AWSBackupServiceRolePolicyForRestores
Last Modified
Aug 28, 2026
August 28, 2026 at 12:03 AM UTC
Version
v36
Total Versions
33
Created
Aug 27, 2026
Actions
146
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can read data in every bucket or table
Reads any DynamoDB table. Read-only is not the same as harmless when the data is the asset.
dynamodb:Scandynamodb:GetItemUse with caution: Read access to data is still access to data. For people who only need to see configuration, ViewOnlyAccess carries none of these signals.
IAM Access Analyzer (1)
- Warning / POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA
The 10441 characters in the identity policy, excluding whitespace, exceed the 10240 character maximum for inline and managed policies. We recommend that you use multiple granular policies. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DynamoDBPermissions",
"Effect": "Allow",
"Action": [
"dynamodb:Scan",
"dynamodb:Query",
"dynamodb:UpdateItem",
"dynamodb:PutItem",
"dynamodb:GetItem",
"dynamodb:DeleteItem",
"dynamodb:BatchWriteItem",
"dynamodb:DescribeTable"
],
"Resource": "arn:aws:dynamodb:*:*:table/*"
},
{
"Sid": "DynamoDBBackupResourcePermissions",
"Effect": "Allow",
"Action": [
"dynamodb:RestoreTableFromBackup"
],
"Resource": "arn:aws:dynamodb:*:*:table/*/backup/*"
},
{
"Sid": "EBSPermissions",
"Effect": "Allow",
"Action": [
"ec2:CreateVolume",
"ec2:DeleteVolume"
],
"Resource": [
"arn:aws:ec2:*::snapshot/*",
"arn:aws:ec2:*:*:volume/*"
]
},
{
"Sid": "EC2DescribePermissions",
"Effect": "Allow",
"Action": [
"ec2:DescribeImages",
"ec2:DescribeInstances",
"ec2:DescribeSnapshots",
"ec2:DescribeVolumes",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAddresses",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeVpcs",
"ec2:DescribeInternetGateways",
"ec2:DescribeSnapshotTierStatus",
"ec2:DescribeRouteTables"
],
"Resource": "*"
},
{
"Sid": "CreateTagsPermissions",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": "arn:aws:ec2:*:*:route-table/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/AmazonFSx": "ManagedByAmazonFSx"
}
}
},
{
"Sid": "StorageGatewayVolumePermissions",
"Effect": "Allow",
"Action": [
"storagegateway:DeleteVolume",
"storagegateway:DescribeCachediSCSIVolumes",
"storagegateway:DescribeStorediSCSIVolumes",
"storagegateway:AddTagsToResource"
],
"Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*"
},
{
"Sid": "StorageGatewayGatewayPermissions",
"Effect": "Allow",
"Action": [
"storagegateway:DescribeGatewayInformation",
"storagegateway:CreateStorediSCSIVolume",
"storagegateway:CreateCachediSCSIVolume"
],
"Resource": "arn:aws:storagegateway:*:*:gateway/*"
},
{
"Sid": "StorageGatewayListPermissions",
"Effect": "Allow",
"Action": [
"storagegateway:ListVolumes"
],
"Resource": "arn:aws:storagegateway:*:*:*"
},
{
"Sid": "RDSPermissions",
"Effect": "Allow",
"Action": [
"rds:DescribeDBInstances",
"rds:DescribeDBSnapshots",
"rds:ListTagsForResource",
"rds:RestoreDBInstanceFromDBSnapshot",
"rds:DeleteDBInstance",
"rds:AddTagsToResource",
"rds:DescribeDBClusters",
"rds:RestoreDBClusterFromSnapshot",
"rds:DeleteDBCluster",
"rds:RestoreDBInstanceToPointInTime",
"rds:DescribeDBClusterSnapshots",
"rds:RestoreDBClusterToPointInTime",
"rds:CreateTenantDatabase",
"rds:DeleteTenantDatabase"
],
"Resource": "*"
},
{
"Sid": "EFSPermissions",
"Effect": "Allow",
"Action": [
"elasticfilesystem:Restore",
"elasticfilesystem:CreateFilesystem",
"elasticfilesystem:DescribeFilesystems",
"elasticfilesystem:DeleteFilesystem",
"elasticfilesystem:TagResource"
],
"Resource": "arn:aws:elasticfilesystem:*:*:file-system/*"
},
{
"Sid": "KMSDescribePermissions",
"Effect": "Allow",
"Action": "kms:DescribeKey",
"Resource": "*"
},
{
"Sid": "DSQLResourcePermissionsForRestore",
"Effect": "Allow",
"Action": [
"dsql:StartRestoreJob",
"dsql:GetRestoreJob",
"dsql:StopRestoreJob",
"dsql:TagResource",
"dsql:CreateCluster",
"dsql:PutMultiRegionProperties",
"dsql:PutWitnessRegion",
"dsql:UpdateCluster",
"dsql:AddPeerCluster",
"dsql:RemovePeerCluster",
"dsql:GetCluster"
],
"Resource": [
"*"
]
},
{
"Sid": "KMSPermissions",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:GenerateDataKey",
"kms:ReEncryptTo",
"kms:ReEncryptFrom",
"kms:GenerateDataKeyWithoutPlaintext",
"kms:DescribeKey"
],
"Resource": "*",
"Condition": {
"StringLike": {
"kms:ViaService": [
"dynamodb.*.amazonaws.com",
"ec2.*.amazonaws.com",
"elasticfilesystem.*.amazonaws.com",
"rds.*.amazonaws.com",
"redshift.*.amazonaws.com",
"dsql.*.amazonaws.com",
"redshift-serverless.*.amazonaws.com"
]
}
}
},
{
"Sid": "KMSCreateGrantPermissions",
"Effect": "Allow",
"Action": "kms:CreateGrant",
"Resource": "*",
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": "true"
}
}
},
{
"Sid": "EBSSnapshotBlockPermissions",
"Effect": "Allow",
"Action": [
"ebs:CompleteSnapshot",
"ebs:StartSnapshot",
"ebs:PutSnapshotBlock"
],
"Resource": "arn:aws:ec2:*::snapshot/*"
},
{
"Sid": "RDSResourcePermissions",
"Effect": "Allow",
"Action": [
"rds:CreateDBInstance"
],
"Resource": "arn:aws:rds:*:*:db:*"
},
{
"Sid": "EC2DeleteAndRestorePermissions",
"Effect": "Allow",
"Action": [
"ec2:DeleteSnapshot",
"ec2:DeleteTags",
"ec2:RestoreSnapshotTier"
],
"Resource": "arn:aws:ec2:*::snapshot/*",
"Condition": {
"Null": {
"aws:ResourceTag/aws:backup:source-resource": "false"
}
}
},
{
"Sid": "EC2CreateTagsScopedPermissions",
"Effect": "Allow",
"Action": "ec2:CreateTags",
"Resource": [
"arn:aws:ec2:*::snapshot/*",
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"aws:backup:source-resource"
]
}
}
},
{
"Sid": "EC2RunInstancesPermissions",
"Effect": "Allow",
"Action": [
"ec2:RunInstances"
],
"Resource": "*"
},
{
"Sid": "EC2TerminateInstancesPermissions",
"Effect": "Allow",
"Action": [
"ec2:TerminateInstances"
],
"Resource": "arn:aws:ec2:*:*:instance/*"
},
{
"Sid": "EC2CreateTagsPermissions",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*"
],
"Condition": {
"StringLike": {
"ec2:CreateAction": [
"RunInstances",
"CreateVolume"
]
}
}
},
{
"Sid": "FsxPermissions",
"Effect": "Allow",
"Action": [
"fsx:CreateFileSystemFromBackup"
],
"Resource": [
"arn:aws:fsx:*:*:file-system/*",
"arn:aws:fsx:*:*:backup/*"
]
},
{
"Sid": "FsxTagPermissions",
"Effect": "Allow",
"Action": [
"fsx:DescribeFileSystems",
"fsx:TagResource"
],
"Resource": "arn:aws:fsx:*:*:file-system/*"
},
{
"Sid": "FsxBackupPermissions",
"Effect": "Allow",
"Action": "fsx:DescribeBackups",
"Resource": "arn:aws:fsx:*:*:backup/*"
},
{
"Sid": "FsxDeletePermissions",
"Effect": "Allow",
"Action": [
"fsx:DeleteFileSystem",
"fsx:UntagResource"
],
"Resource": "arn:aws:fsx:*:*:file-system/*",
"Condition": {
"Null": {
"aws:ResourceTag/aws:backup:source-resource": "false"
}
}
},
{
"Sid": "FsxDescribePermissions",
"Effect": "Allow",
"Action": [
"fsx:DescribeVolumes"
],
"Resource": "arn:aws:fsx:*:*:volume/*"
},
{
"Sid": "FsxVolumeTagPermissions",
"Effect": "Allow",
"Action": [
"fsx:CreateVolumeFromBackup",
"fsx:TagResource"
],
"Resource": [
"arn:aws:fsx:*:*:volume/*"
],
"Condition": {
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"aws:backup:source-resource"
]
}
}
},
{
"Sid": "FsxBackupTagPermissions",
"Effect": "Allow",
"Action": [
"fsx:CreateVolumeFromBackup",
"fsx:TagResource"
],
"Resource": [
"arn:aws:fsx:*:*:storage-virtual-machine/*",
"arn:aws:fsx:*:*:backup/*",
"arn:aws:fsx:*:*:volume/*"
]
},
{
"Sid": "FsxVolumePermissions",
"Effect": "Allow",
"Action": [
"fsx:DeleteVolume",
"fsx:UntagResource"
],
"Resource": "arn:aws:fsx:*:*:volume/*",
"Condition": {
"Null": {
"aws:ResourceTag/aws:backup:source-resource": "false"
}
}
},
{
"Sid": "DSPermissions",
"Effect": "Allow",
"Action": "ds:DescribeDirectories",
"Resource": "*"
},
{
"Sid": "DynamoDBRestorePermissions",
"Effect": "Allow",
"Action": [
"dynamodb:RestoreTableFromAwsBackup"
],
"Resource": "arn:aws:dynamodb:*:*:table/*"
},
{
"Sid": "GatewayRestorePermissions",
"Effect": "Allow",
"Action": [
"backup-gateway:Restore"
],
"Resource": "arn:aws:backup-gateway:*:*:hypervisor/*"
},
{
"Sid": "CloudformationChangeSetPermissions",
"Effect": "Allow",
"Action": [
"cloudformation:CreateChangeSet",
"cloudformation:DescribeChangeSet",
"cloudformation:TagResource",
"cloudformation:UntagResource"
],
"Resource": "arn:aws:cloudformation:*:*:*/*/*"
},
{
"Sid": "RedshiftClusterSnapshotPermissions",
"Effect": "Allow",
"Action": [
"redshift:RestoreFromClusterSnapshot",
"redshift:RestoreTableFromClusterSnapshot"
],
"Resource": [
"arn:aws:redshift:*:*:snapshot:*/*",
"arn:aws:redshift:*:*:cluster:*",
"arn:aws:redshift-serverless:*:*:snapshot/*"
]
},
{
"Sid": "RedshiftClusterPermissions",
"Effect": "Allow",
"Action": [
"redshift:DescribeClusters"
],
"Resource": [
"arn:aws:redshift:*:*:cluster:*"
]
},
{
"Sid": "RedshiftTablePermissions",
"Effect": "Allow",
"Action": [
"redshift:DescribeTableRestoreStatus"
],
"Resource": "*"
},
{
"Sid": "RedshiftServerlessSnapshotPermissions",
"Effect": "Allow",
"Action": [
"redshift-serverless:RestoreTableFromSnapshot"
],
"Resource": [
"arn:aws:redshift-serverless:*:*:namespace/*",
"arn:aws:redshift-serverless:*:*:workgroup/*",
"arn:aws:redshift-serverless:*:*:snapshot/*"
]
},
{
"Sid": "RedshiftServerlessNamespacePermissions",
"Effect": "Allow",
"Action": [
"redshift-serverless:GetNamespace"
],
"Resource": [
"arn:aws:redshift-serverless:*:*:namespace/*"
]
},
{
"Sid": "RedshiftServerlessTablePermissions",
"Effect": "Allow",
"Action": [
"redshift-serverless:GetTableRestoreStatus"
],
"Resource": [
"*"
]
},
{
"Sid": "TimestreamResourcePermissions",
"Effect": "Allow",
"Action": [
"timestream:StartAwsRestoreJob",
"timestream:GetAwsRestoreStatus",
"timestream:ListTables",
"timestream:ListTagsForResource",
"timestream:ListDatabases",
"timestream:DescribeTable",
"timestream:DescribeDatabase"
],
"Resource": [
"arn:aws:timestream:*:*:database/*"
]
},
{
"Sid": "TimestreamEndpointPermissions",
"Effect": "Allow",
"Action": [
"timestream:DescribeEndpoints"
],
"Resource": [
"*"
]
},
{
"Sid": "EKSClusterRestore",
"Effect": "Allow",
"Action": [
"eks:CreateCluster",
"eks:DescribeCluster",
"eks:CreateAccessEntry",
"eks:DescribeAccessEntry",
"eks:AssociateAccessPolicy",
"eks:ListAssociatedAccessPolicies",
"eks:CreateAddon",
"eks:DescribeAddon",
"eks:CreateNodegroup",
"eks:DescribeNodegroup",
"eks:CreateFargateProfile",
"eks:DescribeFargateProfile",
"eks:CreatePodIdentityAssociation",
"eks:DescribePodIdentityAssociation",
"eks:TagResource"
],
"Resource": [
"arn:aws:eks:*:*:access-entry/*",
"arn:aws:eks:*:*:addon/*",
"arn:aws:eks:*:*:cluster/*",
"arn:aws:eks:*:*:fargateprofile/*",
"arn:aws:eks:*:*:nodegroup/*",
"arn:aws:eks:*:*:podidentityassociation/*"
]
},
{
"Sid": "AssociateRestoreAccessPolicy",
"Effect": "Allow",
"Action": [
"eks:AssociateAccessPolicy",
"eks:DisassociateAccessPolicy"
],
"Resource": "arn:aws:eks:*:*:access-entry/*",
"Condition": {
"StringEquals": {
"eks:accessScope": "cluster",
"eks:policyArn": "arn:aws:eks::aws:cluster-access-policy/AWSBackupFullAccessPolicyForRestore"
}
}
},
{
"Sid": "CreateClusterIAMPerms",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": "arn:aws:iam::*:role/*",
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"eks.amazonaws.com",
"ec2.amazonaws.com",
"pods.eks.amazonaws.com",
"backup.amazonaws.com"
]
}
}
},
{
"Sid": "CreateEKSNodeGroupPermissions",
"Effect": "Allow",
"Action": [
"ec2:DescribeLaunchTemplateVersions",
"ec2:DescribeSubnets",
"ec2:RunInstances",
"iam:GetRole",
"iam:ListAttachedRolePolicies"
],
"Resource": "*"
},
{
"Sid": "EKSNodeGroupTagOnCreate",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:network-interface/*"
],
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"RunInstances"
]
}
}
},
{
"Sid": "BackupRestoreJobManagementPermissions",
"Effect": "Allow",
"Action": [
"backup:StartRestoreJob",
"backup:ListRestoreJobs",
"backup:ListRecoveryPointsByBackupVault",
"backup:DescribeRestoreJob"
],
"Resource": "*"
}
]
},
"VersionId": "v36",
"IsDefaultVersion": true,
"CreateDate": "2026-08-27T23:57:07+00:00"
}
}Version History (38 recorded)
Raw history1 action added
AWSBackupServiceRolePolicyForRestores - Policy Version v35
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
cfb64daAWSBackupServiceRolePolicyForRestores - Policy Version v35
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
85cc9c0AWSBackupServiceRolePolicyForRestores - Policy Version v30
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
b2112c7AWSBackupServiceRolePolicyForRestores - Policy Version v25
No recorded action delta - this version predates the change index. View the raw diff.
Nov 10, 2025
0d18f22AWSBackupServiceRolePolicyForRestores - Policy Version v24
No recorded action delta - this version predates the change index. View the raw diff.
Jul 15, 2025
a236d42Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 22, 2025
e10cfecUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 27, 2025
ee2eaabUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Jan 7, 2025
e7e83b4Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Dec 15, 2023
ed5d947Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Dec 15, 2023
6966287Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 27, 2023
aac6895Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 6, 2023
8ac10c9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 24, 2023
cda66e2Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 29, 2023
580c869Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 10, 2022
c6a1fbbUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Oct 13, 2022
30be104Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jul 20, 2022
dc50da1