data "aws_iam_policy_document" "example" {

  statement {
    actions = ["backup:DescribeBackupVault", "backup:DeleteBackupVault", "backup:PutBackupVaultAccessPolicy", "backup:DeleteBackupVaultAccessPolicy", "backup:GetBackupVaultAccessPolicy", "backup:StartBackupJob", "backup:GetBackupVaultNotifications", "backup:PutBackupVaultNotifications"]
    effect = "Allow"

    principals {
      identifiers = [*]
      type = "AWS"
    }
    resources = [aws_backup_vault.example.arn]
  }
}

resource "aws_backup_vault" "example" {
  name = "example"
}

resource "aws_backup_vault_policy" "example" {
  backup_vault_name = aws_backup_vault.example.name
  policy = data.aws_iam_policy_document.example.json
}