Skip to content

Instantly share code, notes, and snippets.

@s0enke
Created October 30, 2019 09:28
Embed
What would you like to do?
{
"Sid": "ProtectBackups",
"Condition": {
"ArnNotLike": {
"aws:PrincipalARN": "arn:aws:iam::*:role/AWSControlTowerExecution"
}
},
"Action": [
"backup:Delete*",
"backup:Update*"
],
"Resource": [
"arn:aws:backup:*:*:backup-plan:*",
"arn:aws:backup:*:*:backup-vault:*"
],
"Effect": "Deny"
},
{
"Sid": "ProtectRecoveryPoint",
"Condition": {
"ArnNotLike": {
"aws:PrincipalARN": "arn:aws:iam::*:role/BackupRole"
}
},
"Action": [
"backup:DeleteRecoveryPoint"
],
"Resource": [
"*"
],
"Effect": "Deny"
},
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment