AWS organizations medium security documentation change
Summary
Added 'index_actions' configuration for backup search capabilities with EBS/S3 resource types and IAM requirements
Security assessment
Introduces documentation about backup index creation requiring specific IAM permissions, which relates to access control and security configuration
Diff
diff --git a/organizations/latest/userguide/orgs_manage_policies_backup_syntax.md b/organizations/latest/userguide/orgs_manage_policies_backup_syntax.md index a769e2d1e..ad2c60553 100644 --- a//organizations/latest/userguide/orgs_manage_policies_backup_syntax.md +++ b//organizations/latest/userguide/orgs_manage_policies_backup_syntax.md @@ -111,0 +112 @@ Backup rule elements Element | Description | Required +`index_actions` | Specifies whether AWS Backup creates backup index of your EBS Snapshots and/or S3 Backups. Backup indexes are created in order to search the metadata of your backups. For more information about backup index creation and backup search, see [Backup Search](https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-search.html#backup-search-overview). **Note: additional[IAM role permissions](https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-search.html#backup-search-access) are required for EBS snapshot backup index creation.** Each index action contains the following element: `resource_types` where resource types supported for indexing are EBS and S3. This parameter specificies which resource type will be opted into indexing. | No @@ -283,0 +285,8 @@ The following example shows a backup policy that is assigned to one of the paren + "index_actions": { + "resource_types": { + "@@assign": [ + "EBS", + "S3" + ] + } + }, @@ -364,0 +374,8 @@ If no other policies are inherited or attached to the accounts, the effective po + "index_actions": { + "resource_types": { + "@@assign": [ + "EBS", + "S3" + ] + } + }, @@ -430,0 +448,8 @@ In the following example, an inherited parent policy and a child policy either i + "index_actions": { + "resource_types": { + "@@assign": [ + "EBS", + "S3" + ] + } + }, @@ -519,0 +545,8 @@ In the following example, an inherited parent policy and a child policy either i + "index_actions": { + "resource_types": { + "@@assign": [ + "EBS", + "S3" + ] + } + }, @@ -623,0 +657,9 @@ In the following example, an inherited parent policy uses the [child control ope + "index_actions": { + "@@operators_allowed_for_child_policies": ["@@none"], + "resource_types": { + "@@assign": [ + "EBS", + "S3" + ] + } + }, @@ -719,0 +762,8 @@ In the following example, an inherited parent policy uses the [child control ope + "index_actions": { + "resource_types": { + "@@assign": [ + "EBS", + "S3" + ] + } + }, @@ -829,0 +880,8 @@ In the following example, a child policy uses [value-setting operators](./policy + "index_actions": { + "resource_types": { + "@@assign": [ + "EBS", + "S3" + ] + } + }, @@ -920,0 +979,8 @@ In the following example, a child policy uses [value-setting operators](./policy + "index_actions": { + "resource_types": { + "@@assign": [ + "EBS", + "S3" + ] + } + },