AWS aws-backup documentation change
Summary
Restructured permissions documentation with explicit index/search policy details and KMS requirements
Security assessment
Added specific IAM permissions requirements and KMS decrypt operations for index/search functionality, but no evidence of addressing a specific vulnerability
Diff
diff --git a/aws-backup/latest/devguide/backup-search.md b/aws-backup/latest/devguide/backup-search.md index 4162aee29..5de2ea715 100644 --- a//aws-backup/latest/devguide/backup-search.md +++ b//aws-backup/latest/devguide/backup-search.md @@ -31 +31,22 @@ Before you create an index and a search, your account must have required permiss -Required permissions for index and search creation and management include: +**Index permissions** + +For index operations, AWS Backup authenticates based on the IAM role, not user credentials (for IAM user and IAM role specifics, see [Authentication](./authentication.html)). + +The following permissions are required to create an index of an EBS backup. These permissions are contained in the managed policy [AWSBackupServiceRolePolicyForIndexing](./security-iam-awsmanpol.html#AWSBackupServiceRolePolicyForIndexing): + + * `ec2:DescribeSnapshots` + + * `ebs:ListSnapshotBlocks` + + * `ebs:GetSnapshotBlock` + + * `kms:Decrypt` + + + + +No index permissions are required to create an S3 index. + +**Search permissions** + +The following permissions are required to create a search. These permissions are contained in the managed policy [AWSBackupSearchOperatorAccess](./security-iam-awsmanpol.html#AWSBackupSearchOperatorAccess): @@ -40,3 +61 @@ Required permissions for index and search creation and management include: -These permissions can be found in the policies `[AWSBackupServiceRolePolicyForItemRestores](./security-iam-awsmanpol.html#AWSBackupServiceRolePolicyForItemRestores)` and `[AWSBackupServiceRolePolicyForIndexing](./security-iam-awsmanpol.html#AWSBackupServiceRolePolicyForIndexing)`. - -If you choose to encrypt search results with a customer-owned AWS KMS key, the following permission is required: +If you choose to encrypt the search results with a customer managed AWS KMS key, ensure the following permissions are in the key: @@ -45,0 +65 @@ If you choose to encrypt search results with a customer-owned AWS KMS key, the f + * `kms:Decrypt` @@ -49 +68,0 @@ If you choose to encrypt search results with a customer-owned AWS KMS key, the f -See [IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) in the _IAM User Guide_ for information on how to use roles and permissions.