AWS aws-backup documentation change
Summary
Restructured documentation to clarify service opt-in requirements and resource assignment workflows. Added sections for console/CLI configuration, CloudFormation support, and reorganized content about quotas.
Security assessment
Changes focus on improving documentation structure and clarifying operational processes for service opt-in/resource assignment. While it emphasizes proper configuration to ensure intended backups, there's no evidence of addressing a specific security vulnerability or weakness. The clarification about Aurora/Neptune/DocumentDB opt-in requirements maintains existing security controls rather than introducing new ones.
Diff
diff --git a/aws-backup/latest/devguide/assigning-resources.md b/aws-backup/latest/devguide/assigning-resources.md index 432f99f14..a8ace98d5 100644 --- a//aws-backup/latest/devguide/assigning-resources.md +++ b//aws-backup/latest/devguide/assigning-resources.md @@ -5 +5 @@ -Quotas on resource assignment +Opt in to services, then assign resourcesService opt-inResource assignmentResource assignment quotas @@ -7 +7 @@ Quotas on resource assignment -# Assign resources to a backup plan +# Select AWS services to backup @@ -9 +9 @@ Quotas on resource assignment -Resource assignment specifies which resources AWS Backup will protect using your backup plan. AWS Backup gives you both simple default settings and fine-grained controls to assign resources to your backup plan. Each time your backup plan runs, it scans your AWS account for all resources that match your resource assignment criteria. This level of automation allows you to define your backup plan and resource assignment exactly once. AWS Backup abstracts away the work of finding and backing up new resources that fit your earlier-defined resource assignment. +## Opt in to services, then assign resources @@ -11 +11 @@ Resource assignment specifies which resources AWS Backup will protect using your -You can assign any AWS Backup-supported resource types that you have opted in for AWS Backup to manage. For instructions on how to opt in to more AWS Backup-supported resource types, see [Service Opt-in](./getting-started.html#service-opt-in). +AWS Backup works with many [different AWS services](./backup-feature-availability.html#features-by-resource). Before you decide which services to include in backup plan, use the AWS Backup console or AWS CLI to opt in to using AWS Backup to work with those services. @@ -13 +13 @@ You can assign any AWS Backup-supported resource types that you have opted in fo -The AWS Backup console has two ways to include resource types in a backup plan: explicitly assign the resource type in a backup plan or include all resources. See the points below to understand how these selections work with service opt ins. +Then, in each backup plan, specify in the [console](./assigning-resources-console.html) or through [CLI](./assigning-resources-json.html) which resource types to include in that plan. @@ -15 +15 @@ The AWS Backup console has two ways to include resource types in a backup plan: - * If resource assignments are only based on tags, then service opt-in settings are applied. +For example, you can opt in to all services which AWS Backup supports, then include only Amazon S3 buckets and Aurora clusters in a backup plan. @@ -17 +17 @@ The AWS Backup console has two ways to include resource types in a backup plan: - * If a resource type is explicitly assigned to a backup plan, it will be included in the backup even if the opt-in is not enabled for that particular service. This does not apply to Aurora, Neptune, and Amazon DocumentDB. For these services to be included, the opt-in must be enabled. +###### Topics @@ -19 +19 @@ The AWS Backup console has two ways to include resource types in a backup plan: - * If both resource type and tags are specified in a resource assignment, the specified resource types are filtered first, then tags further filter those resources. + * AWS Backup service opt-in @@ -21 +21 @@ The AWS Backup console has two ways to include resource types in a backup plan: -Service opt-in settings are ignored for most resource types. However Aurora, Neptune, and Amazon DocumentDB require service opt-in. + * Backup plan resource assignment @@ -23 +23 @@ Service opt-in settings are ignored for most resource types. However Aurora, Nep - * When an account uses AWS Backup (creates a backup vault or backup plan) in a Region, the account automatically is opted into all resource types supported by AWS Backup in the Region at that time. Supported services added to that Region at a later date will not be automatically included in a backup plan. You can choose to opt into those resource types once they become supported. + * [Assign resources using the AWS Backup console](./assigning-resources-console.html) @@ -25 +25 @@ Service opt-in settings are ignored for most resource types. However Aurora, Nep - * For Amazon FSx for NetApp ONTAP, when using tag-based resource selection, apply tags to individual volumes instead of the whole file system. + * [Assign resources with AWS CLI](./assigning-resources-json.html) @@ -26,0 +27 @@ Service opt-in settings are ignored for most resource types. However Aurora, Nep + * [Assign AWS Backup resources through AWS CloudFormation](./assigning-resources-cfn.html) @@ -27,0 +29 @@ Service opt-in settings are ignored for most resource types. However Aurora, Nep + * Backup plan resource assignments quotas @@ -30 +31,0 @@ Service opt-in settings are ignored for most resource types. However Aurora, Nep -Your resource assignment can include (or exclude) _resource types_ and _resources_. @@ -32 +32,0 @@ Your resource assignment can include (or exclude) _resource types_ and _resource - * A _resource type_ includes every instance or resource of an AWS Backup-supported AWS service or third-party application. For example, the DynamoDB resource type refers to all your DynamoDB tables. @@ -34 +34 @@ Your resource assignment can include (or exclude) _resource types_ and _resource - * A _resource_ is a single instance of a resource type, such as one of your DynamoDB tables. You can specify a resource using its unique _resource ID_. +## AWS Backup service opt-in @@ -35,0 +36 @@ Your resource assignment can include (or exclude) _resource types_ and _resource +### Service opt-in through the AWS Backup console @@ -36,0 +38 @@ Your resource assignment can include (or exclude) _resource types_ and _resource +###### To configure the AWS services to use with AWS Backup @@ -37,0 +40 @@ Your resource assignment can include (or exclude) _resource types_ and _resource + 1. Sign in to the AWS Management Console, and open the AWS Backup console at [https://console.aws.amazon.com/backup](https://console.aws.amazon.com/backup). @@ -39 +42 @@ Your resource assignment can include (or exclude) _resource types_ and _resource -You can further refine your resource assignment using tags and conditional operators. + 2. In the navigation pane, choose **Settings**. @@ -41 +44 @@ You can further refine your resource assignment using tags and conditional opera -###### Topics + 3. On the **Service opt-in** page, choose **Configure resources**. @@ -43 +46,20 @@ You can further refine your resource assignment using tags and conditional opera - * [Assign resources using the AWS Backup console](./assigning-resources-console.html) + 4. On the **Configure resources** page, use the toggle switches to enable or disable the services that are used with AWS Backup. Choose **Confirm** when your services are configured. Make sure that the AWS service you're opting in is available in your AWS Region. + + + + +### Service opt-in through AWS CLI + +Use the [`aws backup update-region-settings`](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UpdateRegionSettings.html) command to change the services (resource types) your account or organization will use AWS Backup to orchestrate backup creation. Use the [`aws backup describe-region-settings`](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeRegionSettings.html) command to determine which services you have opted into in a specific Region. + +## Backup plan resource assignment + +Through the [AWS Backup console](./assigning-resources-console.html) or through [AWS CLI](./assigning-resources-json.html), the resource assignment in your backup plan specifies which resources AWS Backup will include. AWS Backup provides both simple default settings and fine-grained controls to assign resources. + +You can assign resources in the following ways: + + * Explicitly assign resource types to the backup plan + + * Include all resources (AWS Backup will then scan for all supported resource types) + + * Use tags to include or exclude resources @@ -45 +66,0 @@ You can further refine your resource assignment using tags and conditional opera - * [Assign resources with AWS CLI](./assigning-resources-json.html) @@ -47 +67,0 @@ You can further refine your resource assignment using tags and conditional opera - * [Assign AWS Backup resources through AWS CloudFormation](./assigning-resources-cfn.html) @@ -49 +68,0 @@ You can further refine your resource assignment using tags and conditional opera - * Quotas on resource assignment @@ -50,0 +70 @@ You can further refine your resource assignment using tags and conditional opera +If you only use tags for resource assignment, then the service opt-in settings will still apply. @@ -51,0 +72 @@ You can further refine your resource assignment using tags and conditional opera +You can further refine the resource assignment using conditions and tags. There are some limits on the number of ARNs, conditions, and tags that can be used in a single resource assignment. @@ -52,0 +74 @@ You can further refine your resource assignment using tags and conditional opera +Resource selection through CLI is based on service names and resource types. See [Assign resources with AWS CLI](./assigning-resources-json.html) for considerations about resource election. @@ -54 +76 @@ You can further refine your resource assignment using tags and conditional opera -## Quotas on resource assignment +## Backup plan resource assignments quotas