cis-aws-storage-1-6

name	cis-aws-storage-1.6
description	Ensure AWS Backup with Service Linked Roles
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","backup","iam","service-linked-role","automation"]
cis_id	1.6
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-storage-1.4","cis-aws-storage-1.5"]
prerequisites	["cis-aws-storage-1.1"]
severity_boost	{}

CIS Control 1.6: Ensure AWS Backup with Service Linked Roles (Manual)

Profile Applicability

• Level 2

Description

AWS Service Linked Roles are IAM roles designed specifically for AWS Backup. These roles come with default configurations allowing access to all AWS resources by default.

Rationale

While Service Linked Roles offer quick deployment, using default configurations isn't recommended for security best practices.

Service Linked Roles provide:

• Quick Setup: Automatically created when you first use AWS Backup
• Managed Permissions: AWS maintains the permissions needed for backup operations
• Ease of Use: No manual policy management required

However, organizations should assess whether the default permissions align with their security requirements and consider custom roles for production environments where tighter controls are needed.

Impact

Using Service Linked Roles without proper assessment can result in:

• Over-permissive access to AWS resources
• Difficulty implementing principle of least privilege
• Potential compliance violations if default permissions are too broad
• Reduced visibility into specific backup permissions

Benefits of properly configured Service Linked Roles:

• Simplified initial setup
• Automatic updates to permissions as AWS Backup evolves
• Reduced administrative overhead for basic backup operations

Audit Procedure

Via AWS Management Console

Create service-linked role for AWS Backup:

You don't need to create a service-linked role manually. AWS Backup automatically creates it when you list resources for back up, set up cross-account backup, or perform backups using the AWS Management Console, AWS CLI, or AWS API.

If you delete this role, you can recreate it by following the same steps. AWS Backup will create it for you again when needed.

1. Check for Service-Linked Role

   • Navigate to IAM → Roles
   • Search for roles with "AWSServiceRoleForBackup" prefix
   • Verify the role exists and review its permissions

2. Review Trust Relationship

   • Ensure the role can only be assumed by backup.amazonaws.com
   • Verify no unauthorized principals can assume the role

Via AWS CLI

aws iam list-roles | grep AWSServiceRoleForBackup


aws iam get-role --role-name AWSServiceRoleForBackup


aws iam list-attached-role-policies \
  --role-name AWSServiceRoleForBackup


aws iam get-policy \
  --policy-arn arn:aws:iam::aws:policy/aws-service-role/BackupServiceRolePolicyForBackup