Policy: AWSBackupServiceRolePolicyForS3Restore ARN: arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForS3Restore Allowed Actions Actions Services kms:Decrypt kms kms:DescribeKey kms kms:GenerateDataKey kms s3:CreateBucket s3 s3:DeleteObject s3 s3:GetBucketLocation s3 s3:GetBucketOwnershipControls s3 s3:GetBucketVersioning s3 s3:GetObject s3 s3:GetObjectAcl s3 s3:GetObjectTagging s3 s3:GetObjectVersion s3 s3:GetObjectVersionAcl s3 s3:ListBucket s3 s3:ListBucketVersions s3 s3:ListMultipartUploadParts s3 s3:PutBucketOwnershipControls s3 s3:PutBucketVersioning s3 s3:PutObject s3 s3:PutObjectAcl s3 s3:PutObjectTagging s3 s3:PutObjectVersionAcl s3