AWS aws-backup documentation change
Summary
Clarified required IAM permissions for EBS restore operations by explicitly mentioning the AWSBackupServiceRolePolicyForItemRestores managed policy.
Security assessment
The change adds documentation about required IAM permissions for secure restore operations but does not indicate a specific security vulnerability being addressed.
Diff
diff --git a/aws-backup/latest/devguide/restoring-ebs.md b/aws-backup/latest/devguide/restoring-ebs.md index 9a72c64ea..33618a348 100644 --- a//aws-backup/latest/devguide/restoring-ebs.md +++ b//aws-backup/latest/devguide/restoring-ebs.md @@ -21 +21 @@ When you restore to a gateway volume, you will need to specify a gateway in a re -Prior to starting a restore job of EBS resources to an Amazon S3 bucket, review [EBS permissions](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSBackupServiceRolePolicyForRestores.html) and [Amazon S3 restore permissions](./restoring-s3.html#s3-restore-permissions) for access requirements. +Prior to starting a restore job of EBS resources to an Amazon S3 bucket, review [ EBS permissions](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSBackupServiceRolePolicyForRestores.html) and [Amazon S3 restore permissions](./restoring-s3.html#s3-restore-permissions) for access requirements. The necessary permissions are contained in the managed policy [AWSBackupServiceRolePolicyForItemRestores](./security-iam-awsmanpol.html#AWSBackupServiceRolePolicyForItemRestores) and should be included in the [IAM role](./authentication.html) used for the restore operation. @@ -25 +25 @@ All new object uploads, including restored data, to an S3 bucket is automaticall -You can input up to five paths when restoring from the AWS Backup console; you can specify multiple paths through the command line. A path must have a length less than 1024 bytes in UTF-8 encoded strings, including the user-designated and AWS Backup-designated prefixes +You can input up to five paths when restoring from the AWS Backup console; you can specify multiple paths through the command line. A path must have a length less than 1024 bytes in UTF-8 encoded strings, including the user-designated and AWS Backup-designated prefixes.