AWS aws-backup documentation change
Summary
Added CLI command examples for policy management and revised setup/sharing workflow documentation
Security assessment
Adds documentation about managing approval policies and clarifies secure access control workflows for air-gapped vaults. While not addressing a specific vulnerability, it enhances documentation of security-related access control features.
Diff
diff --git a/aws-backup/latest/devguide/multipartyapproval-tasks-administrator.md b/aws-backup/latest/devguide/multipartyapproval-tasks-administrator.md index 00a866a82..1398baf0a 100644 --- a//aws-backup/latest/devguide/multipartyapproval-tasks-administrator.md +++ b//aws-backup/latest/devguide/multipartyapproval-tasks-administrator.md @@ -21 +21,18 @@ During the [`aws mpa create-approval-team`](https://www.docs.aws.a2z.com/mpa/lat -The policy shown in the example in the _Multi-party approval User Guide_ in the procedure [Create an approval team](https://docs.aws.amazon.com/mpa/latest/userguide/create-team.html#create-team-steps) contains the policy `["arn:aws:mpa::aws:policy/backup.amazonaws.com/CreateRestoreAccessVault"]` with several necessary permissions. You can use `mpa list-policies` to return a list of available policies. +The policy shown in the example in the _Multi-party approval User Guide_ in the procedure [Create an approval team](https://docs.aws.amazon.com/mpa/latest/userguide/create-team.html#create-team-steps) contains the policy `["arn:aws:mpa::aws:policy/backup.amazonaws.com/CreateRestoreAccessVault"]` with several necessary permissions. + +Follow these steps to return a list of available policies by using `mpa list-policies`: + + 1. List Policies: + + aws mpa list-policies --region us-east-1 + + 2. List all policy versions: + + aws mpa list-policy-versions --policy-arn arn:aws:mpa:::aws:policy/backup.amazonaws.com/CreateRestoreAccessVault --region us-east-1 + + 3. Get details on a policy: + + aws mpa get-policy-version --policy-version-arn arn:aws:mpa:::aws:policy/backup.amazonaws.com/CreateRestoreAccessVault/1 --region us-east-1 + + + @@ -158,2 +175,2 @@ Feature | AWS RAM based sharing | Multi-party approval based access -**Setup** | Sharing can occur as soon as the AWS Backup account sets up RAM sharing and the receiving account accepts the share. | Sharing requires the management account to opt in to Multi-party approval and set up RAM sharing. Then, the management account must create a team and assign that team to a logically air-gapped vault. -**Sharing** | Sharing is done through RAM within same AWS organization or across AWS organizations. Access is granted according to the 'push' model, in which the management account first grants access, then the other account accepts access. | Access to a logically air-gapped vault is through Organizations supported approval teams within the same AWS organization or across organizations. Access is granted according to the 'pull' model, where the receiving account first requests access, then the approval team grants or denies the request. +**Setup** | Sharing can occur as soon as the AWS Backup account sets up RAM sharing and the receiving account accepts the share. | Sharing requires the management account to first create a team, then set up RAM sharing. Then, the management account opts in to Multi-party approval and assigns that team to a logically air-gapped vault. +**Sharing** | Sharing is done through RAM within same AWS organization or across AWS organizations. Access is granted according to the 'push' model, in which the account that owns the logically air-gapped vault first grants access. Then, the other account accepts access. | Access to a logically air-gapped vault is through Organizations supported approval teams within the same AWS organization or across organizations. Access is granted according to the 'pull' model, where the receiving account first requests access, then the approval team grants or denies the request.