AWS aws-backup high security documentation change

Service: aws-backup · 2026-05-28 · Security-related high

File: aws-backup/latest/devguide/cross-service-confused-deputy-prevention.md

Summary

Replaced generic statement with detailed KMS key policy example to prevent confused deputy attacks

Security assessment

Added concrete policy example specifically addressing confused deputy vulnerability. Security impact: High - provides explicit protection against unauthorized cross-account access through Backup service.

Diff

diff --git a/aws-backup/latest/devguide/cross-service-confused-deputy-prevention.md b/aws-backup/latest/devguide/cross-service-confused-deputy-prevention.md
index 55b7062a2..0787b38ef 100644
--- a//aws-backup/latest/devguide/cross-service-confused-deputy-prevention.md
+++ b//aws-backup/latest/devguide/cross-service-confused-deputy-prevention.md
@@ -17 +17,26 @@ The most effective way to protect against the confused deputy problem is to use
-The following example policy shows how you can use the `aws:SourceArn` and `aws:SourceAccount` global condition context keys in AWS Backup to prevent the confused deputy problem. This policy grants the service principal backup-storage.amazonaws.com ability to perform KMS actions only when the service principal is acting on behalf of AWS account 123456789012 on the backup vaults: 
+The following example shows how you can use the `aws:SourceArn` and `aws:SourceAccount` global condition context keys in AWS Backup to prevent the confused deputy problem. Add the following statement to your _KMS key policy_ to deny the service principal `backup-storage.amazonaws.com` from performing KMS actions unless the request originates from your specified backup vaults and account: 
+    
+    
+    {
+      "Sid": "Deny Backup Storage confused deputy",
+      "Effect": "Deny",
+      "Principal": {
+        "Service": "backup-storage.amazonaws.com"
+      },
+      "Action": [
+        "kms:Decrypt",
+        "kms:RetireGrant",
+        "kms:GenerateDataKey"
+      ],
+      "Resource": "*",
+      "Condition": {
+        "StringNotEquals": {
+          "aws:SourceAccount": "123456789012"
+        },
+        "ArnNotLike": {
+          "aws:SourceArn": "arn:aws::backup:us-east-1:123456789012:backup-vault:*"
+        }
+      }
+    }
+
+Replace `us-east-1` with your AWS Region and `123456789012` with your AWS account ID. This policy denies the AWS Backup storage service principal from using your KMS key unless the request comes from a backup vault in your specified account and Region.