Skip to content

Commit 0b5b621

Browse files
megan-bower4megan-bower4
committed
feature/PI-407-immutable_backups Enable source backup module without s3 or dynamo backups enabled
1 parent 9775b26 commit 0b5b621

File tree

3 files changed

+135
-203
lines changed

3 files changed

+135
-203
lines changed

‎infrastructure/terraform/modules/aws-backup-source/backup_plan.tf‎

Lines changed: 0 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,3 @@
1-
resource "aws_backup_plan" "default" {
2-
name = "${local.resource_name_prefix}-plan"
3-
4-
dynamic "rule" {
5-
for_each = var.backup_plan_config.rules
6-
content {
7-
recovery_point_tags = {
8-
backup_rule_name = rule.value.name
9-
}
10-
rule_name = rule.value.name
11-
target_vault_name = aws_backup_vault.main.name
12-
schedule = rule.value.schedule
13-
enable_continuous_backup = rule.value.enable_continuous_backup != null ? rule.value.enable_continuous_backup : null
14-
lifecycle {
15-
delete_after = rule.value.lifecycle.delete_after != null ? rule.value.lifecycle.delete_after : null
16-
cold_storage_after = rule.value.lifecycle.cold_storage_after != null ? rule.value.lifecycle.cold_storage_after : null
17-
}
18-
dynamic "copy_action" {
19-
for_each = var.backup_copy_vault_arn != "" && var.backup_copy_vault_account_id != "" && rule.value.copy_action != null ? rule.value.copy_action : {}
20-
content {
21-
lifecycle {
22-
delete_after = copy_action.value
23-
}
24-
destination_vault_arn = var.backup_copy_vault_arn
25-
}
26-
}
27-
}
28-
}
29-
}
30-
311
# this backup plan shouldn't include a continous backup rule as it isn't supported for DynamoDB
322
resource "aws_backup_plan" "dynamodb" {
333
count = var.backup_plan_config_dynamodb.enable ? 1 : 0
@@ -59,18 +29,6 @@ resource "aws_backup_plan" "dynamodb" {
5929
}
6030
}
6131

62-
resource "aws_backup_selection" "default" {
63-
iam_role_arn = aws_iam_role.backup.arn
64-
name = "${local.resource_name_prefix}-selection"
65-
plan_id = aws_backup_plan.default.id
66-
67-
selection_tag {
68-
key = var.backup_plan_config.selection_tag
69-
type = "STRINGEQUALS"
70-
value = "True"
71-
}
72-
}
73-
7432
resource "aws_backup_selection" "dynamodb" {
7533
count = var.backup_plan_config_dynamodb.enable ? 1 : 0
7634
iam_role_arn = aws_iam_role.backup.arn

‎infrastructure/terraform/modules/aws-backup-source/iam.tf‎

Lines changed: 27 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -26,40 +26,31 @@ resource "aws_iam_role_policy_attachment" "restore" {
2626
role = aws_iam_role.backup.name
2727
}
2828

29-
resource "aws_iam_role_policy_attachment" "s3_restore" {
30-
policy_arn = "arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForS3Restore"
31-
role = aws_iam_role.backup.name
32-
}
3329

34-
resource "aws_iam_role_policy_attachment" "s3_backup" {
35-
policy_arn = "arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForS3Backup"
36-
role = aws_iam_role.backup.name
37-
}
38-
39-
resource "aws_iam_role_policy_attachment" "backup_full_access" {
40-
policy_arn = "arn:aws:iam::aws:policy/AWSBackupFullAccess"
41-
role = aws_iam_role.backup.name
42-
}
43-
44-
45-
resource "aws_iam_policy" "restore_testing_selection_permissions" {
46-
name = "${local.resource_name_prefix}-source-account-backup-permissions"
47-
policy = jsonencode({
48-
Version = "2012-10-17",
49-
Statement = [
50-
{
51-
Effect = "Allow",
52-
Action = [
53-
"backup:*",
54-
"cloudformation:*"
55-
],
56-
Resource = "*"
57-
},
58-
]
59-
})
60-
}
61-
62-
resource "aws_iam_role_policy_attachment" "source_account_backup_permissions" {
63-
policy_arn = aws_iam_policy.restore_testing_selection_permissions.arn
64-
role = aws_iam_role.backup.name
65-
}
30+
# resource "aws_iam_role_policy_attachment" "backup_full_access" {
31+
# policy_arn = "arn:aws:iam::aws:policy/AWSBackupFullAccess"
32+
# role = aws_iam_role.backup.name
33+
# }
34+
35+
36+
# resource "aws_iam_policy" "restore_testing_selection_permissions" {
37+
# name = "${local.resource_name_prefix}-source-account-backup-permissions"
38+
# policy = jsonencode({
39+
# Version = "2012-10-17",
40+
# Statement = [
41+
# {
42+
# Effect = "Allow",
43+
# Action = [
44+
# "backup:*",
45+
# "cloudformation:*"
46+
# ],
47+
# Resource = "*"
48+
# },
49+
# ]
50+
# })
51+
# }
52+
53+
# resource "aws_iam_role_policy_attachment" "source_account_backup_permissions" {
54+
# policy_arn = aws_iam_policy.restore_testing_selection_permissions.arn
55+
# role = aws_iam_role.backup.name
56+
# }

‎infrastructure/terraform/per_account/dev/aws-backups.tf‎

Lines changed: 108 additions & 125 deletions
Original file line numberDiff line numberDiff line change
@@ -1,125 +1,108 @@
1-
# data "aws_secretsmanager_secret" "destination_vault_arn" {
2-
# name = "destination_vault_arn"
3-
# }
4-
5-
# data "aws_secretsmanager_secret_version" "destination_vault_arn" {
6-
# secret_id = data.aws_secretsmanager_secret.destination_vault_arn.id
7-
# }
8-
9-
# data "aws_secretsmanager_secret" "destination_account_id" {
10-
# name = "destination_account_id"
11-
# }
12-
13-
# data "aws_secretsmanager_secret_version" "destination_account_id" {
14-
# secret_id = data.aws_secretsmanager_secret.destination_account_id.id
15-
# }
16-
17-
# # First, we create an S3 bucket for compliance reports. You may already have a module for creating
18-
# # S3 buckets with more refined access rules, which you may prefer to use.
19-
20-
# resource "aws_s3_bucket" "backup_reports" {
21-
# bucket_prefix = "${local.project}-backup-reports"
22-
# }
23-
24-
# # Now we have to configure access to the report bucket.
25-
26-
# resource "aws_s3_bucket_ownership_controls" "backup_reports" {
27-
# bucket = aws_s3_bucket.backup_reports.id
28-
# rule {
29-
# object_ownership = "BucketOwnerPreferred"
30-
# }
31-
# }
32-
33-
# resource "aws_s3_bucket_acl" "backup_reports" {
34-
# depends_on = [aws_s3_bucket_ownership_controls.backup_reports]
35-
36-
# bucket = aws_s3_bucket.backup_reports.id
37-
# acl = "private"
38-
# }
39-
40-
# # We need a key for the SNS topic that will be used for notifications from AWS Backup. This key
41-
# # will be used to encrypt the messages sent to the topic before they are sent to the subscribers,
42-
# # but isn't needed by the recipients of the messages.
43-
44-
45-
# # Now we can define the key itself
46-
# resource "aws_kms_key" "backup_notifications" {
47-
# description = "KMS key for AWS Backup notifications"
48-
# deletion_window_in_days = 7
49-
# enable_key_rotation = true
50-
# policy = jsonencode({
51-
# Version = "2012-10-17"
52-
# Statement = [
53-
# {
54-
# Effect = "Allow"
55-
# Sid = "Enable IAM User Permissions"
56-
# Principal = {
57-
# AWS = "arn:aws:iam::${var.assume_account}:root"
58-
# }
59-
# Action = "kms:*"
60-
# Resource = "*"
61-
# },
62-
# {
63-
# Effect = "Allow"
64-
# Principal = {
65-
# Service = "sns.amazonaws.com"
66-
# }
67-
# Action = ["kms:GenerateDataKey*", "kms:Decrypt"]
68-
# Resource = "*"
69-
# },
70-
# ]
71-
# })
72-
# }
73-
74-
# # Now we can deploy the source and destination modules, referencing the resources we've created above.
75-
76-
# module "source" {
77-
# source = "../../modules/aws-backup-source"
78-
79-
# backup_copy_vault_account_id = data.aws_secretsmanager_secret_version.destination_account_id.secret_string
80-
# backup_copy_vault_arn = data.aws_secretsmanager_secret_version.destination_vault_arn.secret_string
81-
# environment_name = var.environment
82-
# bootstrap_kms_key_arn = aws_kms_key.backup_notifications.arn
83-
# project_name = local.project
84-
# reports_bucket = aws_s3_bucket.backup_reports.bucket
85-
# terraform_role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
86-
87-
# backup_plan_config = {
88-
# "compliance_resource_types" : [
89-
# "S3"
90-
# ],
91-
# "rules" : [
92-
# {
93-
# "copy_action" : {
94-
# "delete_after" : 4
95-
# },
96-
# "lifecycle" : {
97-
# "delete_after" : 2
98-
# },
99-
# "name" : "daily_kept_for_2_days",
100-
# "schedule" : "cron(0 0 * * ? *)"
101-
# }
102-
# ],
103-
# "selection_tag" : "NHSE-Enable-Backup"
104-
# }
105-
106-
# backup_plan_config_dynamodb = {
107-
# "enable" : true,
108-
# "compliance_resource_types" : [
109-
# "DynamoDB"
110-
# ],
111-
# "rules" : [
112-
# {
113-
# "copy_action" : {
114-
# "delete_after" : 4
115-
# },
116-
# "lifecycle" : {
117-
# "delete_after" : 2
118-
# },
119-
# "name" : "daily_kept_for_2_days",
120-
# "schedule" : "cron(0 0 * * ? *)"
121-
# }
122-
# ],
123-
# "selection_tag" : "NHSE-Enable-Backup"
124-
# }
125-
# }
1+
data "aws_secretsmanager_secret" "destination_vault_arn" {
2+
name = "destination_vault_arn"
3+
}
4+
5+
data "aws_secretsmanager_secret_version" "destination_vault_arn" {
6+
secret_id = data.aws_secretsmanager_secret.destination_vault_arn.id
7+
}
8+
9+
data "aws_secretsmanager_secret" "destination_account_id" {
10+
name = "destination_account_id"
11+
}
12+
13+
data "aws_secretsmanager_secret_version" "destination_account_id" {
14+
secret_id = data.aws_secretsmanager_secret.destination_account_id.id
15+
}
16+
17+
# First, we create an S3 bucket for compliance reports. You may already have a module for creating
18+
# S3 buckets with more refined access rules, which you may prefer to use.
19+
20+
resource "aws_s3_bucket" "backup_reports" {
21+
bucket_prefix = "${local.project}-backup-reports"
22+
}
23+
24+
# Now we have to configure access to the report bucket.
25+
26+
resource "aws_s3_bucket_ownership_controls" "backup_reports" {
27+
bucket = aws_s3_bucket.backup_reports.id
28+
rule {
29+
object_ownership = "BucketOwnerPreferred"
30+
}
31+
}
32+
33+
resource "aws_s3_bucket_acl" "backup_reports" {
34+
depends_on = [aws_s3_bucket_ownership_controls.backup_reports]
35+
36+
bucket = aws_s3_bucket.backup_reports.id
37+
acl = "private"
38+
}
39+
40+
# We need a key for the SNS topic that will be used for notifications from AWS Backup. This key
41+
# will be used to encrypt the messages sent to the topic before they are sent to the subscribers,
42+
# but isn't needed by the recipients of the messages.
43+
44+
45+
# Now we can define the key itself
46+
resource "aws_kms_key" "backup_notifications" {
47+
description = "KMS key for AWS Backup notifications"
48+
deletion_window_in_days = 7
49+
enable_key_rotation = true
50+
policy = jsonencode({
51+
Version = "2012-10-17"
52+
Statement = [
53+
{
54+
Effect = "Allow"
55+
Sid = "Enable IAM User Permissions"
56+
Principal = {
57+
AWS = "arn:aws:iam::${var.assume_account}:root"
58+
}
59+
Action = "kms:*"
60+
Resource = "*"
61+
},
62+
{
63+
Effect = "Allow"
64+
Principal = {
65+
Service = "sns.amazonaws.com"
66+
}
67+
Action = ["kms:GenerateDataKey*", "kms:Decrypt"]
68+
Resource = "*"
69+
},
70+
]
71+
})
72+
}
73+
74+
# Now we can deploy the source and destination modules, referencing the resources we've created above.
75+
76+
module "source" {
77+
source = "../../modules/aws-backup-source"
78+
79+
backup_copy_vault_account_id = data.aws_secretsmanager_secret_version.destination_account_id.secret_string
80+
backup_copy_vault_arn = data.aws_secretsmanager_secret_version.destination_vault_arn.secret_string
81+
environment_name = var.environment
82+
bootstrap_kms_key_arn = aws_kms_key.backup_notifications.arn
83+
project_name = local.project
84+
reports_bucket = aws_s3_bucket.backup_reports.bucket
85+
terraform_role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
86+
87+
88+
# disable all backups for now - just deploy the vault
89+
backup_plan_config = {
90+
"compliance_resource_types" : [
91+
"S3"
92+
],
93+
"rules" : [
94+
],
95+
"enable" : false,
96+
"selection_tag" : "NHSE-Enable-Backup"
97+
}
98+
99+
backup_plan_config_dynamodb = {
100+
"compliance_resource_types" : [
101+
"DynamoDB"
102+
],
103+
"rules" : [
104+
],
105+
"enable" : false,
106+
"selection_tag" : "NHSE-Enable-Backup"
107+
}
108+
}

0 commit comments

Comments
 (0)