适用于 Amazon Backup 的托管策略 - Amazon Backup
AWS 文档中描述的 AWS 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 AWS 服务入门

本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。

适用于 Amazon Backup 的托管策略

托管策略

托管策略是基于身份的独立策略,您可以将其附加到Amazonaccount.

Amazon托管策略提供开箱即用的体验Amazon Backup

客户托管策略为您提供精细控件,以便在Amazon Backup。例如,您可以使用它们授予数据库备份管理员对 Amazon RDS 备份的访问权限,但不允许 Amazon EFS 备份的访问权限。

有关托管策略的更新,请参阅策略更新

Amazon 托管策略

一个Amazon管理的策略是由创建和管理的独立策略Amazon。Amazon托管策略可用于为很多常用案例提供权限。Amazon与必须自己编写策略相比,通过 托管策略可以更轻松地将适当的权限分配给用户、组和角色。

不过,您无法更改Amazon托管策略。Amazon有时会更新Amazon托管策略。当发生此情况时,更新会影响策略附加到的所有委托人实体(用户、组和角色)。

Amazon Backup提供了几个Amazon托管策略,以适用于常用案例。使用这些策略可以更轻松地定义正确的权限并控制对备份的访问。有两种托管策略。一种类型旨在分配给用户,以控制他们对 Amazon Backup 的访问。另一种托管策略旨在附加到您传递给 Amazon Backup 的角色。下表列出了 Amazon Backup 提供的所有托管策略,并说明了它们的定义方式。您可以在策略部分。

策略名称 IAM 托管策略名称 描述
Backup 管理员 IAM 策略 AWSBackupFullAccess

(已弃用 AWSBackupAdminPolicy)

备份管理员具有的完全访问权限。Amazon Backup操作,包括创建或编辑备份计划,分配Amazon资源用于备份计划和恢复备份。备份管理员负责通过定义满足其组织的业务和法规要求的备份计划来确定和强制实施备份合规性。Backup 管理员还需确保其组织的Amazon资源分配给适当的计划。
Backup 操作员 IAM 策略 AWSBackupOperatorAccess

(已弃用 AWSBackupOperatorPolicy)

备份操作员是这样的用户,他们负责确保正确备份自己负责的资源。Backup 操作员有权分配Amazon资源添加到备份管理员创建的备份计划。他们还有权创建其Amazon资源并配置按需备份的保留周期。备份操作员无权创建或编辑备份计划,也无权在创建备份计划后删除计划备份。备份操作员可以还原备份。您可以限制备份操作员可分配给备份计划或从备份还原的资源类型。为此,您可以仅允许将某些具有特定资源类型权限的服务角色传递给 Amazon Backup。
备份管理员 Amazon Organizations 策略 AWSBackupOrganizationAdminAccess 组织管理员对 Amazon Organizations 操作具有完全访问权限,这些操作包括创建、编辑或删除备份策略,将备份策略分配给账户和组织单位,以及监视组织内的备份活动。组织管理员负责通过定义和分配满足其组织业务和管理法规要求的备份策略来保护其组织中的账户。
用于备份的默认服务角色策略 AWSBackupServiceRolePolicyForBackup 提供 Amazon Backup 权限以代表您创建所有支持的资源类型的备份。
用于还原的默认服务角色策略 AWSBackupServiceRolePolicyForRestores 提供 Amazon Backup 权限以代表您还原所有支持的资源类型的备份。对于 EC2 实例还原,您还必须包含以下权限才能启动 EC2 实例:
"Action":"iam:PassRole", "Resource":"arn:aws:iam::account-id:role/role-name", "Effect":"Allow"

客户托管策略

您可以创建在自己的 Amazon 账户中管理的独立策略。这些策略称为客户托管策略。随后可以将这些策略附加到您 Amazon 账户中的多个委托人实体。将策略附加到委托人实体时,便向实体授予了策略中定义的权限。

创建客户托管策略的一种方式是:首先复制一个现有的Amazon托管策略。这样从一开始您就可以确信策略是正确的,只需根据您的环境进行自定义即可。

以下策略指定个别的备份和还原权限Amazon服务。它们可以经过定制并附加到您创建的角色,以进一步限制对Amazon资源的费用。

用于个人的 Backup 和还原策略Amazon服务
服务备份策略 服务还原策略
DynamoDB Backup 策略
{ "Version":"2012-10-17", "Statement":[ { "Action":[ "dynamodb:DescribeTable", "dynamodb:CreateBackup" ], "Resource":"arn:aws:dynamodb:*:*:table/*", "Effect":"Allow" }, { "Action":[ "tag:GetResources" ], "Resource":"*", "Effect":"Allow" }, { "Action":[ "dynamodb:DescribeBackup", "dynamodb:DeleteBackup" ], "Resource":"arn:aws:dynamodb:*:*:table/*/backup/*", "Effect":"Allow" }, { "Effect":"Allow", "Action":[ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource":"arn:aws:backup:*:*:backup-vault:*" } ] }
DynamoDB 还原策略
{ "Version":"2012-10-17", "Statement":[ { "Action":[ "dynamodb:DescribeBackup", "dynamodb:DescribeTable", "dynamodb:RestoreTableFromBackup", "dynamodb:Scan", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem" ], "Resource":"arn:aws:dynamodb:*:*:table/*", "Effect":"Allow" }, { "Action":[ "dynamodb:RestoreTableFromBackup", "dynamodb:DeleteBackup" ], "Resource":"arn:aws:dynamodb:*:*:table/*/backup/*", "Effect":"Allow" } ] }
Amazon EBS Backup 策略
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":"ec2:CreateTags", "Resource":"arn:aws:ec2:*::snapshot/*" }, { "Effect":"Allow", "Action":[ "ec2:CreateSnapshot", "ec2:DeleteSnapshot" ], "Resource":[ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect":"Allow", "Action":[ "ec2:DescribeVolumes", "ec2:DescribeSnapshots", "ec2:DescribeTags" ], "Resource":"*" }, { "Action":[ "tag:GetResources" ], "Resource":"*", "Effect":"Allow" }, { "Effect":"Allow", "Action":[ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource":"arn:aws:backup:*:*:backup-vault:*" } ] }
Amazon EBS 还原策略
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource":[ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect":"Allow", "Action":[ "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource":"*" } ] }
Amazon EFS Backup 策略
{ "Version":"2012-10-17", "Statement":[ { "Action":[ "elasticfilesystem:Backup", "elasticfilesystem:DescribeTags" ], "Resource":"arn:aws:elasticfilesystem:*:*:file-system/*", "Effect":"Allow" }, { "Action":[ "tag:GetResources" ], "Resource":"*", "Effect":"Allow" }, { "Effect":"Allow", "Action":[ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource":"arn:aws:backup:*:*:backup-vault:*" } ] }
Amazon EFS 还原策略
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "elasticfilesystem:Restore", "elasticfilesystem:CreateFilesystem", "elasticfilesystem:DescribeFilesystems", "elasticfilesystem:DeleteFilesystem" ], "Resource":"arn:aws:elasticfilesystem:*:*:file-system/*" } ] }
Amazon RDS Backup 策略
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:DescribeDBInstances", "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:CopyDBClusterSnapshot" ], "Resource":"*" }, { "Effect":"Allow", "Action":[ "rds:DeleteDBSnapshot", "rds:ModifyDBSnapshotAttribute" ], "Resource":[ "arn:aws:rds:*:*:snapshot:awsbackup:*" ] }, { "Effect": "Allow", "Action": [ "rds:DeleteDBClusterSnapshot", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Action":[ "tag:GetResources" ], "Resource":"*", "Effect":"Allow" }, { "Effect":"Allow", "Action":[ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource":"arn:aws:backup:*:*:backup-vault:*" }, { "Action":"kms:DescribeKey", "Effect":"Allow", "Resource":"*" } ] }
Amazon RDS 还原策略
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:ListTagsForResource", "rds:RestoreDBInstanceFromDBSnapshot", "rds:DeleteDBInstance", "rds:AddTagsToResource" ], "Resource":"*" } ] }
Amazon Aurora Backup 策略
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "rds:CreateDBClusterSnapshot", "rds:DescribeDBClusters", "rds:DescribeDBClusterSnapshots", "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:CopyDBClusterSnapshot" ], "Resource":"*" }, { "Effect":"Allow", "Action":[ "rds:DeleteDBClusterSnapshot" ], "Resource":[ "arn:aws:rds:*:*:cluster-snapshot:awsbackup:*" ] }, { "Action":[ "tag:GetResources" ], "Resource":"*", "Effect":"Allow" }, { "Effect":"Allow", "Action":[ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource":"arn:aws:backup:*:*:backup-vault:*" }, { "Action":"kms:DescribeKey", "Effect":"Allow", "Resource":"*" } ] }
Amazon Aurora 还原策略
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "rds:DeleteDBCluster", "rds:DescribeDBClusters", "rds:RestoreDBClusterFromSnapshot", "rds:ListTagsForResource", "rds:AddTagsToResource" ], "Resource":"*" } ] }
Amazon Storage Gateway 备份策略
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "storagegateway:CreateSnapshot", "storagegateway:ListTagsForResource" ], "Resource":"arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect":"Allow", "Action":[ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource":"arn:aws:ec2:*::snapshot/*" }, { "Effect":"Allow", "Action":[ "ec2:DescribeSnapshots" ], "Resource":"*" }, { "Action":[ "tag:GetResources" ], "Resource":"*", "Effect":"Allow" }, { "Effect":"Allow", "Action":[ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource":"arn:aws:backup:*:*:backup-vault:*" } ] }
Amazon Storage Gateway 还原策略
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "storagegateway:DeleteVolume", "storagegateway:DescribeCachediSCSIVolumes", "storagegateway:DescribeStorediSCSIVolumes" ], "Resource":"arn:aws:storagegateway:*:*:gateway/*/volume/*" }, { "Effect":"Allow", "Action":[ "storagegateway:DescribeGatewayInformation", "storagegateway:CreateStorediSCSIVolume", "storagegateway:CreateCachediSCSIVolume" ], "Resource":"arn:aws:storagegateway:*:*:gateway/*" }, { "Effect":"Allow", "Action":[ "storagegateway:ListVolumes" ], "Resource":"arn:aws:storagegateway:*:*:*" } ] }
Amazon FSx Backup 策略
{ "Version":"2012-10-17", "Statement":[ { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": "fsx:CreateBackup", "Effect": "Allow", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "fsx:ListTagsForResource", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "fsx:DeleteBackup", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Effect": "Allow", "Action": [ "fsx:ListTagsForResource", "fsx:ManageBackupPrincipalAssociations", "fsx:CopyBackup", "fsx:TagResource" ], "Resource": "arn:aws:fsx:*:*:backup/*" } ] }
Amazon FSx 还原策略
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "fsx:CreateFileSystemFromBackup" ], "Effect": "Allow", "Resource": [ "arn:aws:fsx:*:*:file-system/*", "arn:aws:fsx:*:*:backup/*" ] }, { "Action": "fsx:DescribeFileSystems", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*" }, { "Action": "fsx:DescribeBackups", "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:backup/*" }, { "Action": [ "fsx:DeleteFileSystem", "fsx:UntagResource" ], "Effect": "Allow", "Resource": "arn:aws:fsx:*:*:file-system/*", "Condition": { "Null": { "aws:ResourceTag/aws:backup:source-resource": "false" } } }, { "Action": "ds:DescribeDirectories", "Effect": "Allow", "Resource": "*" } ] }
Amazon EC2 Backup 策略
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource":"arn:aws:ec2:*::snapshot/*" }, { "Effect":"Allow", "Action":[ "ec2:CreateImage", "ec2:DeregisterImage" ], "Resource":"*" }, { "Effect":"Allow", "Action":[ "ec2:CopyImage", "ec2:CopySnapshot" ], "Resource":"*" }, { "Effect":"Allow", "Action":[ "ec2:CreateTags" ], "Resource":"arn:aws:ec2:*:*:image/*" }, { "Effect":"Allow", "Action":[ "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests" ], "Resource":"*" }, { "Effect":"Allow", "Action":[ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource":[ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Action":[ "tag:GetResources" ], "Resource":"*", "Effect":"Allow" }, { "Effect":"Allow", "Action":[ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource":"arn:aws:backup:*:*:backup-vault:*" } ] }
Amazon EC2 还原策略
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "ec2:CreateVolume", "ec2:DeleteVolume" ], "Resource":[ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Effect":"Allow", "Action":[ "ec2:DescribeSnapshots", "ec2:DescribeVolumes" ], "Resource":"*" }, { "Effect":"Allow", "Action":[ "ec2:DescribeImages", "ec2:DescribeInstances" ], "Resource":"*" }, { "Action":[ "ec2:RunInstances" ], "Effect":"Allow", "Resource":"*" }, { "Action":[ "ec2:TerminateInstances" ], "Effect":"Allow", "Resource":"arn:aws:ec2:*:*:instance/*" }, { "Action":"iam:PassRole", "Resource":"arn:aws:iam::<account-id>:role/<role-name>", "Effect":"Allow" } ] }
Windows VSS(卷影复制服务)Backup 策略
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "ec2:CreateTags", "ec2:DeleteSnapshot" ], "Resource":"arn:aws:ec2:*::snapshot/*" }, { "Effect":"Allow", "Action":[ "ec2:CreateImage", "ec2:DeregisterImage" ], "Resource":"*" }, { "Effect":"Allow", "Action":[ "ec2:CopyImage", "ec2:CopySnapshot" ], "Resource":"*" }, { "Effect":"Allow", "Action":[ "ec2:CreateTags" ], "Resource":"arn:aws:ec2:*:*:image/*" }, { "Effect":"Allow", "Action":[ "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeNetworkInterfaces", "ec2:DescribeElasticGpus", "ec2:DescribeSpotInstanceRequests" ], "Resource":"*" }, { "Effect":"Allow", "Action":[ "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource":[ "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Action":[ "tag:GetResources" ], "Resource":"*", "Effect":"Allow" }, { "Effect":"Allow", "Action":[ "backup:DescribeBackupVault", "backup:CopyIntoBackupVault" ], "Resource":"arn:aws:backup:*:*:backup-vault:*" }, { "Effect":"Allow", "Action":[ "ssm:CancelCommand", "ssm:GetCommandInvocation" ], "Resource":"*" }, { "Effect":"Allow", "Action":"ssm:SendCommand", "Resource":[ "arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot", "arn:aws:ec2:*:*:instance/*" ] } ] }

要还原加密的备份,请执行下列操作之一:

  • 允许在Amazon Key Management Service(Amazon KMS) 密钥策略,或

  • 将此策略附加到您的 IAM 角色以进行恢复:

    { "Action": [ "kms:DescribeKey", "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:ReEncrypt", ], "Effect": "Allow", "Resource": "*" }