feature/PI-407-immutable_backups Add dynamo backup plan config and remove restore plans

Author: megan-bower4

infrastructure/terraform/modules/aws-backup-source/backup_restore_testing.tf

@@ -1,26 +1,25 @@
-resource "awscc_backup_restore_testing_plan" "backup_restore_testing_plan" {
-  restore_testing_plan_name = "backup_restore_testing_plan"
-  schedule_expression       = var.restore_testing_plan_scheduled_expression
-  start_window_hours        = var.restore_testing_plan_start_window
-  recovery_point_selection = {
-    algorithm             = var.restore_testing_plan_algorithm
-    include_vaults        = [aws_backup_vault.main.arn]
-    recovery_point_types  = var.restore_testing_plan_recovery_point_types
-    selection_window_days = var.restore_testing_plan_selection_window_days
-  }
-}
+# resource "awscc_backup_restore_testing_plan" "backup_restore_testing_plan" {
+#   restore_testing_plan_name = "backup_restore_testing_plan"
+#   schedule_expression       = var.restore_testing_plan_scheduled_expression
+#   start_window_hours        = var.restore_testing_plan_start_window
+#   recovery_point_selection = {
+#     algorithm             = var.restore_testing_plan_algorithm
+#     include_vaults        = [aws_backup_vault.main.arn]
+#     recovery_point_types  = var.restore_testing_plan_recovery_point_types
+#     selection_window_days = var.restore_testing_plan_selection_window_days
+#   }
+# }
 
-resource "awscc_backup_restore_testing_selection" "backup_restore_testing_selection_dynamodb" {
-  count                          = var.backup_plan_config_dynamodb.enable ? 1 : 0
-  iam_role_arn                   = aws_iam_role.backup.arn
-  protected_resource_type        = "DynamoDB"
-  restore_testing_plan_name      = awscc_backup_restore_testing_plan.backup_restore_testing_plan.restore_testing_plan_name
-  restore_testing_selection_name = "backup_restore_testing_selection_dynamodb"
-  protected_resource_arns        = ["*"]
-  protected_resource_conditions = {
-    string_equals = [{
-      key   = "aws:ResourceTag/${var.backup_plan_config_dynamodb.selection_tag}"
-      value = "True"
-    }]
-  }
-}
+# resource "awscc_backup_restore_testing_selection" "backup_restore_testing_selection_dynamodb" {
+#   count                          = var.backup_plan_config_dynamodb.enable ? 1 : 0
+#   iam_role_arn                   = aws_iam_role.backup.arn
+#   protected_resource_type        = "DynamoDB"
+#   restore_testing_plan_name      = awscc_backup_restore_testing_plan.backup_restore_testing_plan.restore_testing_plan_name
+#   restore_testing_selection_name = "backup_restore_testing_selection_dynamodb"
+#   protected_resource_conditions = {
+#     string_equals = [{
+#       key   = "aws:ResourceTag/${var.backup_plan_config_dynamodb.selection_tag}"
+#       value = "True"
+#     }]
+#   }
+# }

infrastructure/terraform/modules/aws-backup-source/iam.tf

@@ -36,6 +36,11 @@ resource "aws_iam_role_policy_attachment" "s3_backup" {
   role       = aws_iam_role.backup.name
 }
 
+resource "aws_iam_role_policy_attachment" "backup_full_access" {
+  policy_arn = "arn:aws:iam::aws:policy/AWSBackupFullAccess"
+  role       = aws_iam_role.backup.name
+}
+
 
 resource "aws_iam_policy" "restore_testing_selection_permissions" {
   name = "${local.resource_name_prefix}-source-account-backup-permissions"
@@ -49,7 +54,7 @@ resource "aws_iam_policy" "restore_testing_selection_permissions" {
           "cloudformation:*"
         ],
         Resource = "*"
-      }
+      },
     ]
   })
 }

infrastructure/terraform/per_account/dev/aws-backups.tf

@@ -102,4 +102,24 @@ module "source" {
     ],
     "selection_tag" : "NHSE-Enable-Backup"
   }
+
+  backup_plan_config_dynamodb = {
+    "enable" : true,
+    "compliance_resource_types" : [
+      "DynamoDB"
+    ],
+    "rules" : [
+      {
+        "copy_action" : {
+          "delete_after" : 4
+        },
+        "lifecycle" : {
+          "delete_after" : 2
+        },
+        "name" : "daily_kept_for_2_days",
+        "schedule" : "cron(0 0 * * ? *)"
+      }
+    ],
+    "selection_tag" : "NHSE-Enable-Backup"
+  }
 }

infrastructure/terraform/per_account/dev/terraform.tf

@@ -25,5 +25,9 @@ terraform {
       source  = "hashicorp/local"
       version = "~> 2.0"
     }
+    awscc = {
+      source  = "hashicorp/awscc"
+      version = "~> 1.32.0"
+    }
   }
 }