The aws-backup mod contains resource, control and policy definitions for AWS Backup service.
Resource Types
Resource types covered by this mod:
- AWS > Backup
- AWS > Backup > Backup Plan
- AWS > Backup > Backup Selection
- AWS > Backup > Backup Vault
- AWS > Backup > Protected Resource
- AWS > Backup > Recovery Point
- AWS > Backup > Region Settings
Permissions
Taking a look at permissions and associated grant levels for each permission for Backup:
Permission | Grant Level | Help |
---|---|---|
backup-storage:MountCapsule | Admin | This permission is required to create a Backup Vault. |
backup:CreateBackupPlan | Admin | |
backup:CreateBackupSelection | Admin | |
backup:CreateBackupSelection | Admin | |
backup:CreateBackupVault | Admin | |
backup:DeleteBackupPlan | Admin | |
backup:DeleteBackupSelection | Admin | |
backup:DeleteBackupSelection | Admin | |
backup:DeleteBackupVault | Admin | |
backup:DeleteBackupVaultAccessPolicy | Admin | |
backup:DeleteBackupVaultNotifications | Admin | |
backup:DeleteRecoveryPoint | Admin | |
backup:DescribeBackupJob | Metadata | |
backup:DescribeBackupVault | Metadata | |
backup:DescribeProtectedResource | Metadata | |
backup:DescribeRecoveryPoint | Metadata | |
backup:DescribeRestoreJob | Metadata | |
backup:ExportBackupPlanTemplate | Metadata | |
backup:GetBackupPlan | Metadata | |
backup:GetBackupPlanFromJSON | Metadata | |
backup:GetBackupPlanFromTemplate | Metadata | |
backup:GetBackupSelection | Metadata | |
backup:GetBackupVaultAccessPolicy | Metadata | |
backup:GetBackupVaultNotifications | Metadata | |
backup:GetRecoveryPointRestoreMetadata | Metadata | |
backup:GetSupportedResourceTypes | Metadata | |
backup:ListBackupJobs | Metadata | |
backup:ListBackupPlanTemplates | Metadata | |
backup:ListBackupPlanVersions | Metadata | |
backup:ListBackupPlans | Metadata | |
backup:ListBackupSelections | Metadata | |
backup:ListBackupVaults | Metadata | |
backup:ListProtectedResources | Metadata | |
backup:ListRecoveryPointsByBackupVault | Metadata | |
backup:ListRecoveryPointsByResource | Metadata | |
backup:ListRestoreJobs | Metadata | |
backup:ListTags | Metadata | |
backup:PutBackupVaultAccessPolicy | Admin | |
backup:PutBackupVaultNotifications | Operator | |
backup:StartBackupJob | Operator | |
backup:StartRestoreJob | Operator | |
backup:StopBackupJob | Operator | |
backup:TagResource | Operator | |
backup:UntagResource | Operator | |
backup:UpdateBackupPlan | Admin | |
backup:UpdateRecoveryPointLifecycle | Admin | |
backup:UpdateRegionSettings | Admin | |
health:DescribeEventAggregates | Metadata | |
kms:DescribeKey | Metadata | |
kms:ListAliases | Metadata | |
kms:ListKeys | Metadata |
Learn More About Turbot
- Setting Policies Tutorial
- Mods Overview
- Policies Overview
- Resources Overview
- Common Policies and Controls
Recommended Version
Version
5.9.0
Released On
May 31, 2023
Depends On
Resource Types
- AWS > Backup
- AWS > Backup > Backup Plan
- AWS > Backup > Backup Selection
- AWS > Backup > Backup Vault
- AWS > Backup > Protected Resource
- AWS > Backup > Recovery Point
- AWS > Backup > Region Settings
Control Types
- AWS > Backup > Backup Plan > Active
- AWS > Backup > Backup Plan > Approved
- AWS > Backup > Backup Plan > CMDB
- AWS > Backup > Backup Plan > Configured
- AWS > Backup > Backup Plan > Discovery
- AWS > Backup > Backup Plan > Tags
- AWS > Backup > Backup Plan > Usage
- AWS > Backup > Backup Selection > Active
- AWS > Backup > Backup Selection > Approved
- AWS > Backup > Backup Selection > CMDB
- AWS > Backup > Backup Selection > Discovery
- AWS > Backup > Backup Vault > Active
- AWS > Backup > Backup Vault > Approved
- AWS > Backup > Backup Vault > CMDB
- AWS > Backup > Backup Vault > Configured
- AWS > Backup > Backup Vault > Discovery
- AWS > Backup > Backup Vault > Tags
- AWS > Backup > Backup Vault > Usage
- AWS > Backup > Protected Resource > CMDB
- AWS > Backup > Protected Resource > Discovery
- AWS > Backup > Recovery Point > Active
- AWS > Backup > Recovery Point > Approved
- AWS > Backup > Recovery Point > CMDB
- AWS > Backup > Recovery Point > Discovery
- AWS > Backup > Recovery Point > Tags
- AWS > Backup > Region Settings > CMDB
- AWS > Backup > Region Settings > Discovery
- AWS > Backup > Region Settings > Service Opt-In
- AWS > Backup > Stack
Policy Types
- AWS > Backup > API Enabled
- AWS > Backup > Approved Regions [Default]
- AWS > Backup > Backup Plan > Active
- AWS > Backup > Backup Plan > Active > Age
- AWS > Backup > Backup Plan > Active > Last Modified
- AWS > Backup > Backup Plan > Approved
- AWS > Backup > Backup Plan > Approved > Custom
- AWS > Backup > Backup Plan > Approved > Regions
- AWS > Backup > Backup Plan > Approved > Usage
- AWS > Backup > Backup Plan > CMDB
- AWS > Backup > Backup Plan > Configured
- AWS > Backup > Backup Plan > Configured > Claim Precedence
- AWS > Backup > Backup Plan > Configured > Source
- AWS > Backup > Backup Plan > Regions
- AWS > Backup > Backup Plan > Tags
- AWS > Backup > Backup Plan > Tags > Template
- AWS > Backup > Backup Plan > Usage
- AWS > Backup > Backup Plan > Usage > Limit
- AWS > Backup > Backup Selection > Active
- AWS > Backup > Backup Selection > Active > Age
- AWS > Backup > Backup Selection > Active > Last Modified
- AWS > Backup > Backup Selection > Approved
- AWS > Backup > Backup Selection > Approved > Custom
- AWS > Backup > Backup Selection > Approved > Regions
- AWS > Backup > Backup Selection > Approved > Usage
- AWS > Backup > Backup Selection > CMDB
- AWS > Backup > Backup Selection > Regions
- AWS > Backup > Backup Vault > Active
- AWS > Backup > Backup Vault > Active > Age
- AWS > Backup > Backup Vault > Active > Budget
- AWS > Backup > Backup Vault > Active > Last Modified
- AWS > Backup > Backup Vault > Approved
- AWS > Backup > Backup Vault > Approved > Budget
- AWS > Backup > Backup Vault > Approved > Custom
- AWS > Backup > Backup Vault > Approved > Encryption at Rest
- AWS > Backup > Backup Vault > Approved > Encryption at Rest > Customer Managed Key
- AWS > Backup > Backup Vault > Approved > Regions
- AWS > Backup > Backup Vault > Approved > Usage
- AWS > Backup > Backup Vault > CMDB
- AWS > Backup > Backup Vault > Configured
- AWS > Backup > Backup Vault > Configured > Claim Precedence
- AWS > Backup > Backup Vault > Configured > Source
- AWS > Backup > Backup Vault > Regions
- AWS > Backup > Backup Vault > Tags
- AWS > Backup > Backup Vault > Tags > Template
- AWS > Backup > Backup Vault > Usage
- AWS > Backup > Backup Vault > Usage > Limit
- AWS > Backup > Enabled
- AWS > Backup > Permissions
- AWS > Backup > Permissions > Levels
- AWS > Backup > Permissions > Levels > Modifiers
- AWS > Backup > Permissions > Lockdown
- AWS > Backup > Permissions > Lockdown > API Boundary
- AWS > Backup > Protected Resource > CMDB
- AWS > Backup > Protected Resource > Regions
- AWS > Backup > Recovery Point > Active
- AWS > Backup > Recovery Point > Active > Age
- AWS > Backup > Recovery Point > Active > Budget
- AWS > Backup > Recovery Point > Active > Last Modified
- AWS > Backup > Recovery Point > Approved
- AWS > Backup > Recovery Point > Approved > Budget
- AWS > Backup > Recovery Point > Approved > Custom
- AWS > Backup > Recovery Point > Approved > Regions
- AWS > Backup > Recovery Point > Approved > Usage
- AWS > Backup > Recovery Point > CMDB
- AWS > Backup > Recovery Point > Regions
- AWS > Backup > Recovery Point > Tags
- AWS > Backup > Recovery Point > Tags > Template
- AWS > Backup > Region Settings > CMDB
- AWS > Backup > Region Settings > Regions
- AWS > Backup > Region Settings > Service Opt-In
- AWS > Backup > Region Settings > Service Opt-In > Resources
- AWS > Backup > Regions
- AWS > Backup > Stack
- AWS > Backup > Stack > Secret Variables
- AWS > Backup > Stack > Source
- AWS > Backup > Stack > Terraform Version
- AWS > Backup > Stack > Variables
- AWS > Backup > Tags Template [Default]
- AWS > Turbot > Event Handlers > Events > Rules > Event Sources > @turbot/aws-backup
- AWS > Turbot > Permissions > Compiled > API Boundary > @turbot/aws-backup
- AWS > Turbot > Permissions > Compiled > Levels > @turbot/aws-backup
- AWS > Turbot > Permissions > Compiled > Service Permissions > @turbot/aws-backup
Release Notes
5.9.0 (2023-05-31)
What's new?
- Resource's metadata will now also include
createdBy
details in Turbot CMDB.
5.8.1 (2022-12-14)
Bug fixes
- The
AWS > Backup > Recovery Point > CMDB
control would sometimes go into an error state for recovery points that don't support tagging operations. This is fixed and the control will now work as expected.
Action Types
Added
- AWS > Backup > Backup Plan > Skip alarm for approved control
- AWS > Backup > Backup Plan > Skip alarm for approved control [90 days]
- AWS > Backup > Backup Selection > Skip alarm for approved control
- AWS > Backup > Backup Selection > Skip alarm for approved control [90 days]
- AWS > Backup > Backup Vault > Skip alarm for approved control
- AWS > Backup > Backup Vault > Skip alarm for approved control [90 days]
- AWS > Backup > Recovery Point > Skip alarm for approved control
- AWS > Backup > Recovery Point > Skip alarm for approved control [90 days]
5.8.0 (2022-05-11)
Resource Types
Added
- AWS > Backup > Backup Selection
- AWS > Backup > Protected Resource
- AWS > Backup > Recovery Point
Control Types
Added
- AWS > Backup > Backup Selection > Active
- AWS > Backup > Backup Selection > Approved
- AWS > Backup > Backup Selection > CMDB
- AWS > Backup > Backup Selection > Discovery
- AWS > Backup > Protected Resource > CMDB
- AWS > Backup > Protected Resource > Discovery
- AWS > Backup > Recovery Point > Active
- AWS > Backup > Recovery Point > Approved
- AWS > Backup > Recovery Point > CMDB
- AWS > Backup > Recovery Point > Discovery
- AWS > Backup > Recovery Point > Tags
Policy Types
Added
- AWS > Backup > Backup Selection > Active
- AWS > Backup > Backup Selection > Active > Age
- AWS > Backup > Backup Selection > Active > Last Modified
- AWS > Backup > Backup Selection > Approved
- AWS > Backup > Backup Selection > Approved > Custom
- AWS > Backup > Backup Selection > Approved > Regions
- AWS > Backup > Backup Selection > Approved > Usage
- AWS > Backup > Backup Selection > CMDB
- AWS > Backup > Backup Selection > Regions
- AWS > Backup > Protected Resource > CMDB
- AWS > Backup > Protected Resource > Regions
- AWS > Backup > Recovery Point > Active
- AWS > Backup > Recovery Point > Active > Age
- AWS > Backup > Recovery Point > Active > Budget
- AWS > Backup > Recovery Point > Active > Last Modified
- AWS > Backup > Recovery Point > Approved
- AWS > Backup > Recovery Point > Approved > Budget
- AWS > Backup > Recovery Point > Approved > Custom
- AWS > Backup > Recovery Point > Approved > Regions
- AWS > Backup > Recovery Point > Approved > Usage
- AWS > Backup > Recovery Point > CMDB
- AWS > Backup > Recovery Point > Regions
- AWS > Backup > Recovery Point > Tags
- AWS > Backup > Recovery Point > Tags > Template
Action Types
Added
- AWS > Backup > Backup Selection > Delete
- AWS > Backup > Backup Selection > Router
- AWS > Backup > Recovery Point > Delete
- AWS > Backup > Recovery Point > Router
- AWS > Backup > Recovery Point > Update Tags
5.7.0 (2022-03-22)
What's new?
- Users can now create their own custom checks against resource attributes in the Approved control using the
Approved > Custom
policy. These custom checks would be a part of the evaluation of the Approved control. Custom messages can also be added which are then displayed in the control details table. See Custom Checks for more information.
Bug fixes
- We've improved the process of deleting resources from Turbot if their CMDB policy was set to
Enforce: Disabled
. The CMDB controls will now not look to resolve credentials via Turbot's IAM role while deleting resources from Turbot. This will allow the CMDB controls to process resource deletions from Turbot more reliably than before.
Control Types
Added
- AWS > Backup > Backup Plan > Configured
- AWS > Backup > Backup Vault > Configured
Policy Types
Added
- AWS > Backup > Backup Plan > Approved > Custom
- AWS > Backup > Backup Plan > Configured
- AWS > Backup > Backup Plan > Configured > Claim Precedence
- AWS > Backup > Backup Plan > Configured > Source
- AWS > Backup > Backup Vault > Approved > Custom
- AWS > Backup > Backup Vault > Configured
- AWS > Backup > Backup Vault > Configured > Claim Precedence
- AWS > Backup > Backup Vault > Configured > Source
5.6.0 (2021-07-22)
Resource Types
Added
- AWS > Backup > Region Settings
Control Types
Added
- AWS > Backup > Region Settings > CMDB
- AWS > Backup > Region Settings > Discovery
- AWS > Backup > Region Settings > Service Opt-In
Policy Types
Added
- AWS > Backup > Region Settings > CMDB
- AWS > Backup > Region Settings > Regions
- AWS > Backup > Region Settings > Service Opt-In
- AWS > Backup > Region Settings > Service Opt-In > Resources
Action Types
Added
- AWS > Backup > Region Settings > Router
- AWS > Backup > Region Settings > Update Service Opt-In
5.5.0 (2021-06-24)
What's new?
AWS > Turbot > Permissions > Compiled > API Boundary > @turbot/aws-backup
policy now includesbackup-storage:*
permissions.
5.4.0 (2021-06-17)
Control Types
Added
- AWS > Backup > Stack
Policy Types
Added
- AWS > Backup > Stack
- AWS > Backup > Stack > Secret Variables
- AWS > Backup > Stack > Source
- AWS > Backup > Stack > Terraform Version
- AWS > Backup > Stack > Variables
5.3.2 (2020-12-28)
Bug fixes
- Controls run faster now when in the
tbd
andskipped
states thanks to the new Turbot Precheck feature (not to be confused with TSA PreCheck). With Turbot Precheck, controls avoid running GraphQL input queries when intbd
andskipped
, resulting in faster and lighter control runs.
5.3.1 (2020-09-30)
Bug fixes
- We've made some improvements to our real-time event handling that reduces the risk of creating resources in CMDB with malformed AKAs. There's no noticeable difference, but things should run more reliably now.
5.3.0 (2020-09-04)
What's new?
- Discovery controls now have their own control category,
CMDB > Discovery
, to allow for easier filtering separately from other CMDB controls. - We've renamed the service's default regions policy from
Regions [Default]
toRegions
to be consistent with our other regions policies. - A vault's access policy document is now available in its
Policy
field.
Policy Types
Renamed
- AWS > Backup > Regions [Default] to AWS > Backup > Regions
5.2.0 (2020-08-13)
What's new?
- Updated
AWS > Backup > Regions
policy default value to now includeus-gov-east-1
,us-gov-west-1
.
Policy Types
Added
- AWS > Backup > Backup Vault > Approved > Encryption at Rest
- AWS > Backup > Backup Vault > Approved > Encryption at Rest > Customer Managed Key
5.1.5 (2020-08-11)
Bug fixes
- In various Active controls, we were outputting log messages that did not properly show how many days were left until we'd delete the inactive resources (we were still deleting them after the correct number of days). These log messages have been fixed and now contain the correct number of days.
5.1.4 (2020-07-06)
Bug fixes
- Updated various resource configurations to provide better compatibility with AWS China regions.
5.1.3 (2020-06-12)
What's new?
- All resource Router actions now run even if Turbot is outside of its allowed change window. This allows Turbot to maintain an up-to-date CMDB by handling resource updates at all times. Note that this only affects Turbot's ability to process resources changes that were made in the cloud provider - enforcement actions are still disabled outside of the change window.
5.1.2 (2020-05-26)
Bug fixes
- Links to documentation in the descriptions for several controls and policies were broken. These links have now been fixed.