As traduções são geradas por tradução automática. Em caso de conflito entre o conteúdo da tradução e da versão original em inglês, a versão em inglês prevalecerá.
# AWSBackupServiceRolePolicyForBackup
**Descrição**: fornece permissão AWS de Backup para criar backups em seu nome em todos AWS os serviços
`AWSBackupServiceRolePolicyForBackup` é uma [política gerenciada pelo AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies).
## Utilização desta política
Você pode vincular a `AWSBackupServiceRolePolicyForBackup` aos seus usuários, grupos e perfis.
## Detalhes desta política
+ **Tipo**: Política de função de serviço
+ **Hora da criação**: 10 de janeiro de 2019, 21:01 UTC
+ **Horário editado:** 23 de fevereiro de 2026, 19:42 UTC
+ **ARN**: `arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup`
## Versão da política
**Versão da política:** v30 (padrão)
A versão padrão da política é aquela que define as permissões desta política. Quando um usuário ou função da política faz uma solicitação para acessar um AWS recurso, AWS verifica a versão padrão da política para determinar se a solicitação deve ser permitida.
## Documento da política JSON
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "DynamoDBPermissions",
"Effect" : "Allow",
"Action" : [
"dynamodb:DescribeTable",
"dynamodb:CreateBackup"
],
"Resource" : "arn:aws:dynamodb:*:*:table/*"
},
{
"Sid" : "DynamoDBBackupResourcePermissions",
"Effect" : "Allow",
"Action" : [
"dynamodb:DescribeBackup",
"dynamodb:DeleteBackup"
],
"Resource" : "arn:aws:dynamodb:*:*:table/*/backup/*"
},
{
"Sid" : "DynamoDBBackupPermissions",
"Effect" : "Allow",
"Action" : [
"rds:AddTagsToResource",
"rds:ListTagsForResource",
"rds:DescribeDBSnapshots",
"rds:CreateDBSnapshot",
"rds:CopyDBSnapshot",
"rds:DescribeDBInstances",
"rds:CreateDBClusterSnapshot",
"rds:DescribeDBClusters",
"rds:DescribeDBClusterSnapshots",
"rds:CopyDBClusterSnapshot",
"rds:DescribeDBClusterAutomatedBackups"
],
"Resource" : "*"
},
{
"Sid" : "RDSInstanceAutomatedBackupPermissions",
"Effect" : "Allow",
"Action" : "rds:DeleteDBInstanceAutomatedBackup",
"Resource" : "arn:aws:rds:*:*:auto-backup:*"
},
{
"Sid" : "RDSClusterPermissions",
"Effect" : "Allow",
"Action" : [
"rds:ModifyDBCluster"
],
"Resource" : [
"arn:aws:rds:*:*:cluster:*"
]
},
{
"Sid" : "RDSClusterBackupPermissions",
"Effect" : "Allow",
"Action" : "rds:DeleteDBClusterAutomatedBackup",
"Resource" : "arn:aws:rds:*:*:cluster-auto-backup:*"
},
{
"Sid" : "RDSModifyPermissions",
"Effect" : "Allow",
"Action" : [
"rds:ModifyDBInstance"
],
"Resource" : [
"arn:aws:rds:*:*:db:*"
]
},
{
"Sid" : "RDSBackupPermissions",
"Effect" : "Allow",
"Action" : [
"rds:DeleteDBSnapshot",
"rds:ModifyDBSnapshotAttribute"
],
"Resource" : [
"arn:aws:rds:*:*:snapshot:awsbackup:*"
]
},
{
"Sid" : "RDSClusterModifyPermissions",
"Effect" : "Allow",
"Action" : [
"rds:DeleteDBClusterSnapshot",
"rds:ModifyDBClusterSnapshotAttribute"
],
"Resource" : [
"arn:aws:rds:*:*:cluster-snapshot:awsbackup:*"
]
},
{
"Sid" : "StorageGatewayPermissions",
"Effect" : "Allow",
"Action" : [
"storagegateway:CreateSnapshot",
"storagegateway:ListTagsForResource"
],
"Resource" : "arn:aws:storagegateway:*:*:gateway/*/volume/*"
},
{
"Sid" : "EBSCopyPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:CopySnapshot"
],
"Resource" : "arn:aws:ec2:*::snapshot/*"
},
{
"Sid" : "EC2CopyPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:CopyImage"
],
"Resource" : "*"
},
{
"Sid" : "EBSTagAndDeletePermissions",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags",
"ec2:DeleteSnapshot"
],
"Resource" : "arn:aws:ec2:*::snapshot/*"
},
{
"Sid" : "EC2Permissions",
"Effect" : "Allow",
"Action" : [
"ec2:CreateImage",
"ec2:DeregisterImage",
"ec2:DescribeSnapshots",
"ec2:DescribeTags",
"ec2:DescribeImages",
"ec2:DescribeInstances",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstanceCreditSpecifications",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeElasticGpus",
"ec2:DescribeSpotInstanceRequests",
"ec2:DescribeSnapshotTierStatus"
],
"Resource" : "*"
},
{
"Sid" : "EC2TagPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags"
],
"Resource" : "arn:aws:ec2:*:*:image/*"
},
{
"Sid" : "EC2ModifyPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:ModifySnapshotAttribute",
"ec2:ModifyImageAttribute"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"aws:ResourceTag/aws:backup:source-resource" : "false"
}
}
},
{
"Sid" : "EBSSnapshotTierPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:ModifySnapshotTier"
],
"Resource" : "arn:aws:ec2:*::snapshot/*",
"Condition" : {
"Null" : {
"aws:ResourceTag/aws:backup:source-resource" : "false"
}
}
},
{
"Sid" : "BackupVaultPermissions",
"Effect" : "Allow",
"Action" : [
"backup:DescribeBackupVault",
"backup:CopyIntoBackupVault"
],
"Resource" : "arn:aws:backup:*:*:backup-vault:*"
},
{
"Sid" : "BackupVaultCopyPermissions",
"Effect" : "Allow",
"Action" : [
"backup:CopyFromBackupVault"
],
"Resource" : "*"
},
{
"Sid" : "EFSPermissions",
"Effect" : "Allow",
"Action" : [
"elasticfilesystem:Backup",
"elasticfilesystem:DescribeTags"
],
"Resource" : "arn:aws:elasticfilesystem:*:*:file-system/*"
},
{
"Sid" : "EBSResourcePermissions",
"Effect" : "Allow",
"Action" : [
"ec2:CreateSnapshot",
"ec2:DeleteSnapshot",
"ec2:DescribeVolumes",
"ec2:DescribeSnapshots"
],
"Resource" : "*"
},
{
"Sid" : "KMSDynamoDBPermissions",
"Effect" : "Allow",
"Action" : [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource" : "*",
"Condition" : {
"StringLike" : {
"kms:ViaService" : [
"dynamodb.*.amazonaws.com"
]
}
}
},
{
"Sid" : "KMSPermissions",
"Effect" : "Allow",
"Action" : "kms:DescribeKey",
"Resource" : "*"
},
{
"Sid" : "KMSCreateGrantPermissions",
"Effect" : "Allow",
"Action" : "kms:CreateGrant",
"Resource" : "*",
"Condition" : {
"Bool" : {
"kms:GrantIsForAWSResource" : "true"
}
}
},
{
"Sid" : "KMSEC2Permissions",
"Effect" : "Allow",
"Action" : [
"kms:GenerateDataKeyWithoutPlaintext",
"kms:ReEncryptTo",
"kms:ReEncryptFrom"
],
"Resource" : "arn:aws:kms:*:*:key/*",
"Condition" : {
"StringLike" : {
"kms:ViaService" : [
"ec2.*.amazonaws.com"
]
},
"ForAnyValue:StringEquals" : {
"kms:EncryptionContextKeys" : "aws:ebs:id"
}
}
},
{
"Sid" : "GetResourcesPermissions",
"Effect" : "Allow",
"Action" : [
"tag:GetResources"
],
"Resource" : "*"
},
{
"Sid" : "SSMPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:CancelCommand",
"ssm:GetCommandInvocation"
],
"Resource" : "*"
},
{
"Sid" : "SSMSendPermissions",
"Effect" : "Allow",
"Action" : "ssm:SendCommand",
"Resource" : [
"arn:aws:ssm:*:*:document/AWSEC2-CreateVssSnapshot",
"arn:aws:ec2:*:*:instance/*"
]
},
{
"Sid" : "FsxBackupPermissions",
"Effect" : "Allow",
"Action" : "fsx:DescribeBackups",
"Resource" : "arn:aws:fsx:*:*:backup/*"
},
{
"Sid" : "FsxCreateBackupPermissions",
"Effect" : "Allow",
"Action" : "fsx:CreateBackup",
"Resource" : [
"arn:aws:fsx:*:*:file-system/*",
"arn:aws:fsx:*:*:backup/*",
"arn:aws:fsx:*:*:volume/*"
]
},
{
"Sid" : "FsxPermissions",
"Effect" : "Allow",
"Action" : "fsx:DescribeFileSystems",
"Resource" : "arn:aws:fsx:*:*:file-system/*"
},
{
"Sid" : "FsxVolumePermissions",
"Effect" : "Allow",
"Action" : "fsx:DescribeVolumes",
"Resource" : "arn:aws:fsx:*:*:volume/*"
},
{
"Sid" : "FsxListTagsPermissions",
"Effect" : "Allow",
"Action" : "fsx:ListTagsForResource",
"Resource" : [
"arn:aws:fsx:*:*:file-system/*",
"arn:aws:fsx:*:*:volume/*"
]
},
{
"Sid" : "FsxDeletePermissions",
"Effect" : "Allow",
"Action" : "fsx:DeleteBackup",
"Resource" : "arn:aws:fsx:*:*:backup/*"
},
{
"Sid" : "FsxResourcePermissions",
"Effect" : "Allow",
"Action" : [
"fsx:ListTagsForResource",
"fsx:ManageBackupPrincipalAssociations",
"fsx:CopyBackup",
"fsx:TagResource"
],
"Resource" : "arn:aws:fsx:*:*:backup/*"
},
{
"Sid" : "DynamodbBackupPermissions",
"Effect" : "Allow",
"Action" : [
"dynamodb:StartAwsBackupJob",
"dynamodb:ListTagsOfResource"
],
"Resource" : "arn:aws:dynamodb:*:*:table/*"
},
{
"Sid" : "BackupGatewayBackupPermissions",
"Effect" : "Allow",
"Action" : [
"backup-gateway:Backup",
"backup-gateway:ListTagsForResource"
],
"Resource" : "arn:aws:backup-gateway:*:*:vm/*"
},
{
"Sid" : "CloudformationStackPermissions",
"Effect" : "Allow",
"Action" : [
"cloudformation:ListStacks",
"cloudformation:GetTemplate",
"cloudformation:DescribeStacks",
"cloudformation:ListStackResources"
],
"Resource" : "arn:aws:cloudformation:*:*:stack/*/*"
},
{
"Sid" : "RedshiftCreatePermissions",
"Effect" : "Allow",
"Action" : [
"redshift:CreateClusterSnapshot",
"redshift:DescribeClusterSnapshots",
"redshift:DescribeTags"
],
"Resource" : [
"arn:aws:redshift:*:*:snapshot:*/*",
"arn:aws:redshift:*:*:cluster:*"
]
},
{
"Sid" : "RedshiftSnapshotPermissions",
"Effect" : "Allow",
"Action" : [
"redshift:DeleteClusterSnapshot"
],
"Resource" : [
"arn:aws:redshift:*:*:snapshot:*/*"
]
},
{
"Sid" : "RedshiftPermissions",
"Effect" : "Allow",
"Action" : [
"redshift:DescribeClusters"
],
"Resource" : [
"arn:aws:redshift:*:*:cluster:*"
]
},
{
"Sid" : "RedshiftResourcePermissions",
"Effect" : "Allow",
"Action" : [
"redshift:CreateTags"
],
"Resource" : [
"arn:aws:redshift:*:*:snapshot:*/*"
]
},
{
"Sid" : "RedshiftServerlessCreatePermissions",
"Effect" : "Allow",
"Action" : [
"redshift-serverless:CreateSnapshot"
],
"Resource" : [
"arn:aws:redshift-serverless:*:*:snapshot/*",
"arn:aws:redshift-serverless:*:*:namespace/*"
]
},
{
"Sid" : "RedshiftServerlessSnapshotPermissions",
"Effect" : "Allow",
"Action" : [
"redshift-serverless:DeleteSnapshot"
],
"Resource" : [
"arn:aws:redshift-serverless:*:*:snapshot/*"
],
"Condition" : {
"Null" : {
"aws:ResourceTag/aws:backup:source-resource" : "false"
}
}
},
{
"Sid" : "RedshiftServerlessGetPermissions",
"Effect" : "Allow",
"Action" : [
"redshift-serverless:GetNamespace"
],
"Resource" : [
"arn:aws:redshift-serverless:*:*:namespace/*"
]
},
{
"Sid" : "RedshiftServerlessResourcePermissions",
"Effect" : "Allow",
"Action" : [
"redshift-serverless:GetSnapshot",
"redshift-serverless:TagResource"
],
"Resource" : [
"arn:aws:redshift-serverless:*:*:snapshot/*"
]
},
{
"Sid" : "RedshiftServerlessListPermissions",
"Effect" : "Allow",
"Action" : [
"redshift-serverless:ListNamespaces",
"redshift-serverless:ListSnapshots",
"redshift-serverless:ListTagsForResource"
],
"Resource" : [
"*"
]
},
{
"Sid" : "TimestreamResourcePermissions",
"Effect" : "Allow",
"Action" : [
"timestream:StartAwsBackupJob",
"timestream:GetAwsBackupStatus",
"timestream:ListTables",
"timestream:ListDatabases",
"timestream:ListTagsForResource",
"timestream:DescribeTable",
"timestream:DescribeDatabase"
],
"Resource" : [
"arn:aws:timestream:*:*:database/*"
]
},
{
"Sid" : "TimestreamEndpointPermissions",
"Effect" : "Allow",
"Action" : [
"timestream:DescribeEndpoints"
],
"Resource" : "*"
},
{
"Sid" : "SSMSAPPermissions",
"Effect" : "Allow",
"Action" : [
"ssm-sap:GetOperation",
"ssm-sap:ListDatabases"
],
"Resource" : "*"
},
{
"Sid" : "SSMSAPResourcePermissions",
"Effect" : "Allow",
"Action" : [
"ssm-sap:BackupDatabase",
"ssm-sap:UpdateHanaBackupSettings",
"ssm-sap:GetDatabase",
"ssm-sap:ListTagsForResource"
],
"Resource" : "arn:aws:ssm-sap:*:*:*"
},
{
"Sid" : "RecoveryPointTaggingPermissions",
"Effect" : "Allow",
"Action" : [
"backup:TagResource"
],
"Resource" : "arn:aws:backup:*:*:recovery-point:*",
"Condition" : {
"StringEquals" : {
"aws:PrincipalAccount" : "${aws:ResourceAccount}"
}
}
},
{
"Sid" : "DSQLResourcePermissionsForBackup",
"Effect" : "Allow",
"Action" : [
"dsql:StartBackupJob",
"dsql:GetBackupJob",
"dsql:StopBackupJob",
"dsql:GetCluster",
"dsql:ListClusters",
"dsql:ListTagsForResource"
],
"Resource" : [
"*"
]
},
{
"Sid" : "KMSDSQLPermissions",
"Effect" : "Allow",
"Action" : [
"kms:Decrypt"
],
"Resource" : "*",
"Condition" : {
"StringLike" : {
"kms:ViaService" : [
"dsql.*.amazonaws.com"
]
},
"ForAnyValue:StringEquals" : {
"kms:EncryptionContextKeys" : "aws:dsql:ClusterId"
}
}
},
{
"Sid" : "EKSClusterConfigurationBackup",
"Effect" : "Allow",
"Action" : [
"eks:ListClusters",
"eks:ListTagsForResource",
"eks:DescribeCluster",
"eks:ListAddons",
"eks:DescribeAddon",
"eks:ListNodegroups",
"eks:DescribeNodegroup",
"eks:ListPodIdentityAssociations",
"eks:DescribePodIdentityAssociation",
"eks:ListAccessEntries",
"eks:DescribeAccessEntry",
"eks:ListAssociatedAccessPolicies",
"eks:ListFargateProfiles",
"eks:DescribeFargateProfile",
"ec2:DescribeLaunchTemplateVersions"
],
"Resource" : "*"
},
{
"Sid" : "CreateBackupAccessEntry",
"Effect" : "Allow",
"Action" : [
"eks:CreateAccessEntry"
],
"Resource" : "arn:aws:eks:*:*:cluster/*"
},
{
"Sid" : "AssociateBackupAccessPolicy",
"Effect" : "Allow",
"Action" : [
"eks:AssociateAccessPolicy",
"eks:DisassociateAccessPolicy"
],
"Resource" : "arn:aws:eks:*:*:access-entry/*",
"Condition" : {
"StringEquals" : {
"eks:policyArn" : "arn:aws:eks::aws:cluster-access-policy/AWSBackupFullAccessPolicyForBackup",
"eks:accessScope" : "cluster"
}
}
},
{
"Sid" : "GuardDutyMalwareScanPermissions",
"Effect" : "Allow",
"Action" : [
"guardduty:StartMalwareScan",
"guardduty:GetMalwareScan"
],
"Resource" : "*"
},
{
"Sid" : "GuardDutyMalwareScanIAMPassPermissions",
"Effect" : "Allow",
"Action" : "iam:PassRole",
"Resource" : "arn:aws:iam::*:role/*",
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : "malware-protection.guardduty.amazonaws.com"
}
}
}
]
}
```
## Saiba mais
+ [Crie um conjunto de permissões usando políticas AWS gerenciadas no IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html)
+ [Adicionar e remover permissões de identidade IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html)
+ [Compreenda o controle de versionamento das políticas do IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [Comece com políticas AWS gerenciadas e adote permissões com privilégios mínimos](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)