initial commit
This commit is contained in:
@@ -0,0 +1,47 @@
|
||||
<!-- This readme file is generated with terraform-docs -->
|
||||
## Requirements
|
||||
|
||||
No requirements.
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| aws | n/a |
|
||||
|
||||
## Modules
|
||||
|
||||
No modules.
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [aws_backup_plan.ab-plan](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_plan) | resource |
|
||||
| [aws_backup_region_settings.ab-settings](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_region_settings) | resource |
|
||||
| [aws_backup_selection.ab-selection-by-service-type](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_selection) | resource |
|
||||
| [aws_backup_vault.ab-vault](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_vault) | resource |
|
||||
| [aws_backup_vault_policy.ab-vault-policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_vault_policy) | resource |
|
||||
| [aws_iam_role.ab-iam-role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
|
||||
| [aws_iam_role_policy_attachment.ab-iam-role-policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
|
||||
| [aws_kms_alias.ab-kms-key-alias](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |
|
||||
| [aws_kms_key.ab-kms-key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
|
||||
| [aws_caller_identity.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
| Name | Description | Type | Default | Required |
|
||||
|------|-------------|------|---------|:--------:|
|
||||
| daily-backup-cron | Daily backup rule cron expression | `string` | n/a | yes |
|
||||
| daily-backup-retention | Daily backup retention period | `number` | n/a | yes |
|
||||
| monthly-backup-cron | Monthly backup rule cron expression | `string` | n/a | yes |
|
||||
| monthly-backup-retention | Monthly backup retention period | `number` | n/a | yes |
|
||||
| service-opt-in | n/a | <pre>map(object({<br> enabled = bool<br> }))</pre> | <pre>{<br> "Aurora": {<br> "enabled": false<br> },<br> "DynamoDB": {<br> "enabled": true<br> },<br> "EBS": {<br> "enabled": false<br> },<br> "EC2": {<br> "enabled": true<br> },<br> "EFS": {<br> "enabled": true<br> },<br> "FSx": {<br> "enabled": false<br> },<br> "RDS": {<br> "enabled": true<br> },<br> "Redshift": {<br> "enabled": true<br> },<br> "S3": {<br> "enabled": false<br> },<br> "VirtualMachine": {<br> "enabled": false<br> }<br>}</pre> | no |
|
||||
|
||||
## Outputs
|
||||
|
||||
No outputs.
|
||||
|
||||
---
|
||||
## Authorship
|
||||
This module was developed by xpk.
|
||||
@@ -0,0 +1,43 @@
|
||||
data "aws_caller_identity" "this" {}
|
||||
|
||||
resource "aws_kms_key" "ab-kms-key" {
|
||||
description = "KMS key for aws backup"
|
||||
deletion_window_in_days = 10
|
||||
policy = jsonencode(
|
||||
{
|
||||
"Version" : "2012-10-17",
|
||||
"Id" : "awsbackup-service",
|
||||
"Statement" : [
|
||||
{
|
||||
"Sid" : "Enable IAM User Permissions",
|
||||
"Effect" : "Allow",
|
||||
"Principal" : {
|
||||
"AWS" : "arn:aws:iam::${data.aws_caller_identity.this.id}:root"
|
||||
},
|
||||
"Action" : "kms:*",
|
||||
"Resource" : "*"
|
||||
},
|
||||
{
|
||||
"Sid" : "Allow attachment of persistent resources",
|
||||
"Effect" : "Allow",
|
||||
"Principal" : "*",
|
||||
"Action" : [
|
||||
"kms:CreateGrant",
|
||||
"kms:ListGrants",
|
||||
"kms:RevokeGrant"
|
||||
],
|
||||
"Resource" : "*",
|
||||
"Condition" : {
|
||||
"Bool" : {
|
||||
"kms:GrantIsForAWSResource" : "true"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
})
|
||||
}
|
||||
|
||||
resource "aws_kms_alias" "ab-kms-key-alias" {
|
||||
name = "alias/awsbackup-kms-key"
|
||||
target_key_id = aws_kms_key.ab-kms-key.id
|
||||
}
|
||||
@@ -0,0 +1,176 @@
|
||||
# build local data structure
|
||||
|
||||
locals {
|
||||
backup-config = {
|
||||
"Aurora" : {
|
||||
enabled = var.service-opt-in.Aurora.enabled
|
||||
arn-prefix = "arn:aws:rds:*:*:cluster:*"
|
||||
}
|
||||
"DynamoDB" : {
|
||||
enabled = var.service-opt-in.DynamoDB.enabled
|
||||
arn-prefix = "arn:aws:dynamodb:*:*:table/*"
|
||||
}
|
||||
"EBS" : {
|
||||
enabled = var.service-opt-in.EBS.enabled
|
||||
arn-prefix = "arn:aws:ec2:*:*:volume/*"
|
||||
}
|
||||
"EC2" : {
|
||||
enabled = var.service-opt-in.EC2.enabled
|
||||
arn-prefix = "arn:aws:ec2:*:*:instance/*"
|
||||
}
|
||||
"EFS" : {
|
||||
enabled = var.service-opt-in.EFS.enabled
|
||||
arn-prefix = "arn:aws:elasticfilesystem:*:*:file-system/*"
|
||||
}
|
||||
"FSx" : {
|
||||
enabled = var.service-opt-in.FSx.enabled
|
||||
arn-prefix = "arn:*:fsx:*"
|
||||
}
|
||||
"Redshift" : {
|
||||
enabled = var.service-opt-in.Redshift.enabled
|
||||
arn-prefix = "arn:aws:redshift:*:*:cluster:*"
|
||||
}
|
||||
"RDS" : {
|
||||
enabled = var.service-opt-in.RDS.enabled
|
||||
arn-prefix = "arn:aws:rds:*:*:db:*"
|
||||
}
|
||||
# this version can't handle space
|
||||
# "Storage Gateway" : {
|
||||
# enabled = var.opt-in-storagegateway
|
||||
# arn-prefix = "arn:aws:storagegateway:*:*:gateway/*"
|
||||
# }
|
||||
"VirtualMachine" : {
|
||||
enabled = var.service-opt-in.VirtualMachine.enabled
|
||||
arn-prefix = "arn:aws:backup-gateway:*:*:vm/*"
|
||||
}
|
||||
"S3" : {
|
||||
enabled = var.service-opt-in.S3.enabled
|
||||
arn-prefix = "arn:aws:s3:::*"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_backup_region_settings" "ab-settings" {
|
||||
resource_type_opt_in_preference = {
|
||||
for k, v in local.backup-config : k => v.enabled
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_backup_vault" "ab-vault" {
|
||||
for_each = toset([
|
||||
for k, v in local.backup-config : k
|
||||
if v.enabled
|
||||
])
|
||||
name = "BackupVault-${each.value}"
|
||||
kms_key_arn = aws_kms_key.ab-kms-key.arn
|
||||
}
|
||||
|
||||
resource "aws_backup_vault_policy" "ab-vault-policy" {
|
||||
for_each = aws_backup_vault.ab-vault
|
||||
backup_vault_name = each.value.name
|
||||
policy = jsonencode(
|
||||
{
|
||||
"Version" : "2012-10-17",
|
||||
"Id" : "default",
|
||||
"Statement" : [
|
||||
{
|
||||
"Sid" : "default",
|
||||
"Effect" : "Allow",
|
||||
"Principal" : {
|
||||
"AWS" : data.aws_caller_identity.this.account_id
|
||||
},
|
||||
"Action" : [
|
||||
"backup:DescribeBackupVault",
|
||||
"backup:DeleteBackupVault",
|
||||
"backup:PutBackupVaultAccessPolicy",
|
||||
"backup:DeleteBackupVaultAccessPolicy",
|
||||
"backup:GetBackupVaultAccessPolicy",
|
||||
"backup:StartBackupJob",
|
||||
"backup:GetBackupVaultNotifications",
|
||||
"backup:PutBackupVaultNotifications"
|
||||
],
|
||||
"Resource" : each.value.arn
|
||||
}
|
||||
]
|
||||
})
|
||||
}
|
||||
|
||||
resource "aws_backup_plan" "ab-plan" {
|
||||
for_each = aws_backup_vault.ab-vault
|
||||
name = "BackupPlan-${replace(each.value.name, "BackupVault-", "")}"
|
||||
|
||||
# daily backup
|
||||
rule {
|
||||
rule_name = "Daily"
|
||||
target_vault_name = each.value.name
|
||||
schedule = var.daily-backup-cron
|
||||
start_window = 60
|
||||
completion_window = 240
|
||||
|
||||
lifecycle {
|
||||
delete_after = var.daily-backup-retention
|
||||
}
|
||||
|
||||
recovery_point_tags = {
|
||||
"CreatedBy" : "AWSBackup"
|
||||
"AWSBackupPlan" : "BackupPlan-${replace(each.value.name, "BackupVault-", "")}-Daily"
|
||||
}
|
||||
}
|
||||
|
||||
# monthly backup (when overlap with daily, only monthly backup will be created.
|
||||
# see https://docs.aws.amazon.com/aws-backup/latest/devguide/creating-a-backup-plan.html)
|
||||
rule {
|
||||
rule_name = "Monthly"
|
||||
target_vault_name = each.value.name
|
||||
schedule = var.monthly-backup-cron
|
||||
start_window = 60
|
||||
completion_window = 240
|
||||
|
||||
lifecycle {
|
||||
delete_after = var.monthly-backup-retention
|
||||
cold_storage_after = var.daily-backup-retention # move to cold storage after daily retention, supported on a few services only
|
||||
}
|
||||
|
||||
recovery_point_tags = {
|
||||
"CreatedBy" : "AWSBackup"
|
||||
"AWSBackupPlan" : "BackupPlan-${replace(each.value.name, "BackupVault-", "")}-Monthly"
|
||||
}
|
||||
}
|
||||
|
||||
# advanced_backup_setting {
|
||||
# backup_options = {
|
||||
# WindowsVSS = "enabled"
|
||||
# }
|
||||
# resource_type = "EC2"
|
||||
# }
|
||||
}
|
||||
#
|
||||
resource "aws_iam_role" "ab-iam-role" {
|
||||
name = "AwsBackupRole"
|
||||
assume_role_policy = jsonencode(
|
||||
{
|
||||
"Version" : "2012-10-17",
|
||||
"Statement" : [
|
||||
{
|
||||
"Action" : ["sts:AssumeRole"],
|
||||
"Effect" : "allow",
|
||||
"Principal" : {
|
||||
"Service" : ["backup.amazonaws.com"]
|
||||
}
|
||||
}
|
||||
]
|
||||
})
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "ab-iam-role-policy" {
|
||||
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
|
||||
role = aws_iam_role.ab-iam-role.name
|
||||
}
|
||||
|
||||
resource "aws_backup_selection" "ab-selection-by-service-type" {
|
||||
for_each = aws_backup_plan.ab-plan
|
||||
iam_role_arn = aws_iam_role.ab-iam-role.arn
|
||||
name = "SelectionByServiceType"
|
||||
plan_id = each.value.id
|
||||
resources = [lookup(local.backup-config, replace(each.value.name, "BackupPlan-", "")).arn-prefix]
|
||||
}
|
||||
@@ -0,0 +1,57 @@
|
||||
variable "daily-backup-cron" {
|
||||
type = string
|
||||
description = "Daily backup rule cron expression"
|
||||
}
|
||||
|
||||
variable "monthly-backup-cron" {
|
||||
type = string
|
||||
description = "Monthly backup rule cron expression"
|
||||
}
|
||||
|
||||
variable "daily-backup-retention" {
|
||||
type = number
|
||||
description = "Daily backup retention period"
|
||||
}
|
||||
|
||||
variable "monthly-backup-retention" {
|
||||
type = number
|
||||
description = "Monthly backup retention period"
|
||||
}
|
||||
|
||||
variable "service-opt-in" {
|
||||
type = map(object({
|
||||
enabled = bool
|
||||
}))
|
||||
default = {
|
||||
"Aurora" : {
|
||||
enabled = false
|
||||
}
|
||||
"DynamoDB" : {
|
||||
enabled = true
|
||||
}
|
||||
"EBS" : {
|
||||
enabled = false
|
||||
}
|
||||
"EC2" : {
|
||||
enabled = true
|
||||
}
|
||||
"EFS" : {
|
||||
enabled = true
|
||||
}
|
||||
"FSx" : {
|
||||
enabled = false
|
||||
}
|
||||
"Redshift" : {
|
||||
enabled = true
|
||||
}
|
||||
"RDS" : {
|
||||
enabled = true
|
||||
}
|
||||
"VirtualMachine" : {
|
||||
enabled = false
|
||||
}
|
||||
"S3" : {
|
||||
enabled = false
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user