AWS aws-backup documentation change
Summary
Updated IAM role references, recovery point copy instructions, and added support limitations
Security assessment
Changes include standardizing IAM roles and clarifying UI workflows. The IAM role update promotes using the default service role (security best practice), but no vulnerability is explicitly addressed. The Outposts limitation note is operational, not security-related.
Diff
diff --git a/aws-backup/latest/devguide/eks-backups.md b/aws-backup/latest/devguide/eks-backups.md index 74947f7c0..2255955ca 100644 --- a//aws-backup/latest/devguide/eks-backups.md +++ b//aws-backup/latest/devguide/eks-backups.md @@ -125 +125 @@ Use the **start-backup-job** command: - --iam-role-arn arn:aws:iam::123456789012:role/service-role \ + --iam-role-arn arn:aws:iam::123456789012:role/AWSBackupDefaultServiceRole \ @@ -134 +134 @@ Optionally, specify additional parameters such as lifecycle settings: - --iam-role-arn arn:aws:iam::123456789012:role/service-role \ + --iam-role-arn arn:aws:iam::123456789012:role/AWSBackupDefaultServiceRole \ @@ -215 +215 @@ To copy recovery points using the AWS Backup console: - 2. Click on **Protected Resources** in the left-hand navigation. In the text box, type `EKS` to display only your Amazon EKS clusters. + 2. Click on **Vaults** in the left-hand navigation, and go to the vault that contains the recovery point you want to copy. In the text box, type `EKS` to display only your recovery points for Amazon EKS clusters. @@ -217 +217 @@ To copy recovery points using the AWS Backup console: - 3. Composite recovery points will be displayed in the Recovery points pane. The plus sign (+) to the left of each recovery point ID can be clicked to expand each composite recovery point, showing all nested recovery points contained in the composite. You can click the radial circle button to the left of any recovery point to copy it. + 3. Both composite and nested recovery points will be displayed under the Recovery point ID pane. Note you cannot select and copy a nested EKS recovery point. @@ -219 +219,3 @@ To copy recovery points using the AWS Backup console: - 4. Once it is selected, click the **Copy** button in the top-right corner of the pane. + 4. The arrow sign to the left of each composite recovery point ID can be clicked to expand, showing all nested recovery points contained in the composite. You can click the square checkbox to the left of any recovery point to copy it. + + 5. Once it is selected, click the **Actions** dropdown in the top-right corner of the pane and click **Copy**. @@ -239 +241 @@ Amazon EKS backups support all copy types: - * Persistent volumes using a CSI Driver via CSI migration, in-tree storage plugins or ACK controllers are not supported. + * Persistent volumes using a CSI Driver via CSI migration, in-tree storage plugins or ACK controllers are not supported. Note that the annotation `volume.kubernetes.io/storage-provisioner: ebs.csi.aws.com` is metadata indicating which provisioner could manage the volume, not that the volume uses CSI. The actual provisioner is determined by the storageClass. @@ -241 +243 @@ Amazon EKS backups support all copy types: - * Amazon S3 buckets with specific prefixes attached to CSI Driver MountPoints cannot be backed up. Only Amazon S3 buckets as targets are supported, not specific prefixes + * Amazon S3 buckets with specific prefixes attached to CSI Driver MountPoints cannot be backed up. Only Amazon S3 buckets as targets are supported, not specific prefixes. @@ -245 +247,3 @@ Amazon EKS backups support all copy types: - * Amazon FSx via CSI driver is not supported via EKS Backups + * Amazon FSx via CSI driver is not supported via EKS Backups. + + * AWS Backup does not support Amazon EKS on AWS Outposts.