Limiting users to restore rds backup

0

I have created an AWS Backup to backup a RDS DB instance. I use the default IAM role when I setup the Backup plan. After a few backups were created, I asked an AWS user in the same account to try restoring a backup from the Backup vault, and he was able to restore without hitting any permission error.

What is the best way to limit which user can restore the backups? Should I use a custom IAM role and apply to the Backup plan instead of using the default IAM role so that not any user can restore backup?

Should I apply the managed poilicy for AWS backup AWSBackupServiceRolePolicyForBackup and AWSBackupServiceRolePolicyForRestores to the custom role?

How should I go about denying backup and restore permissions to users/group and allowing restore permissions to specific users?

profile picture
Lottie
feita há 5 meses200 visualizações
1 Resposta
0
Resposta aceita

Hello.

AWS Backup's IAM role is only used for backing up resources, so it cannot be used to control restoration.
You can restrict restores from AWS Backup by restricting "backup:StartRestoreJob" in the backup vault access policy.
https://docs.aws.amazon.com/aws-backup/latest/devguide/create-a-vault-access-policy.html

If you are using IAM users, I think it would be effective to create an IAM group that allows restores and control the users who can restore.

profile picture
ESPECIALISTA
respondido há 5 meses
profile picture
ESPECIALISTA
avaliado há 5 meses

Você não está conectado. Fazer login para postar uma resposta.

Uma boa resposta responde claramente à pergunta, dá feedback construtivo e incentiva o crescimento profissional de quem perguntou.

Diretrizes para responder a perguntas