AWS aws-backup medium security documentation change

Service: aws-backup · 2026-05-28 · Security-related medium

File: aws-backup/latest/devguide/security-iam-awsmanpol.md

Summary

Added section explaining how to build customer managed policies by extracting specific statements from AWS Backup managed policies

Security assessment

This change promotes least-privilege security practices by teaching users how to create granular IAM policies. It directly addresses security risks from over-permissive policies ('Resource': '*') and references IAM Access Analyzer warnings.

Diff

diff --git a/aws-backup/latest/devguide/security-iam-awsmanpol.md b/aws-backup/latest/devguide/security-iam-awsmanpol.md
index 15d4349a5..008f337cf 100644
--- a//aws-backup/latest/devguide/security-iam-awsmanpol.md
+++ b//aws-backup/latest/devguide/security-iam-awsmanpol.md
@@ -381,0 +382,35 @@ The following sections describe the recommended backup and restore permissions f
+### How to build a customer managed policy from managed policy statements
+
+Each service section below lists the specific statement names (Sids) you need from the AWS Backup managed policies. To build a least-privilege customer managed policy for a specific service, follow these steps:
+
+  1. Open the managed policy reference for [AWSBackupServiceRolePolicyForBackup](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSBackupServiceRolePolicyForBackup.html) (for backup permissions) or [AWSBackupServiceRolePolicyForRestores](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSBackupServiceRolePolicyForRestores.html) (for restore permissions).
+
+  2. Locate each statement by its `Sid` value as listed in the service section below.
+
+  3. Copy the full JSON block for each required statement into your custom policy document.
+
+  4. Wrap the statements in a valid IAM policy structure. Include the `Version` element to avoid [IAM Access Analyzer warnings](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-reference-policy-checks.html#access-analyzer-reference-policy-checks-general-warning-missing-version):
+    
+        {
+      "Version": "2012-10-17",
+      "Statement": [
+        // Paste your extracted statements here
+      ]
+    }
+
+  5. (Optional) Narrow the `Resource` field in each statement to restrict access to specific resources rather than using `"*"`.
+
+
+
+
+Alternatively, you can retrieve the full policy JSON using the AWS CLI:
+    
+    
+    aws iam get-policy-version \
+        --policy-arn arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup \
+        --version-id $(aws iam get-policy --policy-arn arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup --query "Policy.DefaultVersionId" --output text) \
+        --query "PolicyVersion.Document" \
+        --output json
+
+This returns the complete policy document, from which you can extract the statements you need by matching the `Sid` values listed in the service sections below.
+