Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-storage-1-6The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-aws-storage-1.6 |
| description | Ensure AWS Backup with Service Linked Roles |
| category | cis-storage-services |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","storage","backup","iam","service-linked-role","automation"] |
| cis_id | 1.6 |
| cis_benchmark | CIS AWS Storage Services Benchmark v1.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-storage-1.4","cis-aws-storage-1.5"] |
| prerequisites | ["cis-aws-storage-1.1"] |
| severity_boost | {} |
AWS Service Linked Roles are IAM roles designed specifically for AWS Backup. These roles come with default configurations allowing access to all AWS resources by default.
While Service Linked Roles offer quick deployment, using default configurations isn't recommended for security best practices.
Service Linked Roles provide:
However, organizations should assess whether the default permissions align with their security requirements and consider custom roles for production environments where tighter controls are needed.
Using Service Linked Roles without proper assessment can result in:
Benefits of properly configured Service Linked Roles:
Create service-linked role for AWS Backup:
You don't need to create a service-linked role manually. AWS Backup automatically creates it when you list resources for back up, set up cross-account backup, or perform backups using the AWS Management Console, AWS CLI, or AWS API.
If you delete this role, you can recreate it by following the same steps. AWS Backup will create it for you again when needed.
Check for Service-Linked Role
Review Trust Relationship
aws iam list-roles | grep AWSServiceRoleForBackup
aws iam get-role --role-name AWSServiceRoleForBackup
aws iam list-attached-role-policies \
--role-name AWSServiceRoleForBackup
aws iam get-policy \
--policy-arn arn:aws:iam::aws:policy/aws-service-role/BackupServiceRolePolicyForBackup
Automatic Creation (Recommended Initial Setup)
Assessment of Service-Linked Role
If Custom Role is Preferred
The service-linked role is created automatically. To verify its existence:
# Check if service-linked role exists
aws iam get-role --role-name AWSServiceRoleForBackup
# If you need to recreate it (after deletion)
# Simply perform any backup operation via CLI:
aws backup list-backup-vaults
# The role will be automatically recreated
Note: You cannot manually create the service-linked role using AWS CLI. It must be created automatically by the service.
When using the AWS Backup console for the first time, you can choose to have AWS Backup create a default service role for you. This role has the permissions that AWS Backup needs to create and restore backups on your behalf.
The service-linked role includes these AWS-managed policies:
BackupServiceRolePolicyForBackupBackupServiceRolePolicyForRestoresNot mapped to specific CIS Controls v7 or v8 in the provided documentation.