NRL-853 set up DynamoDB backup plan for weekly and monthly with transitions to cold storage

Author: katebobyn-nhs

terraform/account-wide-infrastructure/dev/aws-backup.tf

@@ -109,7 +109,7 @@ module "source" {
     "compliance_resource_types" : [
       "S3"
     ],
-    "enable" = true,
+    "enable" : true,
     "rules" : [
       {
         "copy_action" : {
@@ -132,14 +132,39 @@ module "source" {
     "enable" : true,
     "rules" : [
       {
+        "name" : "daily",
+        "schedule" : "cron(0 0 * * ? *)",
         "copy_action" : {
           "delete_after" : 4
         },
+
         "lifecycle" : {
           "delete_after" : 2
+        }
+      },
+      {
+        "name" : "monthly"
+        "schedule" : "cron(30 0 * * 4#1)" # first Thursday each month from 00:30
+        "copy_action" : {
+          "cold_storage_after" : 3,
+          "delete_after" : 100 # ensures there will always be min 3
         },
-        "name" : "daily_kept_for_2_days",
-        "schedule" : "cron(0 0 * * ? *)"
+        "lifecycle" : {
+          "delete_after" : 2
+        }
+
+      },
+      {
+        "name" : "weekly"               # overlaps with monthly
+        "schedule" : "cron(30 0 * * 4)" # every Thursday from 00:30 to precede releases
+        "copy_action" : {
+          "cold_storage_after" : 14 # ensures 2 warm including one from previous release
+          "delete_after" : 100
+        },
+        "lifecycle" : {
+          "delete_after" : 2
+        }
+
       }
     ],
     "selection_tag" : "NHSE-Enable-DDB-Backup"

terraform/account-wide-infrastructure/modules/backup-source/backup_plan.tf

@@ -20,7 +20,8 @@ resource "aws_backup_plan" "default" {
         for_each = rule.value.copy_action != null ? rule.value.copy_action : {}
         content {
           lifecycle {
-            delete_after = copy_action.value
+            delete_after       = copy_action.value.lifecycle.delete_after
+            cold_storage_after = copy_action.value.lifecycle.cold_storage_after
           }
           destination_vault_arn = var.backup_copy_vault_arn
         }
@@ -51,7 +52,8 @@ resource "aws_backup_plan" "dynamodb" {
         for_each = rule.value.copy_action != null ? rule.value.copy_action : {}
         content {
           lifecycle {
-            delete_after = copy_action.value
+            delete_after       = copy_action.value.delete_after
+            cold_storage_after = copy_action.value.cold_storage_after
           }
           destination_vault_arn = var.backup_copy_vault_arn
         }

terraform/account-wide-infrastructure/modules/backup-source/variables.tf

@@ -107,7 +107,8 @@ variable "backup_plan_config_dynamodb" {
         cold_storage_after = optional(number)
       })
       copy_action = optional(object({
-        delete_after = optional(number)
+        delete_after       = optional(number)
+        cold_storage_after = optional(number)
       }))
     })))
   })