Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

IAM permissions for AWS Backup Lock in governance mode

1

Hello

According to what we can read in the documentation (Vaults locked in governance mode can have the lock removed by users with sufficient IAM permissions), I would like to create a user account that will have permissions to remove the lock while ensuring that none of the other administrator accounts have such permissions.

How should I configure permissions on the privileged account and on the other administrator accounts?

https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html

Topics
Security, Identity, & ComplianceStorage
Tags
IAM PoliciesAWS Backup
Language
English
asked 3 years ago1.3K views
1 Answer
0

Short answer is to restrict which can "backup:DeleteBackupVaultLockConfiguration" https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbackup.html#:~:text=DeleteBackupVaultLockConfiguration

Probably want to layer an Organizational SCP with DENY with condition ArnNotEquals for the arn of the user who you allow to delete the vault lock.

answered 3 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content