AWS aws-backup documentation change
Summary
Updated cross-account backup requirements to emphasize explicit enablement through console/API and added service-linked role prerequisite for restores
Security assessment
While cross-account operations have security implications, these changes focus on operational setup requirements rather than addressing security vulnerabilities or documenting new security features. The service-linked role note helps prevent restore failures but doesn't directly relate to security controls.
Diff
diff --git a/aws-backup/latest/devguide/create-cross-account-backup.md b/aws-backup/latest/devguide/create-cross-account-backup.md index cd57d1256..83b1b1e14 100644 --- a//aws-backup/latest/devguide/create-cross-account-backup.md +++ b//aws-backup/latest/devguide/create-cross-account-backup.md @@ -46,3 +46 @@ You must “Allow” the access policy `backup:CopyIntoBackupVault` for your des -The management account is the primary account in your organization, as defined by AWS Organizations, that you use to manage cross-account backup across your AWS accounts. To use cross-account backup, you also must enable service trust. After enabling service trust, you can use any account in the organization as a destination account. From your destination account, you can choose which vaults to use for cross-account backup. - - * **Enable cross-account backup in the AWS Backup console** +The management account is the primary account in your organization, as defined by AWS Organizations, that you use to opt-in to cross-account backup across your AWS accounts. Before your organization can start with cross-account backups, you must enable cross-account backup in the AWS Backup console or through the [UpdateGlobalSettings](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UpdateGlobalSettings.html) API. @@ -242 +240 @@ AWS Backup does not support recovering resources from one AWS account to another -Restoring a backup from one account to another is a two-step process. +Before restoring a backup from one account to another, ensure that the destination account has the service-linked role (SLR) for the resource type you are restoring. If the destination account has never used that AWS service before, the SLR may not exist. You can create the SLR by using the service in the destination account, which automatically creates it. Once the SLR requirement is addressed, restoring a backup from one account to another is a two-step process: