:*:*"
},
{
"Sid": "RecoveryPointTaggingPermissions",
"Effect": "Allow",
"Action": [
"backup:TagResource"
],
"Resource": "arn:aws:backup:*:*:recovery-point:*",
"Condition": {
"StringEquals": {
"aws:PrincipalAccount": "${aws:ResourceAccount}"
}
}
},
{
"Sid": "DSQLResourcePermissionsForBackup",
"Effect": "Allow",
"Action": [
"dsql:StartBackupJob",
"dsql:GetBackupJob",
"dsql:StopBackupJob",
"dsql:GetCluster",
"dsql:ListClusters",
"dsql:ListTagsForResource"
],
"Resource": [
"*"
]
},
{
"Sid": "KMSDSQLPermissions",
"Effect": "Allow",
"Action": [
"kms:Decrypt"
],
"Resource": "*",
"Condition": {
"StringLike": {
"kms:ViaService": [
"dsql.*.amazonaws.com"
]
},
"ForAnyValue:StringEquals": {
"kms:EncryptionContextKeys": "aws:dsql:ClusterId"
}
}
},
{
"Sid": "EKSClusterConfigurationBackup",
"Effect": "Allow",
"Action": [
"eks:ListClusters",
"eks:ListTagsForResource",
"eks:DescribeCluster",
"eks:ListAddons",
"eks:DescribeAddon",
"eks:ListNodegroups",
"eks:DescribeNodegroup",
"eks:ListPodIdentityAssociations",
"eks:DescribePodIdentityAssociation",
"eks:ListAccessEntries",
"eks:DescribeAccessEntry",
"eks:ListAssociatedAccessPolicies",
"eks:ListFargateProfiles",
"eks:DescribeFargateProfile",
"ec2:DescribeLaunchTemplateVersions"
],
"Resource": "*"
},
{
"Sid": "CreateBackupAccessEntry",
"Effect": "Allow",
"Action": [
"eks:CreateAccessEntry"
],
"Resource": "arn:aws:eks:*:*:cluster/*"
},
{
"Sid": "AssociateBackupAccessPolicy",
"Effect": "Allow",
"Action": [
"eks:AssociateAccessPolicy",
"eks:DisassociateAccessPolicy"
],
"Resource": "arn:aws:eks:*:*:access-entry/*",
"Condition": {
"StringEquals": {
"eks:policyArn": "arn:aws:eks::aws:cluster-access-policy/AWSBackupFullAccessPolicyForBackup",
"eks:accessScope": "cluster"
}
}
},
{
"Sid": "GuardDutyMalwareScanPermissions",
"Effect": "Allow",
"Action": [
"guardduty:StartMalwareScan",
"guardduty:GetMalwareScan"
],
"Resource": "*"
},
{
"Sid": "GuardDutyMalwareScanIAMPassPermissions",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::*:role/*",
"Condition": {
"StringEquals": {
"iam:PassedToService": "malware-protection.guardduty.amazonaws.com"
}
}
}
]
},
"VersionId": "v30",
"IsDefaultVersion": true,
"CreateDate": "2026-02-23T19:42:11+00:00"
}
}Version History (36 recorded)
Raw historyAWSBackupServiceRolePolicyForBackup - Policy Version v30
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
aa5b149AWSBackupServiceRolePolicyForBackup - Policy Version v30
No recorded action delta - this version predates the change index. View the raw diff.
Feb 23, 2026
89fd7c5AWSBackupServiceRolePolicyForBackup - Policy Version v29
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
11e4257AWSBackupServiceRolePolicyForBackup - Policy Version v26
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
2b7b6bdAWSBackupServiceRolePolicyForBackup - Policy Version v23
No recorded action delta - this version predates the change index. View the raw diff.
Nov 10, 2025
3149498Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 22, 2025
e10cfecUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 27, 2025
ee2eaabUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 27, 2024
2659f75Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 27, 2024
14d5913Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 17, 2024
1bd1789Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Dec 15, 2023
ed5d947Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Dec 15, 2023
6966287Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 27, 2023
aac6895Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 6, 2023
8ac10c9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 24, 2023
cda66e2Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 10, 2022
c6a1fbbUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Oct 13, 2022
30be104Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 17, 2022
51974a5