AWS Security ChangesHomeSearch

AWS organizations medium security documentation change

Service: organizations · 2025-05-25 · Security-related medium

File: organizations/latest/userguide/orgs_manage_policies_backup_syntax.md

Summary

Added 'index_actions' configuration for backup search capabilities with EBS/S3 resource types and IAM requirements

Security assessment

Introduces documentation about backup index creation requiring specific IAM permissions, which relates to access control and security configuration

Diff

diff --git a/organizations/latest/userguide/orgs_manage_policies_backup_syntax.md b/organizations/latest/userguide/orgs_manage_policies_backup_syntax.md
index a769e2d1e..ad2c60553 100644
--- a//organizations/latest/userguide/orgs_manage_policies_backup_syntax.md
+++ b//organizations/latest/userguide/orgs_manage_policies_backup_syntax.md
@@ -111,0 +112 @@ Backup rule elements Element | Description | Required
+`index_actions` | Specifies whether AWS Backup creates backup index of your EBS Snapshots and/or S3 Backups. Backup indexes are created in order to search the metadata of your backups. For more information about backup index creation and backup search, see [Backup Search](https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-search.html#backup-search-overview). **Note: additional[IAM role permissions](https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-search.html#backup-search-access) are required for EBS snapshot backup index creation.** Each index action contains the following element: `resource_types` where resource types supported for indexing are EBS and S3. This parameter specificies which resource type will be opted into indexing.  | No  
@@ -283,0 +285,8 @@ The following example shows a backup policy that is assigned to one of the paren
+                        "index_actions": {
+                            "resource_types": {
+                                "@@assign": [
+                                    "EBS",
+                                    "S3"
+                                ]
+                            }
+                         },
@@ -364,0 +374,8 @@ If no other policies are inherited or attached to the accounts, the effective po
+                        "index_actions": {
+                            "resource_types": {
+                                "@@assign": [
+                                    "EBS",
+                                    "S3"
+                                ]
+                            }
+                         },
@@ -430,0 +448,8 @@ In the following example, an inherited parent policy and a child policy either i
+                        "index_actions": {
+                            "resource_types": {
+                                "@@assign": [
+                                    "EBS",
+                                    "S3"
+                                ]
+                            }
+                         },
@@ -519,0 +545,8 @@ In the following example, an inherited parent policy and a child policy either i
+                        "index_actions": {
+                            "resource_types": {
+                                "@@assign": [
+                                    "EBS",
+                                    "S3"
+                                ]
+                            }
+                         },
@@ -623,0 +657,9 @@ In the following example, an inherited parent policy uses the [child control ope
+                        "index_actions": {
+                           "@@operators_allowed_for_child_policies": ["@@none"],
+                            "resource_types": {
+                                "@@assign": [
+                                    "EBS",
+                                    "S3"
+                                ]
+                            }
+                         },
@@ -719,0 +762,8 @@ In the following example, an inherited parent policy uses the [child control ope
+                        "index_actions": {
+                            "resource_types": {
+                                "@@assign": [
+                                    "EBS",
+                                    "S3"
+                                ]
+                            }
+                         },
@@ -829,0 +880,8 @@ In the following example, a child policy uses [value-setting operators](./policy
+                        "index_actions": {
+                            "resource_types": {
+                                "@@assign": [
+                                    "EBS",
+                                    "S3"
+                                ]
+                            }
+                         },
@@ -920,0 +979,8 @@ In the following example, a child policy uses [value-setting operators](./policy
+                         "index_actions": {
+                            "resource_types": {
+                                "@@assign": [
+                                    "EBS",
+                                    "S3"
+                                ]
+                            }
+                         },