AWSBackupRestoreAccessForSAPHANA

OperatorAWS managedActivePermissions reviewedShow on map Compare

Summary

Provides AWS Backup permission to restore a backup of SAP HANA on Amazon EC2

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/AWSBackupRestoreAccessForSAPHANA
Default version: v1
Created: 2022-11-10
Last edited: 2022-11-10
Services: backup, ssm-sap

Control-plane actions (72)

By access level: 32 List, 1 Permissions management, 34 Read, 5 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
Backup	65 of 122	31 List, 1 Permissions management, 31 Read, 2 Write; 0 restricted, 0 conditional	backup:Describe, backup:Get, backup:List*, backup:StartBackupJob, backup:StartRestoreJob
Systems Manager for SAP	7 of 30	1 List, 3 Read, 3 Write; 5 restricted, 0 conditional	ssm-sap:BackupDatabase, ssm-sap:GetDatabase, ssm-sap:GetOperation, ssm-sap:ListDatabases, ssm-sap:ListTagsForResource, ssm-sap:RestoreDatabase, ssm-sap:UpdateHanaBackupSettings

Backup: 65 actions

backup:DescribeBackupAccessPoint (Read)
backup:DescribeBackupJob (Read)
backup:DescribeBackupVault (Read)
backup:DescribeCopyJob (Read)
backup:DescribeFramework (Read)
backup:DescribeGlobalSettings (Read)
backup:DescribeProtectedResource (Read)
backup:DescribeRecoveryPoint (Read)
backup:DescribeRegionSettings (Read)
backup:DescribeReportJob (Read)
backup:DescribeReportPlan (Read)
backup:DescribeRestoreJob (Read)
backup:DescribeScanJob (Read)
backup:GetBackupPlan (Read)
backup:GetBackupPlanFromJSON (Read)
backup:GetBackupPlanFromTemplate (Read)
backup:GetBackupSelection (Read)
backup:GetBackupVaultAccessPolicy (Read)
backup:GetBackupVaultNotifications (Read)
backup:GetBackupVaultSharingPolicy (Read)
backup:GetLegalHold (Read)
backup:GetPITRMalwareScanResults (Read)
backup:GetRecoveryPointIndexDetails (Read)
backup:GetRecoveryPointRestoreMetadata (Read)
backup:GetRestoreJobMetadata (Read)
backup:GetRestoreTestingInferredMetadata (Read)
backup:GetRestoreTestingPlan (Read)
backup:GetRestoreTestingSelection (Read)
backup:GetSupportedResourceTypes (Read)
backup:GetTieringConfiguration (Read)
backup:ListBackupAccessPoints (List)
backup:ListBackupAccessPointsByRecoveryPoint (List)
backup:ListBackupAccessPointsByResource (List)
backup:ListBackupJobSummaries (List)
backup:ListBackupJobs (List)
backup:ListBackupPlanTemplates (List)
backup:ListBackupPlanVersions (List)
backup:ListBackupPlans (List)
backup:ListBackupSelections (List)
backup:ListBackupVaults (List)
backup:ListCopyJobSummaries (List)
backup:ListCopyJobs (List)
backup:ListFrameworks (List)
backup:ListIndexedRecoveryPoints (List)
backup:ListIndexedRecoveryPointsForSearch (Permissions management)
backup:ListLegalHolds (List)
backup:ListProtectedResources (List)
backup:ListProtectedResourcesByBackupVault (List)
backup:ListRecoveryPointsByBackupVault (List)
backup:ListRecoveryPointsByLegalHold (List)
backup:ListRecoveryPointsByResource (List)
backup:ListReportJobs (List)
backup:ListReportPlans (List)
backup:ListRestoreAccessBackupVaults (List)
backup:ListRestoreJobSummaries (List)
backup:ListRestoreJobs (List)
backup:ListRestoreJobsByProtectedResource (List)
backup:ListRestoreTestingPlans (List)
backup:ListRestoreTestingSelections (List)
backup:ListScanJobSummaries (List)
backup:ListScanJobs (List)
backup:ListTags (Read)
backup:ListTieringConfigurations (List)
backup:StartBackupJob (Write)
backup:StartRestoreJob (Write)

Systems Manager for SAP: 7 actions

ssm-sap:BackupDatabase (Write)
ssm-sap:GetDatabase (Read)
ssm-sap:GetOperation (Read)
ssm-sap:ListDatabases (List)
ssm-sap:ListTagsForResource (Read)
ssm-sap:RestoreDatabase (Write)
ssm-sap:UpdateHANABackupSettings (Write)

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants 6 write, tagging or permissions-management actions, short of full control of any service.
1 granted write or permissions-management action has no data-plane classification from AWS, so the data-plane rule cannot assess it.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "backup:Get*",
        "backup:List*",
        "backup:Describe*",
        "backup:StartBackupJob",
        "backup:StartRestoreJob"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssm-sap:GetOperation",
        "ssm-sap:ListDatabases"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssm-sap:BackupDatabase",
        "ssm-sap:RestoreDatabase",
        "ssm-sap:UpdateHanaBackupSettings",
        "ssm-sap:GetDatabase",
        "ssm-sap:ListTagsForResource"
      ],
      "Resource": "arn:aws:ssm-sap:*:*:*"
    }
  ]
}

Version history

Current version v1, edited by AWS on 2022-11-10. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSBackupRestoreAccessForSAPHANA
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSBackupRestoreAccessForSAPHANA
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSBackupRestoreAccessForSAPHANA

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSBackupRestoreAccessForSAPHANA

Terraform

resource "aws_iam_role_policy_attachment" "awsbackuprestoreaccessforsaphana" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSBackupRestoreAccessForSAPHANA"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSBackupRestoreAccessForSAPHANA"),
);

Sources

Pending editorial review. No editorial sources are listed yet.