AWS aws-backup medium security documentation change

Service: aws-backup · 2026-06-28 · Security-related medium

File: aws-backup/latest/devguide/restore-testing-inferred-metadata.md

Summary

Added section 'Format for list-typed override values' explaining JSON-array encoding for security group IDs and similar list parameters in restore metadata overrides.

Security assessment

The change explicitly documents security-sensitive parameters (vpcSecurityGroupIds, securityGroupIds) and how to format them correctly. Misconfiguration of security groups could lead to unauthorized access, making this a security-relevant documentation update.

Diff

diff --git a/aws-backup/latest/devguide/restore-testing-inferred-metadata.md b/aws-backup/latest/devguide/restore-testing-inferred-metadata.md
index 915ba8175..49bc1eb3a 100644
--- a//aws-backup/latest/devguide/restore-testing-inferred-metadata.md
+++ b//aws-backup/latest/devguide/restore-testing-inferred-metadata.md
@@ -6,0 +7,2 @@
+Format for list-typed override values
+
@@ -76,0 +79,28 @@ For FSx for ONTAP resources, the Storage Virtual Machine (SVM) that you specify
+## Format for list-typed override values
+
+Because `RestoreMetadataOverrides` is a map of string key-value pairs, override values that represent lists (such as `vpcSecurityGroupIds`, `availabilityZones`, `enableCloudwatchLogsExports`, `securityGroupIds`, and `subnetIds`) must be specified as JSON-array-encoded strings.
+
+For example, to specify a single security group:
+    
+    
+    "vpcSecurityGroupIds": "[\"sg-012d52c68c6e88f00\"]"
+
+To specify multiple security groups:
+    
+    
+    "vpcSecurityGroupIds": "[\"sg-012d52c68c6e88f00\",\"sg-abcdef01234567890\"]"
+
+In AWS CloudFormation templates, you can use the `!Sub` intrinsic function to reference resource attributes within the JSON-array string:
+    
+    
+    RestoreMetadataOverrides:
+      vpcSecurityGroupIds: !Sub '["${DBSecurityGroup.GroupId}"]'
+
+For multiple values in CloudFormation:
+    
+    
+    RestoreMetadataOverrides:
+      vpcSecurityGroupIds: !Sub '["${DBSecurityGroup.GroupId}","${AnotherSecurityGroup.GroupId}"]'
+
+This JSON-array-string format applies to all list-typed overrides in the preceding table. For more examples of this format, see [Restore an RDS database](./restoring-rds.html).
+