How can I set up an AWS Backup vault access policy?

Resolution

A vault access policy can help deny access to the specified API operations for a specific type of recovery point. For example, you can deny access to Amazon Elastic Block Store (Amazon EBS) snapshots.

A vault access policy can deny access to the API operations that target a backup vault and the ability to delete the stored recovery points.

Set up an access policy

Use the AWS Backup console to set up an access policy:

1. Open the AWS Backup console.
2. In the navigation pane, choose Backup vaults.
3. Select the vault that you want to add the access policy to.
4. For Access Policy, choose Add permissions. Then, add the policy.

Or, you can use the AWS Command Line Interface (AWS CLI) put-backup-vault-access-policy command to programmatically set up a policy.

Note: If you receive errors when running AWS CLI commands, make sure that you're using the most recent version of the AWS CLI.

Example policies

The following example policy denies access to delete recovery points and allows only specified users to delete recovery points in a backup vault:

{  
    "Version": "2012-10-17",  
    "Statement": [{  
        "Sid": "statement ID",  
        "Effect": "Deny",  
        "Principal": "*",  
        "Action": "backup:DeleteRecoveryPoint",  
        "Resource": "*",  
        "Condition": {  
            "StringNotEquals": {  
                "aws:userId": ["AAAAAAAAAAAAAAAAAAAAA:*", "112233445566"]  
            }  
        }  
    }]  
}

The following example policy denies a particular user from performing a restore operation on all Amazon EBS snapshots:

{  
    "Version": "2012-10-17",  
    "Statement": [{  
        "Sid": "statement ID",  
        "Effect": "Deny",  
        "Principal": {  
            "AWS": "arn:aws:iam::AccountID:role/RoleName"  
        },  
        "Action": ["backup:StartRestoreJob"],  
        "Resource": ["arn:aws:ec2:Region::snapshot/*"]  
    }]  
}

The following example policy denies modifying the lifecycle configuration of all recovery points in a vault and prevents the removal of a vault lock configuration:

{  
    "Version": "2012-10-17",  
    "Statement": [{  
        "Sid": "statement ID",  
        "Effect": "Deny",  
        "Principal": "*",  
        "Action": ["backup:UpdateRecoveryPointLifecycle",  
            "backup:DeleteBackupVaultLockConfiguration"  
        ],  
        "Resource": "*"  
    }]  
}

Note: Vault access policies don't support a wildcard in the Action element.