feat(backup): add disableDefaultBackupPolicy property to selection

[go-to-k]

This PR adds a new property disableDefaultBackupPolicy for BackupSelection. Setting this to true (a default value is false) disables the default role policy AWSBackupServiceRolePolicyForBackup attachment.

Closes #27900.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[lpizzinidev]

Thanks, the implementation looks good!
Just some suggestions on a different name for the variable and documentation adjustments.

[lpizzinidev]

Suggested change

	/**
	* Whether to automatically give backup permissions to the role that AWS
	* Backup uses. If `true`, the `AWSBackupServiceRolePolicyForBackup` managed
	* policy will be attached to the role.
	*
	* @default true
	*/
	readonly attachBackupPolicy?: boolean;
	/**
	* Whether to disable automatically assigning default backup permissions to the role
	* that AWS Backup uses.
	* If `true`, the `AWSBackupServiceRolePolicyForBackup` managed policy will be
	* attached to the role.
	*
	* @default - false
	*/
	readonly disableDefaultBackupPolicy?: boolean;

[lpizzinidev]

Suggested change

	You can set `attachBackupPolicy` to false and attach your role to the plan
	if you don't want to use the managed policy.
	```ts
	declare const plan: backup.BackupPlan;
	const role = new iam.Role(this, 'BackupRole', {
	assumedBy: new iam.ServicePrincipal('backup.amazonaws.com'),
	});
	role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AWSBackupServiceRolePolicyForS3Backup'));
	role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AWSBackupServiceRolePolicyForS3Restore'));
	plan.addSelection('Selection', {
	resources: [
	backup.BackupResource.fromTag('stage', 'prod'),
	],
	role,
	attachBackupPolicy: false,
	});
	```
	A managed policy for restores will be attached to the role by setting
	`allowRestores` to true.
	```ts
	declare const plan: backup.BackupPlan;
	plan.addSelection('Selection', {
	resources: [
	backup.BackupResource.fromTag('stage', 'prod'),
	],
	allowRestores: true,
	});
	To disable the plan from assigning the default `AWSBackupServiceRolePolicyForBackup` backup policy use the `disableDefaultBackupPolicy` property.
	This is useful if you want to avoid granting unnecessary permissions to the role.
	```ts
	declare const plan: backup.BackupPlan;
	const role = new iam.Role(this, 'BackupRole', {
	assumedBy: new iam.ServicePrincipal('backup.amazonaws.com'),
	});
	// Assign S3-specific backup policy
	role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AWSBackupServiceRolePolicyForS3Backup'));
	plan.addSelection('Selection', {
	resources: [
	backup.BackupResource.fromTag('stage', 'prod'),
	],
	role,
	disableDefaultBackupPolicy: true,
	});

Idea for revision, feel free to improve.

[lpizzinidev]

Suggested change

	* the resources.
	* The `AWSBackupServiceRolePolicyForBackup` managed policy
	* will be attached to this role unless `disableDefaultBackupPolicy`
	* is set to `true`.

[go-to-k]

@lpizzinidev

Thanks for your review! I changed them.

[lpizzinidev]

Thanks, looks good to me 👍
Can you please update the title to use the new property name?

[sumupitchayan]

Thanks for your contribution!

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[go-to-k]

@sumupitchayan

Thanks for the approval! But the Queue: Embarked in merge queue failed. Could you please handle this?

Pull request has been modified.

Pull request has been modified.

Pull request has been modified.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: ac2fd9f
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).