Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.
Awesome Lists | Featured Topics | Projects
https://github.com/lgallard/terraform-aws-backup

Terraform module to create AWS Backup plans. AWS Backup is a fully managed backup service that makes it easy to centralize and automate the back up of data across AWS services (EBS volumes, RDS databases, DynamoDB tables, EFS file systems, and Storage Gateway volumes).
https://github.com/lgallard/terraform-aws-backup
aws aws-backup dynamodb dynamodb-backup ebs ebs-backup efs efs-backup rds rds-backup terraform
Last synced: about 2 months ago
JSON representation
Host: GitHub
URL: https://github.com/lgallard/terraform-aws-backup
Owner: lgallard
License: apache-2.0
Created: 2019-10-17T04:51:21.000Z (almost 5 years ago)
Default Branch: master
Last Pushed: 2024-05-03T20:55:34.000Z (5 months ago)
Last Synced: 2024-06-12T10:34:26.379Z (3 months ago)
Topics: aws, aws-backup, dynamodb, dynamodb-backup, ebs, ebs-backup, efs, efs-backup, rds, rds-backup, terraform
Language: HCL
Homepage:
Size: 136 KB
Stars: 133
Watchers: 9
Forks: 61
Open Issues: 0
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE
Awesome Lists containing this project

README

        ![Terraform](https://lgallardo.com/images/terraform.jpg)

# terraform-aws-backup

Terraform module to create [AWS Backup](https://aws.amazon.com/backup/) plans.  AWS Backup is a fully managed backup service that makes it easy to centralize and automate the back up of data across AWS services (EBS volumes, RDS databases, DynamoDB tables, EFS file systems, and Storage Gateway volumes).

## Usage

You can use this module to create a simple plan using the module's `rule_*` variables. You can also  use the `rules` and `selections` list of maps variables to build a more complete plan by defining several rules and selections at once.

Check the [examples](examples/) for the **simple plan**, **complete plan**, **simple plan using variables** and the **selection by tags plan** snippets.

### Example (complete plan)

This example creates a plan with two rules and two selections at once. It also defines a vault key which is used by the first rule because no `target_vault_name` was given (null). Whereas the second rule is using the "Default" vault key.

The first selection has two assignments, the first defined by a resource ARN and the second one defined by a tag condition. The second selection has just one assignment defined by a resource ARN.

```

module "aws_backup_example" {

  source = "lgallard/backup/aws"

  # Vault

  vault_name = "vault-3"

  # Plan

  plan_name = "complete-plan"

  # Notifications

  notifications = {

    sns_topic_arn       = aws_sns_topic.backup_vault_notifications.arn

    backup_vault_events = ["BACKUP_JOB_STARTED", "BACKUP_JOB_COMPLETED", "BACKUP_JOB_FAILED", "RESTORE_JOB_COMPLETED"]

  }

  # Multiple rules using a list of maps

  rules = [

    {

      name                     = "rule-1"

      schedule                 = "cron(0 12 * * ? *)"

      target_vault_name        = null

      start_window             = 120

      completion_window        = 360

      enable_continuous_backup = true

      lifecycle = {

        cold_storage_after = 0

        delete_after       = 30

      },

      copy_actions = [

        {

          lifecycle = {

            cold_storage_after = 0

            delete_after       = 90

          },

          destination_vault_arn = "arn:aws:backup:us-west-2:123456789101:backup-vault:Default"

        },

      ]

      recovery_point_tags = {

        Environment = "production"

      }

    },

    {

      name                = "rule-2"

      schedule            = "cron(0 7 * * ? *)"

      target_vault_name   = "Default"

      schedule            = null

      start_window        = 120

      completion_window   = 360

      lifecycle           = {}

      copy_action         = {}

      recovery_point_tags = {}

    },

  ]

  # Multiple selections

  #  - Selection-1: By resources and tag

  #  - Selection-2: Only by resources

  #  - Selection-3: By resources and conditions

  selections = [

    {

      name      = "selection-1"

      resources     = ["arn:aws:dynamodb:us-east-1:123456789101:table/mydynamodb-table1"]

      not_resources = []

      selection_tags = [

        {

          type  = "STRINGEQUALS"

          key   = "Environment"

          value = "production"

        },

        {

          type  = "STRINGEQUALS"

          key   = "Owner"

          value = "production"

        }

      ]

    },

    {

      name      = "selection-2"

      resources = ["arn:aws:dynamodb:us-east-1:123456789101:table/mydynamodb-table2"]

    },

    {

      name          = "selection-3"

      resources     = ["arn:aws:dynamodb:us-east-1:123456789101:table/mydynamodb-table3"]

      not_resources = []

      conditions = {

        string_equals = [

          {

            key   = "aws:ResourceTag/Component"

            value = "rds"

          }

          ,

          {

            key   = "aws:ResourceTag/Project"

            value = "Project1"

          }

        ]

        string_like = [

          {

            key   = "aws:ResourceTag/Application"

            value = "app*"

          }

        ]

        string_not_equals = [

          {

            key   = "aws:ResourceTag/Backup"

            value = "false"

          }

        ]

        string_not_like = [

          {

            key   = "aws:ResourceTag/Environment"

            value = "test*"

          }

        ]

      }

    }

  ]

  tags = {

    Owner       = "backup team"

    Environment = "production"

    Terraform   = true

  }

}

```

## Requirements

| Name | Version |

|------|---------|

|  [terraform](#requirement\_terraform) | >= 0.12.31 |

|  [aws](#requirement\_aws) | >= 4.26 |

## Providers

| Name | Version |

|------|---------|

|  [aws](#provider\_aws) | 5.15.0 |

## Modules

No modules.

## Resources

| Name | Type |

|------|------|

| [aws_backup_plan.ab_plan](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_plan) | resource |

| [aws_backup_report_plan.ab_report](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_report_plan) | resource |

| [aws_backup_selection.ab_selection](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_selection) | resource |

| [aws_backup_vault.ab_vault](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_vault) | resource |

| [aws_backup_vault_lock_configuration.ab_vault_lock_configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_vault_lock_configuration) | resource |

| [aws_backup_vault_notifications.backup_events](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_vault_notifications) | resource |

| [aws_iam_policy.ab_tag_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |

| [aws_iam_role.ab_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |

| [aws_iam_role_policy_attachment.ab_backup_s3_policy_attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |

| [aws_iam_role_policy_attachment.ab_policy_attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |

| [aws_iam_role_policy_attachment.ab_restores_policy_attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |

| [aws_iam_role_policy_attachment.ab_restores_s3_policy_attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |

| [aws_iam_role_policy_attachment.ab_tag_policy_attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |

| [aws_sns_topic_policy.backup_events](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_policy) | resource |

| [aws_iam_policy_document.ab_role_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

| [aws_iam_policy_document.ab_tag_policy_document](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

| [aws_iam_policy_document.backup_events](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |

## Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

|  [changeable\_for\_days](#input\_changeable\_for\_days) | The number of days before the lock date. If omitted creates a vault lock in governance mode, otherwise it will create a vault lock in compliance mode | `number` | `null` | no |

|  [enabled](#input\_enabled) | Change to false to avoid deploying any AWS Backup resources | `bool` | `true` | no |

|  [iam\_role\_arn](#input\_iam\_role\_arn) | If configured, the module will attach this role to selections, instead of creating IAM resources by itself | `string` | `null` | no |

|  [iam\_role\_name](#input\_iam\_role\_name) | Allow to set IAM role name, otherwise use predefined default | `string` | `""` | no |

|  [locked](#input\_locked) | Change to true to add a lock configuration for the backup vault | `bool` | `false` | no |

|  [max\_retention\_days](#input\_max\_retention\_days) | The maximum retention period that the vault retains its recovery points | `number` | `null` | no |

|  [min\_retention\_days](#input\_min\_retention\_days) | The minimum retention period that the vault retains its recovery points | `number` | `null` | no |

|  [notifications](#input\_notifications) | Notification block which defines backup vault events and the SNS Topic ARN to send AWS Backup notifications to. Leave it empty to disable notifications | `any` | `{}` | no |

|  [notifications\_disable\_sns\_policy](#input\_notifications\_disable\_sns\_policy) | Disable the creation of the SNS policy. Enable if you need to manage the policy elsewhere. | `bool` | `false` | no |

|  [plan\_name](#input\_plan\_name) | The display name of a backup plan | `string` | `null` | no |

|  [reports](#input\_reports) | The default cache behavior for this distribution. | 
list(object({
    name               = string
    description        = optional(string, null)
    formats            = optional(list(string), null)
    s3_bucket_name     = string
    s3_key_prefix      = optional(string, null)
    report_template    = string
    accounts           = optional(list(string), null)
    organization_units = optional(list(string), null)
    regions            = optional(list(string), null)
    framework_arns     = optional(list(string), [])
  })) | `[]` | no |

|  [rule\_completion\_window](#input\_rule\_completion\_window) | The amount of time AWS Backup attempts a backup before canceling the job and returning an error | `number` | `null` | no |

|  [rule\_copy\_action\_destination\_vault\_arn](#input\_rule\_copy\_action\_destination\_vault\_arn) | An Amazon Resource Name (ARN) that uniquely identifies the destination backup vault for the copied backup. | `string` | `null` | no |

|  [rule\_copy\_action\_lifecycle](#input\_rule\_copy\_action\_lifecycle) | The lifecycle defines when a protected resource is copied over to a backup vault and when it expires. | `map(any)` | `{}` | no |

|  [rule\_enable\_continuous\_backup](#input\_rule\_enable\_continuous\_backup) | Enable continuous backups for supported resources. | `bool` | `false` | no |

|  [rule\_lifecycle\_cold\_storage\_after](#input\_rule\_lifecycle\_cold\_storage\_after) | Specifies the number of days after creation that a recovery point is moved to cold storage | `number` | `null` | no |

|  [rule\_lifecycle\_delete\_after](#input\_rule\_lifecycle\_delete\_after) | Specifies the number of days after creation that a recovery point is deleted. Must be 90 days greater than `cold_storage_after` | `number` | `null` | no |

|  [rule\_name](#input\_rule\_name) | An display name for a backup rule | `string` | `null` | no |

|  [rule\_recovery\_point\_tags](#input\_rule\_recovery\_point\_tags) | Metadata that you can assign to help organize the resources that you create | `map(string)` | `{}` | no |

|  [rule\_schedule](#input\_rule\_schedule) | A CRON expression specifying when AWS Backup initiates a backup job | `string` | `null` | no |

|  [rule\_start\_window](#input\_rule\_start\_window) | The amount of time in minutes before beginning a backup | `number` | `null` | no |

|  [rules](#input\_rules) | A list of rule maps | `any` | `[]` | no |

|  [selection\_conditions](#input\_selection\_conditions) | A map of conditions that you define to assign resources to your backup plans using tags. | `map(any)` | `{}` | no |

|  [selection\_name](#input\_selection\_name) | The display name of a resource selection document | `string` | `null` | no |

|  [selection\_not\_resources](#input\_selection\_not\_resources) | An array of strings that either contain Amazon Resource Names (ARNs) or match patterns of resources to exclude from a backup plan. | `list(any)` | `[]` | no |

|  [selection\_resources](#input\_selection\_resources) | An array of strings that either contain Amazon Resource Names (ARNs) or match patterns of resources to assign to a backup plan | `list(any)` | `[]` | no |

|  [selection\_tags](#input\_selection\_tags) | List of tags for `selection_name` var, when using variable definition. | `list(any)` | `[]` | no |

|  [selections](#input\_selections) | A list of selction maps | `any` | `[]` | no |

|  [tags](#input\_tags) | A mapping of tags to assign to the resource | `map(string)` | `{}` | no |

|  [vault\_force\_destroy](#input\_vault\_force\_destroy) | A boolean that indicates that all recovery points stored in the vault are deleted so that the vault can be destroyed without error. | `bool` | `false` | no |

|  [vault\_kms\_key\_arn](#input\_vault\_kms\_key\_arn) | The server-side encryption key that is used to protect your backups | `string` | `null` | no |

|  [vault\_name](#input\_vault\_name) | Name of the backup vault to create. If not given, AWS use default | `string` | `null` | no |

|  [windows\_vss\_backup](#input\_windows\_vss\_backup) | Enable Windows VSS backup option and create a VSS Windows backup | `bool` | `false` | no |

## Outputs

| Name | Description |

|------|-------------|

|  [plan\_arn](#output\_plan\_arn) | The ARN of the backup plan |

|  [plan\_id](#output\_plan\_id) | The id of the backup plan |

|  [plan\_role](#output\_plan\_role) | The service role of the backup plan |

|  [plan\_version](#output\_plan\_version) | Unique, randomly generated, Unicode, UTF-8 encoded string that serves as the version ID of the backup plan |

|  [vault\_arn](#output\_vault\_arn) | The ARN of the vault |

|  [vault\_id](#output\_vault\_id) | The name of the vault |

## Know Issue:

### error creating Backup Vault

In case you get an error message similar to this one:

```

error creating Backup Vault (): AccessDeniedException: status code: 403, request id: 8e7e577e-5b74-4d4d-95d0-bf63e0b2cc2e,

```

Add the [required IAM permissions mentioned in the CreateBackupVault row](https://docs.aws.amazon.com/aws-backup/latest/devguide/access-control.html#backup-api-permissions-ref) to the role or user creating the Vault (the one running Terraform CLI). In particular make sure `kms` and `backup-storage` permissions are added.