AWSBackupServiceRolePolicyForS3Backup.json

{
  "Arn": "arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForS3Backup",
  "CreateDate": "2022-02-18T17:40:24Z",
  "DefaultVersionId": "v4",
  "IsAttachable": true,
  "Path": "/",
  "PolicyId": "ANPAZKAPJZG4CGZAHUZ2D",
  "PolicyName": "AWSBackupServiceRolePolicyForS3Backup",
  "PolicyVersion": {
    "CreateDate": "2024-05-17T17:12:03Z",
    "Document": {
      "Statement": [
        {
          "Action": [
            "backup:TagResource"
          ],
          "Condition": {
            "StringEquals": {
              "aws:PrincipalAccount": "${aws:ResourceAccount}"
            }
          },
          "Effect": "Allow",
          "Resource": "arn:aws:backup:*:*:recovery-point:*",
          "Sid": "RecoveryPointTaggingPermissions"
        },
        {
          "Action": [
            "kms:Decrypt",
            "kms:DescribeKey"
          ],
          "Condition": {
            "StringLike": {
              "kms:ViaService": "s3.*.amazonaws.com"
            }
          },
          "Effect": "Allow",
          "Resource": "*",
          "Sid": "KmsPermissions"
        },
        {
          "Action": "cloudwatch:GetMetricData",
          "Effect": "Allow",
          "Resource": "*",
          "Sid": "CloudWatchGetMetricDataPermissions"
        },
        {
          "Action": "events:ListRules",
          "Effect": "Allow",
          "Resource": "*",
          "Sid": "EventBridgeListRulesPermissions"
        },
        {
          "Action": "s3:ListAllMyBuckets",
          "Effect": "Allow",
          "Resource": "*",
          "Sid": "S3ListBucketPermissions"
        },
        {
          "Action": [
            "events:DeleteRule",
            "events:DescribeRule",
            "events:DisableRule",
            "events:EnableRule",
            "events:ListTargetsByRule",
            "events:PutRule",
            "events:PutTargets",
            "events:RemoveTargets"
          ],
          "Effect": "Allow",
          "Resource": [
            "arn:aws:events:*:*:rule/AwsBackupManagedRule*"
          ],
          "Sid": "EventBridgePermissionsForAwsBackupManagedRule"
        },
        {
          "Action": [
            "s3:GetBucketAcl",
            "s3:GetBucketLocation",
            "s3:GetBucketNotification",
            "s3:GetBucketTagging",
            "s3:GetBucketVersioning",
            "s3:GetInventoryConfiguration",
            "s3:ListBucket",
            "s3:ListBucketVersions",
            "s3:PutBucketNotification",
            "s3:PutInventoryConfiguration"
          ],
          "Effect": "Allow",
          "Resource": "arn:aws:s3:::*",
          "Sid": "S3BucketPermissions"
        },
        {
          "Action": [
            "s3:GetObject",
            "s3:GetObjectAcl",
            "s3:GetObjectTagging",
            "s3:GetObjectVersion",
            "s3:GetObjectVersionAcl",
            "s3:GetObjectVersionTagging"
          ],
          "Effect": "Allow",
          "Resource": "arn:aws:s3:::*/*",
          "Sid": "S3ObjectPermissions"
        }
      ],
      "Version": "2012-10-17"
    },
    "IsDefaultVersion": true,
    "VersionId": "v4"
  },
  "UpdateDate": "2024-05-17T17:12:03Z"
}