AWS aws-backup documentation change

Service: aws-backup · 2025-11-13 · Documentation medium

File: aws-backup/latest/devguide/security-iam-awsmanpol.md

Summary

Added EKS-related permissions to multiple AWS Backup managed policies to support backup/restore operations for EKS clusters

Security assessment

The changes document expanded IAM permissions required for a new feature (EKS support), which is security-relevant as it defines access controls. However, there is no indication these changes address a security vulnerability.

Diff

diff --git a/aws-backup/latest/devguide/security-iam-awsmanpol.md b/aws-backup/latest/devguide/security-iam-awsmanpol.md
index 2fbad4926..ab7facc87 100644
--- a//aws-backup/latest/devguide/security-iam-awsmanpol.md
+++ b//aws-backup/latest/devguide/security-iam-awsmanpol.md
@@ -691,0 +692,89 @@ Change | Description | Date
+AWSBackupFullAccess – Update to an existing policy |  AWS Backup added the following permissions to this policy:
+
+  * `eks:ListClusters`
+  * `eks:ListTagsForResource`
+  * `eks:DescribeCluster`
+
+These permissions allow AWS Backup to backup and restore Amazon EKS clusters. | November 10, 2025  
+AWSBackupOperatorAccess – Update to an existing policy |  AWS Backup added the following permissions to this policy:
+
+  * `eks:ListClusters`
+  * `eks:ListTagsForResource`
+  * `eks:DescribeCluster`
+
+These permissions allow AWS Backup to backup and restore Amazon EKS clusters. | November 10, 2025  
+AWSBackupServiceRolePolicyForBackup – Update to an existing policy |  AWS Backup added the following permissions to this policy:
+
+  * `eks:ListClusters`
+  * `eks:ListTagsForResource`
+  * `eks:DescribeCluster`
+  * `eks:ListAddons`
+  * `eks:DescribeAddon`
+  * `eks:ListNodegroups`
+  * `eks:DescribeNodegroup`
+  * `eks:ListPodIdentityAssociations`
+  * `eks:DescribePodIdentityAssociation`
+  * `eks:ListAccessEntries`
+  * `eks:DescribeAccessEntry`
+  * `eks:ListAssociatedAccessPolicies`
+  * `eks:ListFargateProfiles`
+  * `eks:DescribeFargateProfile`
+  * `ec2:DescribeLaunchTemplateVersions`
+  * `eks:CreateAccessEntry`
+  * `eks:AssociateAccessPolicy`
+  * `eks:DisassociateAccessPolicy`
+
+These permissions allow AWS Backup to create backups of Amazon EKS clusters and their associated resources on behalf of customers. | November 10, 2025  
+AWSBackupServiceLinkedRolePolicyForBackup – Update to an existing policy |  AWS Backup added the following permissions to this policy:
+
+  * `eks:ListClusters`
+  * `eks:ListTagsForResource`
+  * `eks:DescribeCluster`
+  * `eks:ListAddons`
+  * `eks:DescribeAddon`
+  * `eks:ListNodegroups`
+  * `eks:DescribeNodegroup`
+  * `eks:ListPodIdentityAssociations`
+  * `eks:DescribePodIdentityAssociation`
+  * `eks:ListAccessEntries`
+  * `eks:DescribeAccessEntry`
+  * `eks:ListAssociatedAccessPolicies`
+  * `eks:ListFargateProfiles`
+  * `eks:DescribeFargateProfile`
+  * `ec2:DescribeLaunchTemplateVersions`
+  * `eks:CreateAccessEntry`
+  * `eks:AssociateAccessPolicy`
+  * `eks:DisassociateAccessPolicy`
+
+These permissions allow AWS Backup to create backups of Amazon EKS clusters and their associated resources on behalf of customers. | November 10, 2025  
+AWSBackupServiceRolePolicyForRestores – Update to an existing policy |  AWS Backup added the following permissions to this policy:
+
+  * `eks:CreateCluster`
+  * `eks:DescribeCluster`
+  * `eks:CreateAccessEntry`
+  * `eks:DescribeAccessEntry`
+  * `eks:AssociateAccessPolicy`
+  * `eks:ListAssociatedAccessPolicies`
+  * `eks:CreateAddon`
+  * `eks:DescribeAddon`
+  * `eks:CreateNodegroup`
+  * `eks:DescribeNodegroup`
+  * `eks:CreateFargateProfile`
+  * `eks:DescribeFargateProfile`
+  * `eks:CreatePodIdentityAssociation`
+  * `eks:DescribePodIdentityAssociation`
+  * `eks:TagResource`
+  * `eks:DisassociateAccessPolicy`
+  * `iam:PassRole`
+  * `ec2:DescribeLaunchTemplateVersions`
+  * `ec2:DescribeSubnets`
+  * `ec2:RunInstances`
+  * `ec2:CreateTags`
+  * `iam:GetRole`
+  * `iam:ListAttachedRolePolicies`
+  * `backup:StartRestoreJob`
+  * `backup:ListRestoreJobs`
+  * `backup:ListRecoveryPointsByBackupVault`
+  * `backup:DescribeRestoreJob`
+
+These permissions allow AWS Backup to perform restore operations for Amazon EKS clusters and their associated resources on behalf of customers. | November 10, 2025