[@aws_cdk.aws_backup]: BackupSelection default role policy

[annguyen36]

Describe the feature

When creating the BackupSelection L2 construct, it allows to specify allowRestores and role props.
These 2 props will add to the Role (either specified role or auto-create by this construct) the following 2 AWS managed polices:

• allowRestores: true > add by default: AWSBackupServiceRolePolicyForRestores
• role specified or not specify > by default will have: AWSBackupServiceRolePolicyForBackup

I request having the default policy AWSBackupServiceRolePolicyForBackup removed
OR, to have an option to specify the policy for S3 backup only, that way we can easier specify the least-privilege policy that need for S3 service backup and restore:
AWSBackupServiceRolePolicyForRestores
AWSBackupServiceRolePolicyForS3Backup

Use Case

The case is when

• create a BackupSelection for S3 service
• the role either not specify to let it be created by default, or defined in the same stack
• and we need a least privilege permission for this role in place to only allow S3 action.

Currently, by default, the role will have AWSBackupServiceRolePolicyForBackup added which has dynamodb, rds and other services permissions.

Proposed Solution

Currently, as a workaround, I raw override the ManagedPolicyArns to specified only 2 polices for S3 above:

    const plan = backup.BackupPlan.dailyWeeklyMonthly5YearRetention(this, 'Plan');
    const role = new iam.Role(this, 'backupRole', {
      assumedBy: new iam.ServicePrincipal('backup.amazonaws.com')
    })
    const backupSelection = new backup.BackupSelection(this, 'MyBackupSelection', {
      backupPlan: plan,
      resources: [
        backup.BackupResource.fromArn('arn:aws:s3:::my-test-bucket')
      ],
      backupSelectionName: 'backupSelection',
      role: role,
    });
    var json_list = ['arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForS3Backup','arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForS3Restore']
    const overwrite_defined_cfn_role = backupSelection.stack.node.findChild('backupRole').node.findChild('Resource') as iam.CfnRole
    overwrite_defined_cfn_role.addOverride('Properties.ManagedPolicyArns',json_list)

Other Information

Found a somewhat similar issue here #25669, but the mutable is for importing existing role only.

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.87.0

Environment details (OS name and version, etc.)

AL2

[khushail]

thanks @annguyen36 for reporting this.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.