AWS aws-backup documentation change

Service: aws-backup · 2025-08-28 · Documentation low

File: aws-backup/latest/devguide/create-a-vault-access-policy.md

Summary

Removed three JSON policy examples demonstrating access restrictions for backup vault operations

Security assessment

The removed content was example IAM policies showing how to restrict backup operations, but their removal appears to be documentation cleanup rather than addressing a specific security vulnerability. While the policies themselves were security-related, deleting examples doesn't indicate a security fix.

Diff

diff --git a/aws-backup/latest/devguide/create-a-vault-access-policy.md b/aws-backup/latest/devguide/create-a-vault-access-policy.md
index 9f04354d6..101195856 100644
--- a//aws-backup/latest/devguide/create-a-vault-access-policy.md
+++ b//aws-backup/latest/devguide/create-a-vault-access-policy.md
@@ -36,32 +35,0 @@ This policy denies access to the specified API operations for all Amazon EBS sna
-JSON
-    
-
-****
-    
-    
-    
-    {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Sid": "DenyRecoveryPointOperations",
-          "Effect": "Deny",
-          "Principal": {
-            "AWS": "arn:aws:iam::111122223333:role/MyRole"
-          },
-          "Action": [
-            "backup:UpdateRecoveryPointLifecycle",
-            "backup:DescribeRecoveryPoint",
-            "backup:DeleteRecoveryPoint",
-            "backup:GetRecoveryPointRestoreMetadata",
-            "backup:StartRestoreJob"
-          ],
-          "Resource": [
-            "arn:aws:ec2:*:*:snapshot/*"
-          ]
-        }
-      ]
-    }
-    
-    
-
@@ -72,35 +39,0 @@ This policy denies access to the specified API operations targeting a backup vau
-JSON
-    
-
-****
-    
-    
-    
-    {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Sid": "DenyBackupVaultOperations",
-          "Effect": "Deny",
-          "Principal": {
-            "AWS": "arn:aws:iam::123456789012:role/MyRole"
-          },
-          "Action": [
-            "backup:DescribeBackupVault",
-            "backup:DeleteBackupVault",
-            "backup:PutBackupVaultAccessPolicy",
-            "backup:DeleteBackupVaultAccessPolicy",
-            "backup:GetBackupVaultAccessPolicy",
-            "backup:StartBackupJob",
-            "backup:GetBackupVaultNotifications",
-            "backup:PutBackupVaultNotifications",
-            "backup:DeleteBackupVaultNotifications",
-            "backup:ListRecoveryPointsByBackupVault"
-          ],
-          "Resource": "arn:aws:backup:us-east-1:123456789012:backup-vault:backup vault name"
-        }
-      ]
-    }
-    
-    
-
@@ -154,30 +86,0 @@ To allow list IAM identities using their ARN, use the `aws:PrincipalArn` global
-JSON
-    
-
-****
-    
-    
-        {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Sid": "DenyDeleteRecoveryPoint",
-          "Effect": "Deny",
-          "Principal": "*",
-          "Action": "backup:DeleteRecoveryPoint",
-          "Resource": "*",
-          "Condition": {
-            "ArnNotEquals": {
-              "aws:PrincipalArn": [
-                "arn:aws:iam::112233445566:role/mys3role",
-                "arn:aws:iam::112233445566:user/shaheer",
-                "arn:aws:iam::112233445566:root"
-              ]
-            }
-          }
-        }
-      ]
-    }
-    
-    
-