https://github.com/geekcell/terraform-aws-backup
Terraform module to provision an AWS Backup.
https://github.com/geekcell/terraform-aws-backup
aws backup terraform terraform-module
Last synced: 2 months ago
JSON representation
Terraform module to provision an AWS Backup.
- Host: GitHub
- URL: https://github.com/geekcell/terraform-aws-backup
- Owner: geekcell
- License: apache-2.0
- Created: 2022-11-10T14:22:04.000Z (over 3 years ago)
- Default Branch: main
- Last Pushed: 2023-11-06T10:59:09.000Z (over 2 years ago)
- Last Synced: 2025-03-01T18:48:51.915Z (over 1 year ago)
- Topics: aws, backup, terraform, terraform-module
- Language: HCL
- Homepage: https://www.geekcell.io
- Size: 39.1 KB
- Stars: 0
- Watchers: 3
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
[](https://www.geekcell.io/)
### Code Quality
[](https://github.com/geekcell/terraform-aws-backup/blob/master/LICENSE)
[](https://github.com/geekcell/terraform-aws-backup/releases)
[](https://github.com/geekcell/terraform-aws-backup/actions/workflows/release.yaml)
[](https://github.com/geekcell/terraform-aws-backup/actions/workflows/validate.yaml)
[](https://github.com/geekcell/terraform-aws-backup/actions/workflows/linter.yaml)
[](https://github.com/geekcell/terraform-aws-backup/actions/workflows/test.yaml)
### Security
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=INFRASTRUCTURE+SECURITY)
#### Cloud
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=CIS+AWS+V1.2)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=CIS+AWS+V1.3)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=CIS+AZURE+V1.1)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=CIS+AZURE+V1.3)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=CIS+GCP+V1.1)
##### Container
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=CIS+KUBERNETES+V1.6)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=CIS+EKS+V1.1)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=CIS+GKE+V1.1)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=CIS+KUBERNETES+V1.5)
#### Data protection
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=SOC2)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=PCI-DSS+V3.2)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=PCI-DSS+V3.2.1)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=ISO27001)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=NIST-800-53)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=HIPAA)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=geekcell%2Fterraform-aws-backup&benchmark=FEDRAMP+%28MODERATE%29)
# Terraform AWS Backup
This Terraform module provides a preconfigured solution for setting up
AWS Backup in your AWS account. With this module, you can easily and
efficiently create and manage backups for your AWS resources. Our
team has extensive experience working with AWS Backup and has optimized
this module to provide the best possible experience for users.
Using this Terraform module, you can save time and effort in setting up
and managing your backup policies, as well as avoid common mistakes and
pitfalls. The module encapsulates all necessary configurations, making
it easy to use and integrate into your existing AWS environment. Whether
you are looking to add backup protection for your critical resources or
streamline your existing backup processes, this Terraform module is a
great choice.
## Inputs
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| [changeable\_for\_days](#input\_changeable\_for\_days) | The number of days before the lock date. If omitted creates a vault lock in governance mode, otherwise it will create
a vault lock in compliance mode. When you apply this setting:
The vault will become immutable in 3 days after applying. You have 3 days of grace time to manage or delete the vault
lock before it becomes immutable. During this time, only those users with specific IAM permissions can make changes.
Once the vault is locked in compliance mode, it cannot be managed or deleted by anyone, even the root user or AWS.
The only way to deactivate the lock is to terminate the account, which will delete all the backups.
Since you cannot delete the Vault, it will be charged for backups until that date. Be careful! | `number` | `null` | no |
| [create\_backup\_vault](#input\_create\_backup\_vault) | Whether to create a backup vault or use a pre-existing one. | `bool` | `true` | no |
| [custom\_rules](#input\_custom\_rules) | Backup rules to add to the AWS Backup Vault. See examples for usage. |
list(object({
name = string
schedule = optional(string)
start_window = optional(number)
completion_window = optional(number)
enable_continuous_backup = optional(bool)
recovery_point_tags = optional(map(string), {})
lifecycle = optional(object({
cold_storage_after = optional(number)
delete_after = optional(number)
}))
copy_action = optional(object({
destination_vault_arn = optional(string)
lifecycle = optional(object({
cold_storage_after = optional(number)
delete_after = optional(number)
}))
}))
})) | `[]` | no |
| [enable\_customer\_managed\_kms](#input\_enable\_customer\_managed\_kms) | Whether to enable customer managed KMS encryption for the backup vault. | `bool` | `false` | no |
| [enable\_vault\_lock](#input\_enable\_vault\_lock) | Whether to enable Vault Lock for the backup vault. | `bool` | `false` | no |
| [enable\_windows\_vss\_backup](#input\_enable\_windows\_vss\_backup) | Whether to enable Windows VSS backup for the backup plan. | `bool` | `false` | no |
| [kms\_key\_id](#input\_kms\_key\_id) | The ARN of the KMS Key to use to encrypt your backups. If left empty, the default AWS KMS will be used. | `string` | `null` | no |
| [max\_retention\_days](#input\_max\_retention\_days) | The maximum retention period that the vault retains its recovery points. | `number` | `365` | no |
| [min\_retention\_days](#input\_min\_retention\_days) | The minimum retention period that the vault retains its recovery points. | `number` | `7` | no |
| [plan\_name](#input\_plan\_name) | The display name of the backup plan. | `string` | n/a | yes |
| [predefined\_rules](#input\_predefined\_rules) | A list of predefined backup rules to add to the AWS Backup Plan. See examples for usage. | `list(string)` | `[]` | no |
| [role\_arn](#input\_role\_arn) | The ARN of the IAM role that AWS Backup uses to authenticate when restoring or backing up the target resources. If left empty, a default role will be created. | `string` | `null` | no |
| [selections](#input\_selections) | An array of strings that either contain Amazon Resource Names (ARNs) or match patterns of resources to assign to a backup plan. | list(object({
name = string
role_arn = optional(string)
arns = optional(list(string))
tag = optional(object({
type = string
key = string
value = string
}))
})) | `[]` | no |
| [tags](#input\_tags) | Tags to add to the AWS Backup. | `map(any)` | `{}` | no |
| [vault\_force\_destroy](#input\_vault\_force\_destroy) | Whether to allow the backup vault to be destroyed even if it contains recovery points. | `string` | `false` | no |
| [vault\_name](#input\_vault\_name) | Name of the backup vault to create or use and existing one. | `string` | n/a | yes |
## Outputs
| Name | Description |
|------|-------------|
| [backup\_plan\_arn](#output\_backup\_plan\_arn) | The ARN of the backup plan. |
| [backup\_plan\_id](#output\_backup\_plan\_id) | The ID of the backup plan. |
| [backup\_vault\_arn](#output\_backup\_vault\_arn) | The ARN of the backup vault. |
| [backup\_vault\_id](#output\_backup\_vault\_id) | The ID of the backup vault. |
## Providers
| Name | Version |
|------|---------|
| [aws](#provider\_aws) | >= 4.36 |
## Resources
- resource.aws_backup_plan.main (main.tf#53)
- resource.aws_backup_selection.main (main.tf#113)
- resource.aws_backup_vault.main (main.tf#33)
- resource.aws_backup_vault_lock_configuration.main (main.tf#43)
- data source.aws_backup_vault.main (main.tf#27)
# Examples
### Basic Example
```hcl
module "basic-example" {
source = "../../"
vault_name = "my-project"
plan_name = "customer-data"
selections = [
{
name = "s3-buckets"
arns = ["arn:aws:s3:::my-bucket", "arn:aws:s3:::my-other-bucket"]
},
{
name = "db-snaps"
arns = ["arn:aws:rds:us-east-2:123456789012:db:my-mysql-instance"]
}
]
}
```
### With Rules
```hcl
module "with-rules" {
source = "../../"
vault_name = "my-project"
plan_name = "customer-data"
predefined_rules = ["daily-snapshot", "monthly-snapshot"]
custom_rules = [
{
name = "my-custom-rule"
schedule = "cron(0 3 ? * 2,3,4,5,6,7,1 *)"
start_window = 60
completion_window = 240
enable_continuous_backup = false
lifecycle = {
cold_storage_after = 1
delete_after = 180 # half a year
}
}
]
selections = [
{
name = "s3-buckets"
arns = ["arn:aws:s3:::my-bucket", "arn:aws:s3:::my-other-bucket"]
},
{
name = "db-snaps"
arns = ["arn:aws:rds:us-east-2:123456789012:db:my-mysql-instance"]
}
]
}
```
# Predefined Rules
```hcl
locals {
predefined_rules = [
# At 03:00 AM UTC, daily
{
name = "daily-snapshot"
schedule = "cron(0 3 ? * * *)"
start_window = 60
completion_window = 240
enable_continuous_backup = true
recovery_point_tags = {}
lifecycle = {
cold_storage_after = null
delete_after = 35 # 5 weeks
}
copy_action = null
},
# At 03:00 AM UTC, every Sunday
{
name = "weekly-snapshot"
schedule = "cron(0 3 ? * SUN *)"
start_window = 60
completion_window = 240
enable_continuous_backup = true
recovery_point_tags = {}
lifecycle = {
cold_storage_after = null
delete_after = 183 # 6 months
}
copy_action = null
},
# At 03:00 AM UTC, on day 1 of the month
{
name = "monthly-snapshot"
schedule = "cron(0 3 1 * ? *)"
start_window = 60
completion_window = 240
enable_continuous_backup = false
recovery_point_tags = {}
lifecycle = {
cold_storage_after = 1 # day
delete_after = 365 # 1 year
}
copy_action = null
},
# At 03:00 AM UTC, on day 1 of the month, only in January, April, July, and October
{
name = "quarterly-snapshot"
schedule = "cron(0 3 1 1,4,7,10 ? *)"
start_window = 60
completion_window = 240
enable_continuous_backup = false
recovery_point_tags = {}
lifecycle = {
cold_storage_after = 1 # day
delete_after = 730 # 2 years
}
copy_action = null
},
# At 03:00 AM UTC, on day 1 of the month, only in January
{
name = "yearly-snapshot"
schedule = "cron(0 3 1 1 ? *)"
start_window = 60
completion_window = 240
enable_continuous_backup = false
recovery_point_tags = {}
lifecycle = {
cold_storage_after = 1 # day
delete_after = 3650 # 10 years
}
copy_action = null
}
]
}
```