AWSBackupGuardDutyRolePolicyForScans

OperatorAWS managedActivePermissions reviewedShow on map Compare

Summary

Provides GuardDuty permission to read your AWS Backup Recovery Points for malware scans

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/AWSBackupGuardDutyRolePolicyForScans
Default version: v3
Created: 2025-11-20
Last edited: 2026-02-12
Services: backup, ebs, ec2, kms

Control-plane actions (12)

By access level: 2 List, 2 Permissions management, 3 Read, 5 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
Backup	4 of 122	2 Read, 2 Write; 2 restricted, 0 conditional	backup:CreateBackupAccessPoint, backup:DeleteBackupAccessPoint, backup:DescribeBackupAccessPoint, backup:DescribeRecoveryPoint
EC2	3 of 834	2 List, 1 Permissions management; 1 restricted, 1 conditional	ec2:DescribeImages, ec2:DescribeSnapshots, ec2:ModifySnapshotAttribute
KMS	5 of 58	1 Permissions management, 1 Read, 3 Write; 5 restricted, 4 conditional	kms:CreateGrant, kms:Decrypt, kms:DescribeKey, kms:ReEncryptFrom, kms:ReEncryptTo

Backup: 4 actions

backup:CreateBackupAccessPoint (Write)
backup:DeleteBackupAccessPoint (Write)
backup:DescribeBackupAccessPoint (Read)
backup:DescribeRecoveryPoint (Read)

EC2: 3 actions

ec2:DescribeImages (List)
ec2:DescribeSnapshots (List)
ec2:ModifySnapshotAttribute (Permissions management)

KMS: 5 actions

kms:CreateGrant (Permissions management)
kms:Decrypt (Write)
kms:DescribeKey (Read)
kms:ReEncryptFrom (Write)
kms:ReEncryptTo (Write)

Data-plane actions (3)

By access level: 3 Read.

Data-plane actions by service
Service	Granted	Access levels and limits	Granted by
Elastic Block Store	3 of 4	3 Read; 3 restricted, 3 conditional	ebs:GetSnapshotBlock, ebs:ListChangedBlocks, ebs:ListSnapshotBlocks

Elastic Block Store: 3 actions

ebs:GetSnapshotBlock (Read)
ebs:ListChangedBlocks (Read)
ebs:ListSnapshotBlocks (Read)

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants 7 write, tagging or permissions-management actions, short of full control of any service.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "EBSDirectReadAPIPermissions",
      "Effect": "Allow",
      "Action": [
        "ebs:ListSnapshotBlocks",
        "ebs:ListChangedBlocks",
        "ebs:GetSnapshotBlock"
      ],
      "Resource": "arn:aws:ec2:*::snapshot/*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/aws:backup:source-resource": "false"
        },
        "StringLike": {
          "aws:ResourceTag/aws:backup:source-resource": "*"
        }
      }
    },
    {
      "Sid": "CreateGrantForEncryptedVolumeCreation",
      "Effect": "Allow",
      "Action": "kms:CreateGrant",
      "Resource": "arn:aws:kms:*:*:key/*",
      "Condition": {
        "StringLike": {
          "kms:EncryptionContext:aws:guardduty:id": "snap-*",
          "kms:ViaService": [
            "guardduty.*.amazonaws.com",
            "backup.*.amazonaws.com"
          ]
        },
        "ForAllValues:StringEquals": {
          "kms:GrantOperations": [
            "Decrypt",
            "CreateGrant",
            "GenerateDataKeyWithoutPlaintext",
            "ReEncryptFrom",
            "ReEncryptTo",
            "RetireGrant",
            "DescribeKey"
          ]
        },
        "Null": {
          "kms:GrantOperations": "false"
        }
      }
    },
    {
      "Sid": "CreateGrantForReEncryptAndEBSDirect",
      "Effect": "Allow",
      "Action": "kms:CreateGrant",
      "Resource": "arn:aws:kms:*:*:key/*",
      "Condition": {
        "StringLike": {
          "kms:EncryptionContext:aws:ebs:id": "snap-*",
          "kms:ViaService": [
            "guardduty.*.amazonaws.com",
            "backup.*.amazonaws.com"
          ]
        },
        "ForAllValues:StringEquals": {
          "kms:GrantOperations": [
            "Decrypt",
            "ReEncryptFrom",
            "ReEncryptTo",
            "RetireGrant",
            "DescribeKey"
          ]
        },
        "Null": {
          "kms:GrantOperations": "false"
        }
      }
    },
    {
      "Sid": "DescribeKeyPermissions",
      "Effect": "Allow",
      "Action": "kms:DescribeKey",
      "Resource": "arn:aws:kms:*:*:key/*"
    },
    {
      "Sid": "EC2ReadAPIPermissions",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeImages",
        "ec2:DescribeSnapshots"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ShareSnapshotPermissions",
      "Effect": "Allow",
      "Action": [
        "ec2:ModifySnapshotAttribute"
      ],
      "Resource": "arn:aws:ec2:*:*:snapshot/*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/aws:backup:source-resource": "false"
        },
        "StringLike": {
          "aws:ResourceTag/aws:backup:source-resource": "*"
        }
      }
    },
    {
      "Sid": "ShareSnapshotKMSPermissions",
      "Effect": "Allow",
      "Action": [
        "kms:ReEncryptTo",
        "kms:ReEncryptFrom"
      ],
      "Resource": "arn:aws:kms:*:*:key/*",
      "Condition": {
        "StringLike": {
          "kms:EncryptionContext:aws:ebs:id": [
            "vol-*",
            "snap-*"
          ],
          "kms:ViaService": "ec2.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "CreateBackupAccessPointPermissions",
      "Effect": "Allow",
      "Action": [
        "backup:CreateBackupAccessPoint"
      ],
      "Resource": "arn:aws:backup:*:*:recovery-point:*"
    },
    {
      "Sid": "ReadAndDeleteBackupAccessPointPermissions",
      "Effect": "Allow",
      "Action": [
        "backup:DescribeBackupAccessPoint",
        "backup:DeleteBackupAccessPoint"
      ],
      "Resource": "*"
    },
    {
      "Sid": "BackupRecoveryPointApiPermissions",
      "Effect": "Allow",
      "Action": [
        "backup:DescribeRecoveryPoint"
      ],
      "Resource": "arn:aws:backup:*:*:recovery-point:*"
    },
    {
      "Sid": "DecryptKMSEncryptedDataByAWSBackup",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt"
      ],
      "Resource": "arn:aws:kms:*:*:key/*",
      "Condition": {
        "StringLike": {
          "kms:EncryptionContext:aws:backup:backup-vault": "*",
          "kms:ViaService": "backup.*.amazonaws.com"
        }
      }
    }
  ]
}

Version history

Current version v3, edited by AWS on 2026-02-12. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSBackupGuardDutyRolePolicyForScans
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSBackupGuardDutyRolePolicyForScans
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSBackupGuardDutyRolePolicyForScans

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSBackupGuardDutyRolePolicyForScans

Terraform

resource "aws_iam_role_policy_attachment" "awsbackupguarddutyrolepolicyforscans" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSBackupGuardDutyRolePolicyForScans"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSBackupGuardDutyRolePolicyForScans"),
);

Sources

Pending editorial review. No editorial sources are listed yet.