rage.fail

aws-backup-recovery-point-restored-content

A recovery point can contain every secret present in the protected resource; AWS Backup has no generic content-read API, so inspection requires restoration into the source service.

awscritical service: aws:backup emits CanReadData

Where it sits

location	`StartRestoreJob recovery point -> restored resource data`
location kind	`data_record`
data kinds	`credential` `password` `api_key` `private_key` `customer_data` `source_code_secret`
emits edge	`CanReadData`
service	AWS Backup (aws:backup)

Collection recipe

access mode	`indirect_destination`
operation	`StartRestoreJob then source-service read`
response path	`restored resource content`
encoding	`protocol_native`
params	`{"IamRoleArn": "\u003crestore-role\u003e", "Metadata": "\u003crestore-metadata\u003e", "RecoveryPointArn": "\u003crecovery-point-arn\u003e"}`

Required permissions

backup:StartRestoreJob
iam:PassRole

References

https://docs.aws.amazon.com/cli/latest/reference/backup/start-restore-job.html
https://docs.aws.amazon.com/service-authorization/latest/reference/service-reference.html
https://servicereference.us-east-1.amazonaws.com/v1/backup/backup.json
https://servicereference.us-east-1.amazonaws.com/v1/iam/iam.json