AWSBackupOperatorPolicy

{
    "PolicyVersion": {
        "Document": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Action": [
                        "backup:Get*",
                        "backup:List*",
                        "backup:Describe*",
                        "backup:CreateBackupSelection",
                        "backup:DeleteBackupSelection",
                        "backup:GetRecoveryPointRestoreMetadata",
                        "backup:StartBackupJob",
                        "backup:StartRestoreJob"
                    ],
                    "Resource": "*"
                },
                {
                    "Action": [
                        "rds:DescribeDBSnapshots",
                        "rds:ListTagsForResource",
                        "rds:DescribeDBInstances",
                        "rds:describeDBSnapshots",
                        "rds:describeDBEngineVersions",
                        "rds:describeOptionGroups",
                        "rds:describeOrderableDBInstanceOptions",
                        "rds:describeDBSubnetGroups"
                    ],
                    "Effect": "Allow",
                    "Resource": "*"
                },
                {
                    "Action": [
                        "dynamodb:ListBackups",
                        "dynamodb:ListTables"
                    ],
                    "Effect": "Allow",
                    "Resource": "*"
                },
                {
                    "Action": [
                        "elasticfilesystem:DescribeFilesystems"
                    ],
                    "Resource": "arn:aws:elasticfilesystem:*:*:file-system/*",
                    "Effect": "Allow"
                },
                {
                    "Action": [
                        "ec2:DescribeSnapshots",
                        "ec2:DescribeVolumes",
                        "ec2:describeAvailabilityZones"
                    ],
                    "Effect": "Allow",
                    "Resource": "*"
                },
                {
                    "Action": [
                        "tag:GetTagKeys",
                        "tag:GetTagValues",
                        "tag:GetResources"
                    ],
                    "Effect": "Allow",
                    "Resource": "*"
                },
                {
                    "Effect": "Allow",
                    "Action": [
                        "storagegateway:DescribeCachediSCSIVolumes",
                        "storagegateway:DescribeStorediSCSIVolumes"
                    ],
                    "Resource": "arn:aws:storagegateway:*:*:gateway/*/volume/*"
                },
                {
                    "Effect": "Allow",
                    "Action": [
                        "storagegateway:ListGateways"
                    ],
                    "Resource": "arn:aws:storagegateway:*:*:*"
                },
                {
                    "Effect": "Allow",
                    "Action": [
                        "storagegateway:DescribeGatewayInformation",
                        "storagegateway:ListVolumes",
                        "storagegateway:ListLocalDisks"
                    ],
                    "Resource": "arn:aws:storagegateway:*:*:gateway/*"
                },
                {
                    "Action": [
                        "iam:ListRoles",
                        "iam:GetRole",
                        "iam:GetUser"
                    ],
                    "Effect": "Allow",
                    "Resource": "*"
                },
                {
                    "Effect": "Allow",
                    "Action": "iam:PassRole",
                    "Resource": [
                        "arn:aws:iam::*:role/*AwsBackup*",
                        "arn:aws:iam::*:role/*AWSBackup*"
                    ],
                    "Condition": {
                        "StringLike": {
                            "iam:PassedToService": "backup.amazonaws.com"
                        }
                    }
                },
                {
                    "Action": [
                        "kms:ListKeys",
                        "kms:DescribeKey",
                        "kms:GenerateDataKey",
                        "kms:RetireGrant",
                        "kms:CreateGrant",
                        "kms:ListAliases",
                        "kms:Decrypt"
                    ],
                    "Effect": "Allow",
                    "Resource": "*"
                }
            ]
        },
        "VersionId": "v2",
        "IsDefaultVersion": true,
        "CreateDate": "2019-03-11T22:18:12Z"
    }
}