scp.json

        {
            "Sid": "ProtectBackups",
            "Condition": {
                "ArnNotLike": {
                    "aws:PrincipalARN": "arn:aws:iam::*:role/AWSControlTowerExecution"
                }
            },
            "Action": [
                "backup:Delete*",
                "backup:Update*"
            ],
            "Resource": [
                "arn:aws:backup:*:*:backup-plan:*",
                "arn:aws:backup:*:*:backup-vault:*"
            ],
            "Effect": "Deny"
        },
        {
            "Sid": "ProtectRecoveryPoint",
            "Condition": {
                "ArnNotLike": {
                    "aws:PrincipalARN": "arn:aws:iam::*:role/BackupRole"
                }
            },
            "Action": [
                "backup:DeleteRecoveryPoint"
            ],
            "Resource": [
                "*"
            ],
            "Effect": "Deny"
        },