AWS aws-backup documentation change
Summary
Restructured permissions section for index/search operations, consolidated managed policy references, and clarified KMS requirements for encrypted search results
Security assessment
The changes clarify required permissions and encryption requirements but do not indicate a security vulnerability fix. The removal of explicit kms:Decrypt permission listing and emphasis on customer-managed key requirements improves security documentation clarity.
Diff
diff --git a/aws-backup/latest/devguide/backup-search.md b/aws-backup/latest/devguide/backup-search.md index 5de2ea715..4162aee29 100644 --- a//aws-backup/latest/devguide/backup-search.md +++ b//aws-backup/latest/devguide/backup-search.md @@ -31,22 +31 @@ Before you create an index and a search, your account must have required permiss -**Index permissions** - -For index operations, AWS Backup authenticates based on the IAM role, not user credentials (for IAM user and IAM role specifics, see [Authentication](./authentication.html)). - -The following permissions are required to create an index of an EBS backup. These permissions are contained in the managed policy [AWSBackupServiceRolePolicyForIndexing](./security-iam-awsmanpol.html#AWSBackupServiceRolePolicyForIndexing): - - * `ec2:DescribeSnapshots` - - * `ebs:ListSnapshotBlocks` - - * `ebs:GetSnapshotBlock` - - * `kms:Decrypt` - - - - -No index permissions are required to create an S3 index. - -**Search permissions** - -The following permissions are required to create a search. These permissions are contained in the managed policy [AWSBackupSearchOperatorAccess](./security-iam-awsmanpol.html#AWSBackupSearchOperatorAccess): +Required permissions for index and search creation and management include: @@ -61 +40,3 @@ The following permissions are required to create a search. These permissions are -If you choose to encrypt the search results with a customer managed AWS KMS key, ensure the following permissions are in the key: +These permissions can be found in the policies `[AWSBackupServiceRolePolicyForItemRestores](./security-iam-awsmanpol.html#AWSBackupServiceRolePolicyForItemRestores)` and `[AWSBackupServiceRolePolicyForIndexing](./security-iam-awsmanpol.html#AWSBackupServiceRolePolicyForIndexing)`. + +If you choose to encrypt search results with a customer-owned AWS KMS key, the following permission is required: @@ -65 +45,0 @@ If you choose to encrypt the search results with a customer managed AWS KMS key, - * `kms:Decrypt` @@ -68,0 +49 @@ If you choose to encrypt the search results with a customer managed AWS KMS key, +See [IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) in the _IAM User Guide_ for information on how to use roles and permissions.