{"id":22347765,"url":"https://github.com/wearetechnative/terraform-aws-organization-backup","last_synced_at":"2026-01-07T03:07:55.908Z","repository":{"id":221348438,"uuid":"754099458","full_name":"wearetechnative/terraform-aws-organization-backup","owner":"wearetechnative","description":"This module implements a standard `AWS Backup` setup using `AWS Organizaion` backup policies for enforcement.","archived":false,"fork":false,"pushed_at":"2025-01-14T13:16:28.000Z","size":329,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-01-31T12:12:36.113Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/wearetechnative.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-02-07T11:58:26.000Z","updated_at":"2025-01-14T13:16:31.000Z","dependencies_parsed_at":"2024-02-07T14:27:39.791Z","dependency_job_id":"9436783c-b232-4947-ac26-d19cffd8a6d3","html_url":"https://github.com/wearetechnative/terraform-aws-organization-backup","commit_stats":null,"previous_names":["wearetechnative/terraform-aws-organization-backup"],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wearetechnative%2Fterraform-aws-organization-backup","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wearetechnative%2Fterraform-aws-organization-backup/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wearetechnative%2Fterraform-aws-organization-backup/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wearetechnative%2Fterraform-aws-organization-backup/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/wearetechnative","download_url":"https://codeload.github.com/wearetechnative/terraform-aws-organization-backup/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245641317,"owners_count":20648637,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-04T10:10:51.071Z","updated_at":"2026-01-07T03:07:50.889Z","avatar_url":"https://github.com/wearetechnative.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Terraform AWS [aws-organization-backup]\n\n\u003c!-- SHIELDS --\u003e\n\nThis module implements a standard `AWS Backup` setup using `AWS Organizaion` backup policies for enforcement.\n\nAny supported and enabled resource with tag `BackupEnabled` and value `True` will be included.\n\nThe module is currently tested for all scenarios except cross-region and cross-account combined. This probably just works or should be easy to implement.\n\nAll modules should work but currently only EBS, RDS and S3 are tested. EFS, Virtual Machines and DynamoDB might need some work [because KMS is supported](https://docs.aws.amazon.com/aws-backup/latest/devguide/encryption.html).\n\n*** Make sure you GUARD or BACKUP your `KMS CMK` keys as `AWS Backup` mostly uses the [original resource KMS CMK key](https://docs.aws.amazon.com/aws-backup/latest/devguide/encryption.html) for encrypting the backups. The best approach is to block `kms:ScheduleKeyDeletion` in an SCP.\n\nSimultaneous cross-region and cross-account is [not supported](https://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.html#features-by-resource) for RDS, Aurora, Neptune and DocumentDB.\n\n[![](we-are-technative.png)](https://www.technative.nl)\n\n## How does it work\n\nAWS Backup works by copying targeted resource's data into s3 storage on a schedule.\nYou can select which resources you want to back up with the use of tags. (explained further in ./plan.md).\nThe data can be backed up to other regions or AWS accounts.\nAWS Backup integrates with other AWS services, such as AWS Identity and Access Management (IAM) for authentication and Amazon CloudWatch for logging and monitoring.\n\n### Known (major) limitations\n\nThe module is currently tested for all scenarios except cross-region and cross-account combined. This probably just works or should be easy to implement.\n\n### Requirements\n\n- This module requires at least the following Terraform configuration on the management account.\n\n```json\nresource \"aws_organizations_organization\" \"this\" {\n  aws_service_access_principals = [ \"backup.amazonaws.com\" ]\n\n  enabled_policy_types = [ \"BACKUP_POLICY\" ]\n}\n```\n\n- When `enable_external_vault` is `true` then make sure that the provider `aws.external_vault` is set and from the *same* region as the AWS account.\n\n- When the `backup_vault_kms_key_arn` is in another account make sure that any providers that create vaults have access to this KMS key. Required permissions:\n  - kms:CreateGrant\n  - kms:GenerateDataKey\n  - kms:Decrypt\n  - kms:RetireGrant\n  - kms:DescribeKey\n\nThis requirement can be automated once Terraform `aws_kms_grant` supports service principals. See [issue 13994](https://github.com/hashicorp/terraform-provider-aws/issues/13994) for this (please upvote!).\n\n- All accounts with vaults must have the `AWSServiceRoleForBackup` service linked role. This can be created / imported in Terraform with:\n\n```json\nresource \"aws_iam_service_linked_role\" \"backup_service_linked_role\" {\n  aws_service_name = \"backup.amazonaws.com\"\n}\n```\n\n- This modules requires KMS access for the role `role/aws-service-role/backup.amazonaws.com/AWSServiceRoleForBackup`. Our [KMS key module](https://github.com/TechNative-B-V/modules-aws/commit/9f5d80f00cc477ba57d95b26230913f685e0fae9) has these policies.\n\n- Enable all resources for *each region* in the *management account* to make sure that resources are included.\n\n```json\nresource \"aws_backup_region_settings\" \"this\" {\n  resource_type_opt_in_preference = {\n    \"Aurora\" = true,\n    \"CloudFormation\" = true,\n    \"DocumentDB\" = true,\n    \"DynamoDB\" = true,\n    \"EBS\" = true,\n    \"EC2\" = true,\n    \"EFS\" = true,\n    \"FSx\" = true,\n    \"Neptune\" = true,\n    \"RDS\" = true,\n    \"Redshift\" = true,\n    \"S3\" = true,\n    \"Storage Gateway\" = true,\n    \"Timestream\" = true,\n    \"VirtualMachine\" = true\n  }\n\n  resource_type_management_preference = {\n    \"DynamoDB\" = true\n    \"EFS\"      = true\n  }\n}\n```\n\n- S3 buckets with KMS encrypted objects require that the backup role outputed with `backup_role_arn` have Decrypt, DescribeKey permissions on the KMS key.\n\nExample below with KMS grant.\n\n```ruby\nresource \"aws_kms_grant\" \"s3_appdata\" {\n  name              = \"aws_backup_${var.name}_s3_appdata\"\n  key_id            = data.terraform_remote_state.acme.outputs.acme_kms_key_arn\n  grantee_principal = module.organization_backup.backup_role_arn\n  operations        = [\"Decrypt\", \"DescribeKey\"]\n}\n```\n\n- RDS instances with KMS encrypted snapshots require that the backup role outputed with `backup_role_arn` have DescribeKey, Decrypt, ReEncryptFrom, ReEncryptTo, CreateGrant, RetireGrant permissions on the KMS key.\n\n```ruby\nresource \"aws_kms_grant\" \"s3_appdata\" {\n  name              = \"aws_backup_${var.name}_s3_appdata\"\n  key_id            = data.terraform_remote_state.acme.outputs.acme_kms_key_arn\n  grantee_principal = module.organization_backup.backup_role_arn\n\n  operations        = [\"DescribeKey\", \"Decrypt\", \"ReEncryptFrom\", \"ReEncryptTo\", \"CreateGrant\", \"RetireGrant\"]\n}\n```\n\n### Known issues\n\nInitial creation could results in errors like below. Retry again to resolve.\n\n╷\\\n│ Error: error creating Backup Vault Lock Configuration (name): AccessDeniedException:\\\n│       status code: 403, request id: 44cfe1e4-7aab-4c95-b142-9e600b278916\\\n│\\\n│   with module.organization_backup.module.backup_vault_external[0].aws_backup_vault_lock_configuration.this,\\\n│   on modules/aws-organization-backup/backup_vault/main.tf line 10, in resource \"aws_backup_vault_lock_configuration\" \"this\":\\\n│   10: resource \"aws_backup_vault_lock_configuration\" \"this\" {\\\n│\\\n╵\n\nSometimes it looks like AWS Backup is not working but it simply could take hours(!) before something happens.\n\nEnable AWS EventBridge rules on `aws.backup` to closely monitor events and issues since you can also see CloudTrail events. These events also tend to happen long before anything is visible in the web console.\n\n## Usage\n\nTo use this module see the ./examples directory for the 3 main supported and tested workflows with EBS, S3 and RDS.\n\n*ALWAYS* make sure you see your resources in 'Protected Resources' before assuming that the backup plan is correctly configured.\n\n## Future work\n\n- Combined  cross-account and cross-region. Probably requires seperate KMS keys.\n- Automatic handling of setting up KMS access under different configurations (e.g. KMS per vault location, KMS shared in source vault account, KMS shared in destination vault account).\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | \u003e4.27 |\n| \u003ca name=\"provider_aws.external_vault\"\u003e\u003c/a\u003e [aws.external\\_vault](#provider\\_aws.external\\_vault) | \u003e4.27 |\n| \u003ca name=\"provider_aws.management\"\u003e\u003c/a\u003e [aws.management](#provider\\_aws.management) | \u003e4.27 |\n\n## Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_backup_vault\"\u003e\u003c/a\u003e [backup\\_vault](#module\\_backup\\_vault) | ./backup_vault | n/a |\n| \u003ca name=\"module_backup_vault_external\"\u003e\u003c/a\u003e [backup\\_vault\\_external](#module\\_backup\\_vault\\_external) | ./backup_vault | n/a |\n| \u003ca name=\"module_iam_role\"\u003e\u003c/a\u003e [iam\\_role](#module\\_iam\\_role) | ../identity_and_access_management/iam_role/ | n/a |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_backup_global_settings.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_global_settings) | resource |\n| [aws_backup_vault_policy.source_account_to_destination_account_vault_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_vault_policy) | resource |\n| [aws_kms_grant.kms_grant_external_vault](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_grant) | resource |\n| [aws_organizations_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy) | resource |\n| [aws_organizations_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy_attachment) | resource |\n| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |\n| [aws_caller_identity.external_vault](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |\n| [aws_default_tags.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/default_tags) | data source |\n| [aws_iam_policy_document.source_account_to_destination_account_vault_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_backup_vault_kms_key_arn\"\u003e\u003c/a\u003e [backup\\_vault\\_kms\\_key\\_arn](#input\\_backup\\_vault\\_kms\\_key\\_arn) | Backup vault KMS key ARN to be used for internal and optional external vault. Required. | `string` | n/a | yes |\n| \u003ca name=\"input_enable_external_vault\"\u003e\u003c/a\u003e [enable\\_external\\_vault](#input\\_enable\\_external\\_vault) | This will create a mimic vault in the account provided by `aws.external_vault`. If set to false then `aws.external_vault` can be set to any account as it's not used. | `bool` | n/a | yes |\n| \u003ca name=\"input_external_backup_vault_kms_key_arn\"\u003e\u003c/a\u003e [external\\_backup\\_vault\\_kms\\_key\\_arn](#input\\_external\\_backup\\_vault\\_kms\\_key\\_arn) | External backup vault KMS key ARN to be used for external vault. If not set then value taken from `var.backup_vault_kms_key_arn` is used. This variable must be set to support cross-region setups. | `string` | `null` | no |\n| \u003ca name=\"input_immutable_vault\"\u003e\u003c/a\u003e [immutable\\_vault](#input\\_immutable\\_vault) | Make the local and (optional) external vault immutable to prevent deletion. Immutable vaults can never be deleted after 90 days. | `bool` | `true` | no |\n| \u003ca name=\"input_name\"\u003e\u003c/a\u003e [name](#input\\_name) | Name for several resources to allow this module to be reused within the same account. Must also be unique for any vaults in external accounts. Required | `string` | n/a | yes |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_backup_role_arn\"\u003e\u003c/a\u003e [backup\\_role\\_arn](#output\\_backup\\_role\\_arn) | n/a |\n\u003c!-- END_TF_DOCS --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwearetechnative%2Fterraform-aws-organization-backup","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwearetechnative%2Fterraform-aws-organization-backup","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwearetechnative%2Fterraform-aws-organization-backup/lists"}