AWS aws-backup documentation change

Service: aws-backup · 2025-05-28 · Documentation low

File: aws-backup/latest/devguide/security-iam-awsmanpol.md

Summary

Added multiple permissions to AWS Backup managed policies for Aurora DSQL backup/restore operations and KMS encryption operations.

Security assessment

Documents new IAM permissions including KMS cryptographic operations and DSQL resource management. While these permissions enable security-sensitive operations, the changes appear to support new features rather than address vulnerabilities. No evidence of remediating a security issue is present.

Diff

diff --git a/aws-backup/latest/devguide/security-iam-awsmanpol.md b/aws-backup/latest/devguide/security-iam-awsmanpol.md
index 4533967ad..07190fc83 100644
--- a//aws-backup/latest/devguide/security-iam-awsmanpol.md
+++ b//aws-backup/latest/devguide/security-iam-awsmanpol.md
@@ -666,0 +667,47 @@ Change | Description | Date
+AWSBackupFullAccess – Update to an existing policy |  AWS Backup added the following permissions to this policy:
+
+  * `dsql:GetCluster`
+  * `dsql:ListClusters`
+  * `dsql:ListTagsForResource`
+
+These permissions allow AWS Backup to backup and restore Amazon Aurora DSQL resources. | May 21, 2025  
+AWSBackupOperatorAccess – Update to an existing policy |  AWS Backup added the following permissions to this policy:
+
+  * `dsql:GetCluster`
+  * `dsql:ListClusters`
+  * `dsql:ListTagsForResource`
+
+These permissions allow AWS Backup to backup and restore Amazon Aurora DSQL resources. | May 21, 2025  
+AWSBackupServiceRolePolicyForBackup – Update to an existing policy |  AWS Backup added the following permissions to this policy:
+
+  * `kms:Decrypt`
+  * `kms:ReEncryptTo`
+  * `kms:ReEncryptFrom`
+  * `dsql:StartBackupJob`
+  * `dsql:GetBackupJob`
+  * `dsql:StopBackupJob`
+  * `dsql:GetCluster`
+  * `dsql:ListClusters`
+  * `dsql:ListTagsForResource`
+
+These permissions allow AWS Backup to create, delete, retrieve, and manage Amazon Aurora DSQL snapshots on behalf of customers. | May 21, 2025  
+AWSBackupServiceRolePolicyForRestores – Update to an existing policy |  AWS Backup added the following permissions to this policy:
+
+  * `ec2:DescribeRouteTables`
+  * `ec2:CreateTags`
+  * `dsql:StartRestoreJob`
+  * `dsql:GetRestoreJob`
+  * `dsql:StopRestoreJob`
+  * `dsql:TagResource`
+  * `dsql:CreateCluster`
+  * `dsql:PutMultiRegionProperties`
+  * `dsql:PutWitnessRegion`
+  * `kms:DescribeKey`
+
+These permissions allow AWS Backup to create, delete, retrieve, encrypt, decrypt, and manage Amazon Aurora DSQL snapshots on behalf of customers. | May 21, 2025  
+AWSBackupServiceLinkedRolePolicyForBackup – Update to an existing policy |  AWS Backup added the following permissions to this policy:
+
+  * `dsql:ListClusters`
+  * `dsql:ListTagsForResource`
+
+These permissions allow AWS Backup to manage Aurora DSQL backups at customer-specified intervals. | May 21, 2025