about AWS Backup for IAM service

If you just want one backup and keep it forever, please create an on demand backup job and select the Retention period as "Always". Please follow the document below. https://docs.aws.amazon.com/aws-backup/latest/devguide/create-on-demand-backup.html

If you want to take periodic backups like daily, you can create a backup plan and a rule and assign resources to the backup plan. Please follow the document below. https://docs.aws.amazon.com/aws-backup/latest/devguide/creating-a-backup-plan.html

If you have no intentions of copying the backups to a different account, you can use Default Backup vaults.

For resource type, it depends on the resource you are backing up. Example: To backup EC2, you select EC2 Instance ID. For IAM role: You can use the Default IAM role. The Default role is automatically created when you create a first backup job in the console. (The first backup job may fail due to the fact that the Role will be in creating status) You may have to create a new job with the default role after the first failed job. Teh Default role has all the necessary permissions. https://docs.aws.amazon.com/aws-backup/latest/devguide/iam-service-roles.html#default-service-roles

If you want to backup the S3 bucket, Please select the bucket which you want to backup.

Also, You have to add these two policies to the role:AWSBackupDefaultServiceRole once it is created. With out these two policies the backup would fail. AWSBackupServiceRolePolicyForS3Backup AWSBackupServiceRolePolicyForS3Restore