AWS aws-backup documentation change

Service: aws-backup · 2025-11-16 · Documentation medium

File: aws-backup/latest/devguide/manage-cross-account.md

Summary

Added guidance about Backup Service-Linked Role requirements for delegated administrators

Security assessment

The changes emphasize proper IAM role configuration for cross-account backup management, which is a security best practice but doesn't address a specific vulnerability. It adds documentation about secure access control mechanisms.

Diff

diff --git a/aws-backup/latest/devguide/manage-cross-account.md b/aws-backup/latest/devguide/manage-cross-account.md
index e3d535d42..dcbd4a09b 100644
--- a//aws-backup/latest/devguide/manage-cross-account.md
+++ b//aws-backup/latest/devguide/manage-cross-account.md
@@ -128 +128,7 @@ Before you can delegate backup administration, you must first register at least
-  * In the AWS Backup console, ensure **backup policies** , **cross-account monitoring** , and **cross-account backup** features are turned on. These are below the **Delegated administrators** pane in the AWS Backup console.
+  * It is recommended that the Organization Management Account have the AWS Backup Backup Service-Linked Role (AWS BackupServiceRoleForBackup) present to automatically sync delegated administrator permissions with Organizations. This ensures delegated administrators have proper access when you enable opt-in regions or change administrator assignment. If the Backup Service-Linked Role is not present or got deleted, customers have a few options to create it: 
+
+    * Enabling the Delegated Administrator feature. 
+    * Access the Backup Vaults Console page. 
+    * Manually create it following the documentation in [ Creating the Default Service Role.](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create-service-linked-role.html)
+
+  * In the AWS Backup console, ensure **backup policies** , **cross-account monitoring** , **cross-account backup** , and **delegated administrator** features are turned on. These are below the **Delegated administrators** pane in the AWS Backup console.
@@ -133,0 +140,2 @@ Before you can delegate backup administration, you must first register at least
+    * _Optional:_ Delegated administrator, which allows AWS Backup Backup to automatically create the Backup Service-Linked Role to sync delegated administrator permissions with Organizations. 
+