Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Backup

Amazon Backup (service prefix: backup) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Backup
Actions defined by Amazon Backup
Permission-only actions for Amazon Backup
Resource types defined by Amazon Backup
Condition keys for Amazon Backup

API operations defined by Amazon Backup

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociateBackupVaultMpaApprovalTeam	backup:AssociateBackupVaultMpaApprovalTeam			Write
CancelLegalHold	backup:CancelLegalHold			Write
CreateBackupPlan	backup:CreateBackupPlan			Write
	backup:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	malware-protection.guardduty.amazonaws.com	Write
CreateBackupSelection	backup:CreateBackupSelection			Write
CreateBackupSelection	iam:PassRole	iam:PassedToService	backup.amazonaws.com	Write
CreateBackupVault	backup:CreateBackupVault			Write
CreateBackupVault	backup:TagResource			Tagging, Write
CreateFramework	backup:CreateFramework			Write
CreateFramework	backup:TagResource			Tagging, Write
CreateLegalHold	backup:CreateLegalHold			Write
CreateLegalHold	backup:TagResource			Tagging, Write
CreateLogicallyAirGappedBackupVault	backup:CreateLogicallyAirGappedBackupVault			Write
CreateLogicallyAirGappedBackupVault	backup:TagResource			Tagging, Write
CreateReportPlan	backup:CreateReportPlan			Write
CreateReportPlan	backup:TagResource			Tagging, Write
CreateRestoreAccessBackupVault	backup:CreateRestoreAccessBackupVault			Write
CreateRestoreAccessBackupVault	backup:TagResource			Tagging, Write
CreateRestoreTestingPlan	backup:CreateRestoreTestingPlan			Write
CreateRestoreTestingPlan	backup:TagResource			Tagging, Write
CreateRestoreTestingSelection	backup:CreateRestoreTestingSelection			Write
CreateRestoreTestingSelection	iam:PassRole	iam:PassedToService	restore-testing.backup.amazonaws.com	Write
CreateTieringConfiguration	backup:CreateTieringConfiguration			Write
CreateTieringConfiguration	backup:TagResource			Tagging, Write
DeleteBackupPlan	backup:DeleteBackupPlan			Write
DeleteBackupSelection	backup:DeleteBackupSelection			Write
DeleteBackupVault	backup:DeleteBackupVault			Write
DeleteBackupVaultAccessPolicy	backup:DeleteBackupVaultAccessPolicy			Permissions management, Write
DeleteBackupVaultLockConfiguration	backup:DeleteBackupVaultLockConfiguration			Write
DeleteBackupVaultNotifications	backup:DeleteBackupVaultNotifications			Write
DeleteFramework	backup:DeleteFramework			Write
DeleteRecoveryPoint	backup:DeleteRecoveryPoint			Write
DeleteReportPlan	backup:DeleteReportPlan			Write
DeleteRestoreTestingPlan	backup:DeleteRestoreTestingPlan			Write
DeleteRestoreTestingSelection	backup:DeleteRestoreTestingSelection			Write
DeleteTieringConfiguration	backup:DeleteTieringConfiguration			Write
DescribeBackupJob	backup:DescribeBackupJob			Read
DescribeBackupVault	backup:DescribeBackupVault			Read
DescribeCopyJob	backup:DescribeCopyJob			Read
DescribeFramework	backup:DescribeFramework			Read
DescribeGlobalSettings	backup:DescribeGlobalSettings			Read
DescribeProtectedResource	backup:DescribeProtectedResource			Read
DescribeRecoveryPoint	backup:DescribeRecoveryPoint			Read
DescribeRegionSettings	backup:DescribeRegionSettings			Read
DescribeReportJob	backup:DescribeReportJob			Read
DescribeReportPlan	backup:DescribeReportPlan			Read
DescribeRestoreJob	backup:DescribeRestoreJob			Read
DescribeScanJob	backup:DescribeScanJob			Read
DisassociateBackupVaultMpaApprovalTeam	backup:DisassociateBackupVaultMpaApprovalTeam			Write
DisassociateRecoveryPoint	backup:DisassociateRecoveryPoint			Write
DisassociateRecoveryPointFromParent	backup:DisassociateRecoveryPointFromParent			Write
ExportBackupPlanTemplate	backup:ExportBackupPlanTemplate			Read
GetBackupPlan	backup:GetBackupPlan			Read
GetBackupPlanFromJSON	backup:GetBackupPlanFromJSON			Read
GetBackupPlanFromTemplate	backup:GetBackupPlanFromTemplate			Read
GetBackupSelection	backup:GetBackupSelection			Read
GetBackupVaultAccessPolicy	backup:GetBackupVaultAccessPolicy			Read
GetBackupVaultNotifications	backup:GetBackupVaultNotifications			Read
GetLegalHold	backup:GetLegalHold			Read
GetPITRMalwareScanResults	backup:GetPITRMalwareScanResults			Read
GetRecoveryPointIndexDetails	backup:GetRecoveryPointIndexDetails			Read
GetRecoveryPointRestoreMetadata	backup:GetRecoveryPointRestoreMetadata			Read
GetRestoreJobMetadata	backup:GetRestoreJobMetadata			Read
GetRestoreTestingInferredMetadata	backup:GetRestoreTestingInferredMetadata			Read
GetRestoreTestingPlan	backup:GetRestoreTestingPlan			Read
GetRestoreTestingSelection	backup:GetRestoreTestingSelection			Read
GetSupportedResourceTypes	backup:GetSupportedResourceTypes			Read
GetTieringConfiguration	backup:GetTieringConfiguration			Read
ListBackupJobSummaries	backup:ListBackupJobSummaries			List
ListBackupJobs	backup:ListBackupJobs			List
ListBackupPlanTemplates	backup:ListBackupPlanTemplates			List
ListBackupPlanVersions	backup:ListBackupPlanVersions			List
ListBackupPlans	backup:ListBackupPlans			List
ListBackupSelections	backup:ListBackupSelections			List
ListBackupVaults	backup:ListBackupVaults			List
ListCopyJobSummaries	backup:ListCopyJobSummaries			List
ListCopyJobs	backup:ListCopyJobs			List
ListFrameworks	backup:ListFrameworks			List
ListIndexedRecoveryPoints	backup:ListIndexedRecoveryPoints			List
ListLegalHolds	backup:ListLegalHolds			List
ListProtectedResources	backup:ListProtectedResources			List
ListProtectedResourcesByBackupVault	backup:ListProtectedResourcesByBackupVault			List
ListRecoveryPointsByBackupVault	backup:ListRecoveryPointsByBackupVault			List
ListRecoveryPointsByLegalHold	backup:ListRecoveryPointsByLegalHold			List
ListRecoveryPointsByResource	backup:ListRecoveryPointsByResource			List
ListReportJobs	backup:ListReportJobs			List
ListReportPlans	backup:ListReportPlans			List
ListRestoreAccessBackupVaults	backup:ListRestoreAccessBackupVaults			List
ListRestoreJobSummaries	backup:ListRestoreJobSummaries			List
ListRestoreJobs	backup:ListRestoreJobs			List
ListRestoreJobsByProtectedResource	backup:ListRestoreJobsByProtectedResource			List
ListRestoreTestingPlans	backup:ListRestoreTestingPlans			List
ListRestoreTestingSelections	backup:ListRestoreTestingSelections			List
ListScanJobSummaries	backup:ListScanJobSummaries			List
ListScanJobs	backup:ListScanJobs			List
ListTags	backup:ListTags			Read
ListTieringConfigurations	backup:ListTieringConfigurations			List
PutBackupVaultAccessPolicy	backup:PutBackupVaultAccessPolicy			Permissions management, Write
PutBackupVaultLockConfiguration	backup:PutBackupVaultLockConfiguration			Write
PutBackupVaultNotifications	backup:PutBackupVaultNotifications			Write
PutRestoreValidationResult	backup:PutRestoreValidationResult			Write
RevokeRestoreAccessBackupVault	backup:RevokeRestoreAccessBackupVault			Write
StartBackupJob	backup:StartBackupJob			Write
StartBackupJob	iam:PassRole	iam:PassedToService	backup.amazonaws.com	Write
StartCopyJob	backup:StartCopyJob			Write
StartCopyJob	iam:PassRole	iam:PassedToService	backup.amazonaws.com	Write
StartReportJob	backup:StartReportJob			Write
StartRestoreJob	backup:StartRestoreJob			Write
StartRestoreJob	iam:PassRole	iam:PassedToService	backup.amazonaws.com	Write
StartScanJob	backup:StartScanJob			Write
StartScanJob	iam:PassRole	iam:PassedToService	backup.amazonaws.com, malware-protection.guardduty.amazonaws.com	Write
StopBackupJob	backup:StopBackupJob			Write
TagResource	backup:TagResource			Tagging, Write
UntagResource	backup:UntagResource			Tagging, Write
UpdateBackupPlan	backup:UpdateBackupPlan			Write
UpdateBackupPlan	iam:PassRole	iam:PassedToService	malware-protection.guardduty.amazonaws.com	Write
UpdateFramework	backup:UpdateFramework			Write
UpdateGlobalSettings	backup:UpdateGlobalSettings			Write
UpdateRecoveryPointIndexSettings	backup:UpdateRecoveryPointIndexSettings			Write
UpdateRecoveryPointIndexSettings	iam:PassRole	iam:PassedToService	backup.amazonaws.com	Write
UpdateRecoveryPointLifecycle	backup:UpdateRecoveryPointLifecycle			Write
UpdateRegionSettings	backup:UpdateRegionSettings			Write
UpdateReportPlan	backup:UpdateReportPlan			Write
UpdateRestoreTestingPlan	backup:UpdateRestoreTestingPlan			Write
UpdateRestoreTestingSelection	backup:UpdateRestoreTestingSelection			Write
UpdateRestoreTestingSelection	iam:PassRole	iam:PassedToService	restore-testing.backup.amazonaws.com	Write
UpdateTieringConfiguration	backup:UpdateTieringConfiguration			Write

Actions defined by Amazon Backup

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateBackupVaultMpaApprovalTeam	Grants permission to associate an MPA approval team with a backup vault	backupVault*	aws:ResourceTag/${TagKey} backup:MpaApprovalTeamArn	Write
CancelLegalHold	Grants permission to cancel a legal hold	legalHold*	aws:ResourceTag/${TagKey}	Write
CreateBackupPlan	Grants permission to create a new backup plan	backupPlan*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateBackupSelection	Grants permission to create a new resource assignment in a backup plan	backupPlan*	aws:ResourceTag/${TagKey}	Write
CreateBackupVault	Grants permission to create a new backup vault	backupVault*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFramework	Grants permission to create a new framework	framework*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateLegalHold	Grants permission to create a new legal hold	legalHold*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateLogicallyAirGappedBackupVault	Grants permission to create a new logically air-gapped backup vault, a logical container where backups are stored	backupVault*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys backup:MaxRetentionDays backup:MinRetentionDays	Write
CreateReportPlan	Grants permission to create a new report plan	reportPlan*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys backup:FrameworkArns	Write
CreateRestoreAccessBackupVault	Grants permission to create a restore access backup vault	backupVault*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRestoreTestingPlan	Grants permission to create a new restore testing plan	restoreTestingPlan*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRestoreTestingSelection	Grants permission to create a new resource assignment in a restore testing plan	restoreTestingPlan*	aws:ResourceTag/${TagKey}	Write
CreateTieringConfiguration	Grants permission to create a new tiering configuration	tieringConfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteBackupPlan	Grants permission to delete a backup plan	backupPlan*	aws:ResourceTag/${TagKey}	Write
DeleteBackupSelection	Grants permission to delete a resource assignment from a backup plan	backupPlan*	aws:ResourceTag/${TagKey}	Write
DeleteBackupVault	Grants permission to delete a backup vault	backupVault*	aws:ResourceTag/${TagKey}	Write
DeleteBackupVaultAccessPolicy	Grants permission to delete backup vault access policy	backupVault*	aws:ResourceTag/${TagKey}	Permissions management, Write
DeleteBackupVaultLockConfiguration	Grants permission to remove the lock configuration from a backup vault	backupVault*	aws:ResourceTag/${TagKey}	Write
DeleteBackupVaultNotifications	Grants permission to remove the notifications from a backup vault	backupVault*	aws:ResourceTag/${TagKey}	Write
DeleteFramework	Grants permission to delete a framework	framework*	aws:ResourceTag/${TagKey}	Write
DeleteRecoveryPoint	Grants permission to delete a recovery point from a backup vault	recoveryPoint*	aws:ResourceTag/${TagKey}	Write
DeleteReportPlan	Grants permission to delete a report plan	reportPlan*	aws:ResourceTag/${TagKey}	Write
DeleteRestoreTestingPlan	Grants permission to delete a restore testing plan	restoreTestingPlan*	aws:ResourceTag/${TagKey}	Write
DeleteRestoreTestingSelection	Grants permission to delete a resource assignment from a restore testing plan	restoreTestingPlan*	aws:ResourceTag/${TagKey}	Write
DeleteTieringConfiguration	Grants permission to delete a tiering configuration	tieringConfiguration*	aws:ResourceTag/${TagKey}	Write
DescribeBackupJob	Grants permission to describe a backup job			Read
DescribeBackupVault	Grants permission to describe a new backup vault with the specified name	backupVault*	aws:ResourceTag/${TagKey}	Read
DescribeCopyJob	Grants permission to describe a copy job			Read
DescribeFramework	Grants permission to describe a framework with the specified name	framework*	aws:ResourceTag/${TagKey}	Read
DescribeGlobalSettings	Grants permission to describe global settings			Read
DescribeProtectedResource	Grants permission to describe a protected resource			Read
DescribeRecoveryPoint	Grants permission to describe a recovery point	recoveryPoint*	aws:ResourceTag/${TagKey}	Read
DescribeRegionSettings	Grants permission to describe region settings			Read
DescribeReportJob	Grants permission to describe a report job			Read
DescribeReportPlan	Grants permission to describe a report plan with the specified name	reportPlan*	aws:ResourceTag/${TagKey}	Read
DescribeRestoreJob	Grants permission to describe a restore job			Read
DescribeScanJob	Grants permission to describe a scan job			Read
DisassociateBackupVaultMpaApprovalTeam	Grants permission to disassociate an MPA approval team from a backup vault	backupVault*	aws:ResourceTag/${TagKey}	Write
DisassociateRecoveryPoint	Grants permission to disassociate a recovery point from a backup vault	recoveryPoint*	aws:ResourceTag/${TagKey}	Write
DisassociateRecoveryPointFromParent	Grants permission to disassociate a recovery point from its parent	recoveryPoint*	aws:ResourceTag/${TagKey}	Write
ExportBackupPlanTemplate	Grants permission to export a backup plan as a JSON			Read
GetBackupPlan	Grants permission to get a backup plan	backupPlan*	aws:ResourceTag/${TagKey}	Read
GetBackupPlanFromJSON	Grants permission to transform a JSON to a backup plan			Read
GetBackupPlanFromTemplate	Grants permission to transform a template to a backup plan			Read
GetBackupSelection	Grants permission to get a backup plan resource assignment	backupPlan*	aws:ResourceTag/${TagKey}	Read
GetBackupVaultAccessPolicy	Grants permission to get backup vault access policy	backupVault*	aws:ResourceTag/${TagKey}	Read
GetBackupVaultNotifications	Grants permission to get backup vault notifications	backupVault*	aws:ResourceTag/${TagKey}	Read
GetLegalHold	Grants permission to get a legal hold	legalHold*	aws:ResourceTag/${TagKey}	Read
GetPITRMalwareScanResults	Grants permission to get point-in-time recovery (PITR) malware scan results	recoveryPoint*	aws:ResourceTag/${TagKey}	Read
GetRecoveryPointIndexDetails	Grants permission to get indexing details for a recovery point	recoveryPoint*	aws:ResourceTag/${TagKey}	Read
GetRecoveryPointRestoreMetadata	Grants permission to get recovery point restore metadata	recoveryPoint*	aws:ResourceTag/${TagKey}	Read
GetRestoreJobMetadata	Grants permission to get the restore metadata associated with a restore job			Read
GetRestoreTestingInferredMetadata	Grants permission to get inferred metadata generated by restore testing			Read
GetRestoreTestingPlan	Grants permission to get a restore testing plan	restoreTestingPlan*	aws:ResourceTag/${TagKey}	Read
GetRestoreTestingSelection	Grants permission to get a restore testing plan resource assignment	restoreTestingPlan*	aws:ResourceTag/${TagKey}	Read
GetSupportedResourceTypes	Grants permission to get supported resource types			Read
GetTieringConfiguration	Grants permission to describe a tiering configuration	tieringConfiguration*	aws:ResourceTag/${TagKey}	Read
ListBackupJobSummaries	Grants permission to list backup job summaries			List
ListBackupJobs	Grants permission to list backup jobs			List
ListBackupPlanTemplates	Grants permission to list backup plan templates provided by Amazon Backup			List
ListBackupPlanVersions	Grants permission to list backup plan versions	backupPlan*	aws:ResourceTag/${TagKey}	List
ListBackupPlans	Grants permission to list backup plans			List
ListBackupSelections	Grants permission to list resource assignments for a specific backup plan	backupPlan*	aws:ResourceTag/${TagKey}	List
ListBackupVaults	Grants permission to list backup vaults			List
ListCopyJobSummaries	Grants permission to list copy job summaries			List
ListCopyJobs	Grants permission to list copy jobs			List
ListFrameworks	Grants permission to list frameworks			List
ListIndexedRecoveryPoints	Grants permission to get list indexed recovery points			List
ListLegalHolds	Grants permission to list legal holds			List
ListProtectedResources	Grants permission to list protected resources by Amazon Backup			List
ListProtectedResourcesByBackupVault	Grants permission to list protected resources inside a backup vault	backupVault*	aws:ResourceTag/${TagKey}	List
ListRecoveryPointsByBackupVault	Grants permission to list recovery points inside a backup vault	backupVault*	aws:ResourceTag/${TagKey}	List
ListRecoveryPointsByLegalHold	Grants permission to list recovery points by legal hold	legalHold*	aws:ResourceTag/${TagKey}	List
ListRecoveryPointsByResource	Grants permission to list recovery points for a resource			List
ListReportJobs	Grants permission to list report jobs			List
ListReportPlans	Grants permission to list report plans			List
ListRestoreAccessBackupVaults	Grants permission to list a restore access backup vaults associated with a backup vault	backupVault*	aws:ResourceTag/${TagKey}	List
ListRestoreJobSummaries	Grants permission to list restore job summaries			List
ListRestoreJobs	Grants permission to list restore jobs			List
ListRestoreJobsByProtectedResource	Grants permission to list restore jobs for a protected resource			List
ListRestoreTestingPlans	Grants permission to list restore testing plans			List
ListRestoreTestingSelections	Grants permission to list resource assignments for a specific restore testing plan	restoreTestingPlan*	aws:ResourceTag/${TagKey}	List
ListScanJobSummaries	Grants permission to list scan job summaries			List
ListScanJobs	Grants permission to list scan jobs			List
ListTags	Grants permission to list tags for a resource	backupPlan	aws:ResourceTag/${TagKey}	Read
		backupVault	aws:ResourceTag/${TagKey}
		framework	aws:ResourceTag/${TagKey}
		legalHold	aws:ResourceTag/${TagKey}
		recoveryPoint	aws:ResourceTag/${TagKey}
		reportPlan	aws:ResourceTag/${TagKey}
		restoreTestingPlan	aws:ResourceTag/${TagKey}
		tieringConfiguration	aws:ResourceTag/${TagKey}
ListTieringConfigurations	Grants permission to list tiering configurations			List
PutBackupVaultAccessPolicy	Grants permission to add an access policy to the backup vault	backupVault*	aws:ResourceTag/${TagKey}	Permissions management, Write
PutBackupVaultLockConfiguration	Grants permission to add a lock configuration to the backup vault	backupVault*	aws:ResourceTag/${TagKey} backup:ChangeableForDays backup:MaxRetentionDays backup:MinRetentionDays	Write
PutBackupVaultNotifications	Grants permission to add an SNS topic to the backup vault	backupVault*	aws:ResourceTag/${TagKey}	Write
PutRestoreValidationResult	Grants permission to put a restore validation result			Write
RevokeRestoreAccessBackupVault	Grants permission to revoke a restore access backup vault	backupVault*	aws:ResourceTag/${TagKey}	Write
StartBackupJob	Grants permission to start a new backup job	backupVault*	aws:ResourceTag/${TagKey}	Write
StartCopyJob	Grants permission to copy a backup from a source backup vault to a destination backup vault	recoveryPoint*	aws:ResourceTag/${TagKey}	Write
StartReportJob	Grants permission to start a new report job	reportPlan*	aws:ResourceTag/${TagKey}	Write
StartRestoreJob	Grants permission to start a new restore job	recoveryPoint*	aws:ResourceTag/${TagKey}	Write
StartScanJob	Grants permission to start a new scan job	recoveryPoint*	aws:ResourceTag/${TagKey}	Write
StopBackupJob	Grants permission to stop a backup job			Write
TagResource	Grants permission to tag a resource	backupPlan	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		backupVault	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		framework	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		legalHold	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		recoveryPoint	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		reportPlan	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		restoreTestingPlan	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		tieringConfiguration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag a resource	backupPlan	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		backupVault	aws:ResourceTag/${TagKey} aws:TagKeys
		framework	aws:ResourceTag/${TagKey} aws:TagKeys
		legalHold	aws:ResourceTag/${TagKey} aws:TagKeys
		recoveryPoint	aws:ResourceTag/${TagKey} aws:TagKeys
		reportPlan	aws:ResourceTag/${TagKey} aws:TagKeys
		restoreTestingPlan	aws:ResourceTag/${TagKey} aws:TagKeys
		tieringConfiguration	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateBackupPlan	Grants permission to update a backup plan	backupPlan*	aws:ResourceTag/${TagKey}	Write
UpdateFramework	Grants permission to update a framework	framework*	aws:ResourceTag/${TagKey}	Write
UpdateGlobalSettings	Grants permission to update the current global settings for the Amazon Account			Write
UpdateRecoveryPointIndexSettings	Grants permission to update recovery point index settings	recoveryPoint*	aws:ResourceTag/${TagKey} backup:Index	Write
UpdateRecoveryPointLifecycle	Grants permission to update the lifecycle of the recovery point	recoveryPoint*	aws:ResourceTag/${TagKey}	Write
UpdateRegionSettings	Grants permission to update the current service opt-in settings for the Region			Write
UpdateReportPlan	Grants permission to update a report plan	reportPlan*	aws:ResourceTag/${TagKey} backup:FrameworkArns	Write
UpdateRestoreTestingPlan	Grants permission to update a restore testing plan	restoreTestingPlan*	aws:ResourceTag/${TagKey}	Write
UpdateRestoreTestingSelection	Grants permission to update a resource assignment in a restore testing plan	restoreTestingPlan*	aws:ResourceTag/${TagKey}	Write
UpdateTieringConfiguration	Grants permission to update a tiering configuration	tieringConfiguration*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon Backup

The following actions are defined by Amazon Backup but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CopyFromBackupVault	Grants permission to copy from a backup vault	recoveryPoint*	aws:ResourceTag/${TagKey} backup:CopyTargetOrgPaths backup:CopyTargets	Write
CopyIntoBackupVault	Grants permission to copy into a backup vault	backupVault*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey}	Write
CreateBackupAccessPoint	Grants permission to create a new access point for backup instant access	recoveryPoint*	aws:ResourceTag/${TagKey}	Write
DeleteBackupAccessPoint	Grants permission to delete the access point			Write
DeleteBackupVaultSharingPolicy	Grants permission to delete backup vault sharing policy	backupVault*	aws:ResourceTag/${TagKey}	Permissions management, Write
DescribeBackupAccessPoint	Grants permission to return information about the specified access point			Read
GetBackupVaultSharingPolicy	Grants permission to get backup vault sharing policy	backupVault*	aws:ResourceTag/${TagKey}	Read
ListIndexedRecoveryPointsForSearch	Grants permission to list indexed recovery points to search			Permissions management, Write
PutBackupVaultSharingPolicy	Grants permission to add a sharing policy to the backup vault	backupVault*	aws:ResourceTag/${TagKey}	Permissions management, Write
SearchRecoveryPoint	Grants permission to search a recovery point	recoveryPoint*	aws:ResourceTag/${TagKey}	Permissions management, Write

Resource types defined by Amazon Backup

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
backupPlan	arn:${Partition}:backup:${Region}:${Account}:backup-plan:${BackupPlanId}	aws:ResourceTag/${TagKey}
backupVault	arn:${Partition}:backup:${Region}:${Account}:backup-vault:${BackupVaultName}	aws:ResourceTag/${TagKey}
framework	arn:${Partition}:backup:${Region}:${Account}:framework:${FrameworkName}-${FrameworkId}	aws:ResourceTag/${TagKey}
legalHold	arn:${Partition}:backup:${Region}:${Account}:legal-hold:${LegalHoldId}	aws:ResourceTag/${TagKey}
recoveryPoint	arn:${Partition}:${Vendor}:${Region}:*:${ResourceType}:${RecoveryPointId}	aws:ResourceTag/${TagKey}
reportPlan	arn:${Partition}:backup:${Region}:${Account}:report-plan:${ReportPlanName}-${ReportPlanId}	aws:ResourceTag/${TagKey}
restoreTestingPlan	arn:${Partition}:backup:${Region}:${Account}:restore-testing-plan:${RestoreTestingPlanName}-${RestoreTestingPlanId}	aws:ResourceTag/${TagKey}
tieringConfiguration	arn:${Partition}:backup:${Region}:${Account}:tiering-configuration:${TieringConfigurationName}-${TieringConfigurationId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Backup

Amazon Backup defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the allowed set of values for each of the tags	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the presence of mandatory tags in the request	ArrayOfString
backup:ChangeableForDays	Filters access by the value of the ChangeableForDays parameter	Numeric
backup:CopyTargetOrgPaths	Filters access by the organization unit	ArrayOfString
backup:CopyTargets	Filters access by the ARN of a backup vault	ArrayOfARN
backup:FrameworkArns	Filters access by the Framework ARNs	ArrayOfARN
backup:Index	Filters access by the value of Index parameter	String
backup:MaxRetentionDays	Filters access by the value of the MaxRetentionDays parameter	Numeric
backup:MinRetentionDays	Filters access by the value of the MinRetentionDays parameter	Numeric
backup:MpaApprovalTeamArn	Filters access by the MPA Approval Team ARN of a backup vault	ARN

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon AppSync (appsync)

Amazon Backup Gateway (backup-gateway)