AWS aws-backup documentation change
Summary
Restructured documentation to clarify resource assignment rules, service opt-in behavior, and added specific guidance for certain databases and FSx for NetApp ONTAP. Emphasized that explicit resource assignment in backup plans can override service opt-in settings except for Aurora, Neptune, and DocumentDB.
Security assessment
The changes clarify critical configuration behaviors such as service opt-in overrides for most resource types and exceptions for specific databases. This improves awareness of backup scope management, reducing risks of unintended data exposure from misconfigured backups. However, no direct security vulnerability is explicitly addressed.
Diff
diff --git a/aws-backup/latest/devguide/assigning-resources.md b/aws-backup/latest/devguide/assigning-resources.md index a8ace98d5..432f99f14 100644 --- a//aws-backup/latest/devguide/assigning-resources.md +++ b//aws-backup/latest/devguide/assigning-resources.md @@ -5 +5 @@ -Opt in to services, then assign resourcesService opt-inResource assignmentResource assignment quotas +Quotas on resource assignment @@ -7 +7 @@ Opt in to services, then assign resourcesService opt-inResource assignmentResour -# Select AWS services to backup +# Assign resources to a backup plan @@ -9 +9 @@ Opt in to services, then assign resourcesService opt-inResource assignmentResour -## Opt in to services, then assign resources +Resource assignment specifies which resources AWS Backup will protect using your backup plan. AWS Backup gives you both simple default settings and fine-grained controls to assign resources to your backup plan. Each time your backup plan runs, it scans your AWS account for all resources that match your resource assignment criteria. This level of automation allows you to define your backup plan and resource assignment exactly once. AWS Backup abstracts away the work of finding and backing up new resources that fit your earlier-defined resource assignment. @@ -11 +11 @@ Opt in to services, then assign resourcesService opt-inResource assignmentResour -AWS Backup works with many [different AWS services](./backup-feature-availability.html#features-by-resource). Before you decide which services to include in backup plan, use the AWS Backup console or AWS CLI to opt in to using AWS Backup to work with those services. +You can assign any AWS Backup-supported resource types that you have opted in for AWS Backup to manage. For instructions on how to opt in to more AWS Backup-supported resource types, see [Service Opt-in](./getting-started.html#service-opt-in). @@ -13 +13 @@ AWS Backup works with many [different AWS services](./backup-feature-availabilit -Then, in each backup plan, specify in the [console](./assigning-resources-console.html) or through [CLI](./assigning-resources-json.html) which resource types to include in that plan. +The AWS Backup console has two ways to include resource types in a backup plan: explicitly assign the resource type in a backup plan or include all resources. See the points below to understand how these selections work with service opt ins. @@ -15 +15 @@ Then, in each backup plan, specify in the [console](./assigning-resources-consol -For example, you can opt in to all services which AWS Backup supports, then include only Amazon S3 buckets and Aurora clusters in a backup plan. + * If resource assignments are only based on tags, then service opt-in settings are applied. @@ -17,13 +17 @@ For example, you can opt in to all services which AWS Backup supports, then incl -###### Topics - - * AWS Backup service opt-in - - * Backup plan resource assignment - - * [Assign resources using the AWS Backup console](./assigning-resources-console.html) - - * [Assign resources with AWS CLI](./assigning-resources-json.html) - - * [Assign AWS Backup resources through AWS CloudFormation](./assigning-resources-cfn.html) - - * Backup plan resource assignments quotas + * If a resource type is explicitly assigned to a backup plan, it will be included in the backup even if the opt-in is not enabled for that particular service. This does not apply to Aurora, Neptune, and Amazon DocumentDB. For these services to be included, the opt-in must be enabled. @@ -30,0 +19 @@ For example, you can opt in to all services which AWS Backup supports, then incl + * If both resource type and tags are specified in a resource assignment, the specified resource types are filtered first, then tags further filter those resources. @@ -31,0 +21 @@ For example, you can opt in to all services which AWS Backup supports, then incl +Service opt-in settings are ignored for most resource types. However Aurora, Neptune, and Amazon DocumentDB require service opt-in. @@ -32,0 +23 @@ For example, you can opt in to all services which AWS Backup supports, then incl + * When an account uses AWS Backup (creates a backup vault or backup plan) in a Region, the account automatically is opted into all resource types supported by AWS Backup in the Region at that time. Supported services added to that Region at a later date will not be automatically included in a backup plan. You can choose to opt into those resource types once they become supported. @@ -34 +25 @@ For example, you can opt in to all services which AWS Backup supports, then incl -## AWS Backup service opt-in + * For Amazon FSx for NetApp ONTAP, when using tag-based resource selection, apply tags to individual volumes instead of the whole file system. @@ -36 +26,0 @@ For example, you can opt in to all services which AWS Backup supports, then incl -### Service opt-in through the AWS Backup console @@ -38 +27,0 @@ For example, you can opt in to all services which AWS Backup supports, then incl -###### To configure the AWS services to use with AWS Backup @@ -40 +28,0 @@ For example, you can opt in to all services which AWS Backup supports, then incl - 1. Sign in to the AWS Management Console, and open the AWS Backup console at [https://console.aws.amazon.com/backup](https://console.aws.amazon.com/backup). @@ -42 +30 @@ For example, you can opt in to all services which AWS Backup supports, then incl - 2. In the navigation pane, choose **Settings**. +Your resource assignment can include (or exclude) _resource types_ and _resources_. @@ -44 +32 @@ For example, you can opt in to all services which AWS Backup supports, then incl - 3. On the **Service opt-in** page, choose **Configure resources**. + * A _resource type_ includes every instance or resource of an AWS Backup-supported AWS service or third-party application. For example, the DynamoDB resource type refers to all your DynamoDB tables. @@ -46 +34 @@ For example, you can opt in to all services which AWS Backup supports, then incl - 4. On the **Configure resources** page, use the toggle switches to enable or disable the services that are used with AWS Backup. Choose **Confirm** when your services are configured. Make sure that the AWS service you're opting in is available in your AWS Region. + * A _resource_ is a single instance of a resource type, such as one of your DynamoDB tables. You can specify a resource using its unique _resource ID_. @@ -51 +39 @@ For example, you can opt in to all services which AWS Backup supports, then incl -### Service opt-in through AWS CLI +You can further refine your resource assignment using tags and conditional operators. @@ -53,11 +41 @@ For example, you can opt in to all services which AWS Backup supports, then incl -Use the [`aws backup update-region-settings`](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UpdateRegionSettings.html) command to change the services (resource types) your account or organization will use AWS Backup to orchestrate backup creation. Use the [`aws backup describe-region-settings`](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeRegionSettings.html) command to determine which services you have opted into in a specific Region. - -## Backup plan resource assignment - -Through the [AWS Backup console](./assigning-resources-console.html) or through [AWS CLI](./assigning-resources-json.html), the resource assignment in your backup plan specifies which resources AWS Backup will include. AWS Backup provides both simple default settings and fine-grained controls to assign resources. - -You can assign resources in the following ways: - - * Explicitly assign resource types to the backup plan - - * Include all resources (AWS Backup will then scan for all supported resource types) +###### Topics @@ -65 +43 @@ You can assign resources in the following ways: - * Use tags to include or exclude resources + * [Assign resources using the AWS Backup console](./assigning-resources-console.html) @@ -66,0 +45 @@ You can assign resources in the following ways: + * [Assign resources with AWS CLI](./assigning-resources-json.html) @@ -67,0 +47 @@ You can assign resources in the following ways: + * [Assign AWS Backup resources through AWS CloudFormation](./assigning-resources-cfn.html) @@ -68,0 +49 @@ You can assign resources in the following ways: + * Quotas on resource assignment @@ -70 +50,0 @@ You can assign resources in the following ways: -If you only use tags for resource assignment, then the service opt-in settings will still apply. @@ -72 +51,0 @@ If you only use tags for resource assignment, then the service opt-in settings w -You can further refine the resource assignment using conditions and tags. There are some limits on the number of ARNs, conditions, and tags that can be used in a single resource assignment. @@ -74 +52,0 @@ You can further refine the resource assignment using conditions and tags. There -Resource selection through CLI is based on service names and resource types. See [Assign resources with AWS CLI](./assigning-resources-json.html) for considerations about resource election. @@ -76 +54 @@ Resource selection through CLI is based on service names and resource types. See -## Backup plan resource assignments quotas +## Quotas on resource assignment