Configure AWS Backup Vault Access Policy

01 Sign in to AWS Management Console.

02 Navigate to Backup service dashboard at https://console.aws.amazon.com/backup/.

03 In the left navigation panel, under Dashboard, choose Backup vaults.

04 Select the backup vault that you want to examine, then click on its name to access the resource configuration details.

05 On the selected vault configuration page, inside the Access policy section, check the associated policy document for the following statement, where Resource element value (highlighted) represents the Amazon Resource Name (ARN) of the selected backup vault:

"Statement": [
    {
        "Effect": "Deny",
        "Principal": "*",
        "Action": "backup:DeleteRecoveryPoint",
        "Resource": "arn:aws:backup:<aws-region>:<aws-account-id>:backup-vault:<backup-vault-name>"
    }
]

06 Repeat steps no. 4 and 5 to check the access policy configuration for other AWS Backup vaults available in the current region.

07 Change the AWS region from the console navigation bar and repeat the audit process for other regions.

01 Run list-backup-vaults command (OSX/Linux/UNIX) to list the names of all backup vaults available in the selected AWS region:

aws backup list-backup-vaults
    --region us-east-1
    --output table
    --query 'BackupVaultList[*].BackupVaultName'

02 The command output should return a table with the requested AWS Backup vault names:

---------------------------
|    ListBackupVaults     |
+-------------------------+
|  cc-internal-app-vault  |
|  cc-prod-backup-vault   |
+-------------------------+

03 Run get-backup-vault-access-policy command (OSX/Linux/UNIX) using the name of the backup vault that you want to examine as identifier parameter to return the access policy document that is associated with the selected vault:

aws backup get-backup-vault-access-policy
    --region us-east-1
    --backup-vault-name cc-internal-app-vault

04 Based on the resource-based access policy configuration, the command output should return one of the following:

1. If the command output returns the "ResourceNotFoundException" error, as shown in the example below, the selected Amazon Backup vault is not associated with an access policy, therefore there is no deletion protection configured for the selected vault.
   Note: "Principal": "*" and "Principal" : { "AWS" : "*" } are equivalent
   An error occurred (ResourceNotFoundException) when calling the GetBackupVaultAccessPolicy operation: Cryopd arn:aws:backup:us-east-1:123456789012:backup-vault:cc-internal-app-vault has no associated policy.
   

2. If get-backup-vault-access-policy command output returns an access policy document but this document does not contain the policy statement listed below (where Resource value represents the ARN of the backup vault), the selected Amazon Backup vault does not have deletion protection enabled for its backups:
   "Statement": [
       {
           "Effect": "Deny",
           "Principal": "*",
           "Action": "backup:DeleteRecoveryPoint",
           "Resource": "arn:aws:backup:<aws-region>:<aws-account-id>:backup-vault:<backup-vault-name>"
       }
   ]
   

05 Repeat step no. 3 and 4 to verify the access policy configuration for other AWS Backup vaults available in the selected region.

06 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 5 to perform the entire process for other regions.

01 Sign in to AWS Management Console.

02 Navigate to Backup service dashboard at https://console.aws.amazon.com/backup/.

03 In the left navigation panel, under Dashboard, choose Backup vaults.

04 Click on the name of the vault that you want to reconfigure (see Audit section part I to identify the right resource).

05 On the selected vault configuration page, in the Access policy section, perform one of the following:

1. If the selected backup vault does not have an access policy attached, paste the policy document listed below within the Policy editor box. Make sure that you replace the Resource element value (highlighted ARN) with your own vault ARN:
   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Deny",
               "Principal": "*",
               "Action": "backup:DeleteRecoveryPoint",
               "Resource": "arn:aws:backup:<aws-region>:<aws-account-id>:backup-vault:<backup-vault-name>"
           }
       ]
   }
   

2. If the vault selected does have an access policy attached, add the policy statement listed below to the existing policy document available in the Policy editor box. Make sure that you replace the Resource element value (ARN – highlighted) with your own backup vault ARN:
   "Statement": [
       {
           "Effect": "Deny",
           "Principal": "*",
           "Action": "backup:DeleteRecoveryPoint",
           "Resource": "arn:aws:backup:<aws-region>:<aws-account-id>:backup-vault:<backup-vault-name>"
       }
   ]
   

06 Click Attach Policy to attach/update the specified resource-based access policy.

07 Repeat steps no. 4 – 6 to implement deletion protection using policies for other AWS Backup vaults available in the current region.

08 Change the AWS region from the navigation bar to repeat the entire remediation/resolution process for the other regions.

01 Define the resource-based policy that is used to manage access permissions on the target backup vault. Create a new policy document, name it vault-access-policy.json, and paste the content listed below. If the selected backup vault has an access policy attached, add just the policy statement to the existing document. Regardless of the policy configuration used, replace the highlighted information, i.e. the ARN of the selected backup vault with your own vault ARN:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "backup:DeleteRecoveryPoint",
            "Resource": "arn:aws:backup:us-east-1:122330079136:backup-vault:cc-internal-app-vault"
        }
    ]
}

02 Run put-backup-vault-access-policy command (OSX/Linux/UNIX) using the file name of the newly created policy document (i.e. vault-access-policy.json) as command parameter to attach the access policy defined at the previous step to the selected Amazon Backup vault (the command does not produce an output):

aws backup put-backup-vault-access-policy
    --region us-east-1
    --backup-vault-name cc-internal-app-vault
    --policy file://vault-access-policy.json

03 Repeat step no. 1 and 2 to configure deletion protection using access policies for other AWS Backup vaults available in the selected region.

04 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 3 to perform the entire process for other regions.