AWS aws-backup documentation change
Summary
Added detailed Service Opt-in section explaining resource inclusion rules, clarified regional requirements, and added explicit opt-in instructions for supported services
Security assessment
The changes improve documentation about backup configuration requirements but do not address a specific security vulnerability. The emphasis on proper service opt-in and resource selection helps prevent misconfiguration that could lead to data protection gaps, making it preventive security guidance rather than a vulnerability fix.
Diff
diff --git a/aws-backup/latest/devguide/getting-started.md b/aws-backup/latest/devguide/getting-started.md index 675fc5eec..0d719e50d 100644 --- a//aws-backup/latest/devguide/getting-started.md +++ b//aws-backup/latest/devguide/getting-started.md @@ -5 +5 @@ -Prerequisites +PrerequisitesService Opt-in @@ -17,6 +17 @@ Before you begin, ensure that you have the following: - * At least one resource supported by AWS Backup. See the list of [ supported AWS resources and third-party applications](https://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.html#supported-resources). - -When new AWS services become available, enable AWS Backup to use those services. - - * If you intend to include multiple resource types, such as Amazon EBS volumes and Amazon S3 buckets, in the same backup plan, confirm those resources are in the same AWS Region. - + * At least one resource supported by AWS Backup. @@ -23,0 +19 @@ When new AWS services become available, enable AWS Backup to use those services. + * You should be familiar with the AWS services and resources that you are backing up. See the list of [ supported AWS resources and third-party applications](https://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.html#supported-resources). @@ -24,0 +21 @@ When new AWS services become available, enable AWS Backup to use those services. +When new AWS services become available, enable AWS Backup to use those services. @@ -35,0 +33,3 @@ When new AWS services become available, enable AWS Backup to use those services. +See [Assign resources to a backup plan](./assigning-resources.html) for additional information. The AWS Backup console allows a user to assign a resource type to a backup plan; this will be included even if the opt-in is not enabled for that particular service. + + * Make sure that the resources you're backing up are all in the same AWS Region. @@ -39 +38,0 @@ When new AWS services become available, enable AWS Backup to use those services. -See for additional information. The AWS Backup console allows a user to assign a resource type to a backup plan; this will be included even if the opt-in is not enabled for that particular service. @@ -44,0 +44,38 @@ The AWS Backup console provides different options to back up your resources. You +## Service Opt-in + +The AWS Backup console has two ways to include resource types in a backup plan: explicitly assign the resource type in a backup plan or include all resources. See the points below to understand how these selections work with service opt ins. + + * If resource assignments are only based on tags, then service opt-in settings are applied. + + * If a resource type is explicitly assigned to a backup plan, it will be included in the backup even if the opt-in is not enabled for that particular service. This does not apply to Aurora, Neptune, and Amazon DocumentDB. For these services to be included, the opt-in must be enabled. + + * If both resource type and tags are specified in a resource assignment, the specified resource types are filtered first, then tags further filter those resources. + +Service opt-in settings are ignored for most resource types. However Aurora, Neptune, and Amazon DocumentDB require service opt-in. + + * For Amazon FSx for NetApp ONTAP, when using tag-based resource selection, apply tags to individual volumes instead of the whole file system. + + + + +Opt-in choices apply to the specific account and AWS Region. When an account uses AWS Backup (creates a backup vault or backup plan) in a Region, the account automatically is opted into all resource types supported by AWS Backup in the Region at that time. Supported services added to that Region at a later date will not be automatically included in a backup plan. You can choose to opt into those resource types once they become supported. + +As AWS Backup supports more and more AWS services and third-party applications, you might need to revisit this step to opt in to those newly-supported resources. + +AWS Backup does not govern or manage backups taken in AWS environments other than AWS Backup. + +###### To opt in to use AWS Backup to protect all supported resource types + + 1. Sign in to the AWS Management Console, and open the AWS Backup console at [https://console.aws.amazon.com/backup](https://console.aws.amazon.com/backup). + + 2. In the left navigation pane, choose **Settings**. + + 3. Under **Service opt-in** , choose **Configure resources**. + + 4. Opt in to all AWS Backup-supported **Resources** by moving all the toggles to the right. + + 5. Choose **Confirm**. + + + +