AWS aws-backup documentation change
Summary
Updated terminology from 'sharing backup vaults' to 'configuring backup vault access' for cross-account copies. Added clarification about resource-based policies and differentiation from LAG vault sharing. Updated steps and examples to reflect new terminology.
Security assessment
The changes improve documentation around access control mechanisms (resource-based policies) for cross-account backups but don't address any specific security vulnerability. The clarification enhances security posture by better explaining proper access configuration.
Diff
diff --git a/aws-backup/latest/devguide/create-cross-account-backup.md b/aws-backup/latest/devguide/create-cross-account-backup.md index 71b6209b8..fc1e15ead 100644 --- a//aws-backup/latest/devguide/create-cross-account-backup.md +++ b//aws-backup/latest/devguide/create-cross-account-backup.md @@ -5 +5 @@ -Setting up cross-account backupScheduling cross-account backupPerforming on-demand cross-account backupEncryption keys and cross-account copiesRestoring a backup from one AWS account to anotherSharing a backup vault with a different AWS accountConfiguring your account as a destination accountSecurity considerations for cross-account backup +Setting up cross-account backupScheduling cross-account backupPerforming on-demand cross-account backupEncryption keys and cross-account copiesRestoring a backup from one AWS account to anotherConfiguring backup vault access for cross-account copiesConfiguring your account as a destination accountSecurity considerations for cross-account backup @@ -75 +75 @@ For cross-account copy, the source vault and the destination vault are in differ - 7. Now, any account in your organization can share the contents of their backup vault with any other account in your organization. For more information, see Sharing a backup vault with a different AWS account. To limit which accounts can receive the contents of other accounts' backup vaults, see Configuring your account as a destination account. + 7. Now, any account in your organization can share the contents of their backup vault with any other account in your organization. For more information, see Configuring backup vault access for cross-account copies. To limit which accounts can receive the contents of other accounts' backup vaults, see Configuring your account as a destination account. @@ -253 +253 @@ Restoring a backup from one account to another is a two-step process. -## Sharing a backup vault with a different AWS account +## Configuring backup vault access for cross-account copies @@ -255 +255 @@ Restoring a backup from one account to another is a two-step process. -AWS Backup allows you to share a backup vault with one or multiple accounts, or your entire organization in AWS Organizations. You can share a destination backup vault with a source AWS Account, user, or IAM role. +AWS Backup allows you to configure your backup vault to grant access to other AWS accounts, allowing them to copy recovery points to your vault for cross-account backup. This access configuration uses resource-based policies to permit specific accounts to perform backup operations. @@ -257 +257,7 @@ AWS Backup allows you to share a backup vault with one or multiple accounts, or -###### To share a destination Backup vault +###### Note + +This is different from AWS Backup vault sharing for Logically Air Gapped (LAG) vaults, which uses AWS Resource Access Manager (RAM) to share vault resources directly. + +You can grant vault access to one or multiple accounts, or your entire organization in AWS Organizations. You can configure a destination backup vault with access for a source AWS Account, user, or IAM role. + +###### To configure vault access for a destination Backup vault @@ -261 +267 @@ AWS Backup allows you to share a backup vault with one or multiple accounts, or - 2. Choose the name of the backup vault that you want to share. + 2. Choose the name of the backup vault that you want to configure access for. @@ -267 +273 @@ AWS Backup allows you to share a backup vault with one or multiple accounts, or - 5. Enter the **AccountID** of the account you'd like to share with this destination backup vault. + 5. Enter the **AccountID** of the account you'd like to grant access to this destination backup vault. @@ -274 +280 @@ AWS Backup allows you to share a backup vault with one or multiple accounts, or -You can use IAM policies to share your backup vault. +You can use IAM policies to configure vault access. @@ -276 +282 @@ You can use IAM policies to share your backup vault. -###### Share a destination backup vault with an AWS account or IAM role +###### Configure destination backup vault access for an AWS account or IAM role @@ -278 +284 @@ You can use IAM policies to share your backup vault. -The following policy shares a backup vault with account number `4444555566666` and the IAM role `SomeRole` in account number `111122223333`. +The following policy configures vault access for account number `4444555566666` and the IAM role `SomeRole` in account number `111122223333`.