AWS aws-backup documentation change
Summary
Clarified Multi-party approval setup steps, added cost disclaimer, and expanded SCP policy guidance
Security assessment
Changes enhance documentation about a security control (Multi-party approval) but do not indicate remediation of a specific vulnerability. The updates provide operational clarity for a security feature without evidence of addressing an exploit or weakness.
Diff
diff --git a/aws-backup/latest/devguide/multipartyapproval.md b/aws-backup/latest/devguide/multipartyapproval.md index 0667764af..e7bfdac7d 100644 --- a//aws-backup/latest/devguide/multipartyapproval.md +++ b//aws-backup/latest/devguide/multipartyapproval.md @@ -13 +13,3 @@ AWS Backup offers you the option to add [Multi-party approval](https://docs.aws. -Multi-party approval is designed to help protect critical resources and to minimize the time to return to full operation (RTO), such as a disruption caused by malicious actors or malware events. This setup can help you restore the contents of a logically air-gapped vault that may have been compromised. +Multi-party approval is designed to help protect critical resources and to minimize the time to return to full operation, such as a disruption caused by malicious actors or malware events. This setup can help you restore the contents of a logically air-gapped vault that may have been compromised. + +There is no additional cost for integrating and using Multi-party approval teams with AWS Backup logically air-gapped vaults (storage and cross-region transfers charges apply, as shown on the [pricing](https://aws.amazon.com/backup/pricing) page). @@ -25 +27 @@ The following steps outline the recommended flow for setting up a recovery AWS o - 4. The administrator [shares an approval team](./multipartyapproval-tasks-administrator.html#share-multipartyapproval-team-using-ram) using AWS RAM with each account that owns at least one logically air-gapped vault (likely your primary account). + 4. The administrator uses AWS RAM to [share an approval team](./multipartyapproval-tasks-administrator.html#share-multipartyapproval-team-using-ram) with each account that owns at least one logically air-gapped vault (likely your primary account). Both the account that owns the vault and the secondary organization needs to have RAM set up. @@ -59 +61 @@ Before you can effectively and securely use Multi-party approval with your logic -AWS Backup recommends you apply a Service Control Policy (SCP) to your primary organization and configure it with the appropriate permissions to the organization and to each approval team. +AWS Backup recommends you apply a Service Control Policy (SCP) to your primary organization and configure it with the appropriate permissions to the organization and to each approval team. See Multi-party approval terms section for a sample policy. @@ -61 +63 @@ AWS Backup recommends you apply a Service Control Policy (SCP) to your primary o - 4. Your Multi-party approval team from the secondary (recovery) organization is [shared through AWS RAM](./multipartyapproval-tasks-administrator.html#share-multipartyapproval-team-using-ram) with your accounts that own the logically air-gapped vault(s). + 4. Your Multi-party approval team from the secondary (recovery) organization is [shared through AWS RAM](./multipartyapproval-tasks-administrator.html#share-multipartyapproval-team-using-ram) with both your accounts that own the logically air-gapped vault(s) and your recovery accounts.