Skip to content

Commit 9775b26

Browse files
megan-bower4megan-bower4
committed
feature/PI-407-immutable_backups Remove backups moduleee
1 parent 6ee846d commit 9775b26

File tree

1 file changed

+125
-125
lines changed

1 file changed

+125
-125
lines changed

‎infrastructure/terraform/per_account/dev/aws-backups.tf‎

Lines changed: 125 additions & 125 deletions
Original file line numberDiff line numberDiff line change
@@ -1,125 +1,125 @@
1-
data "aws_secretsmanager_secret" "destination_vault_arn" {
2-
name = "destination_vault_arn"
3-
}
4-
5-
data "aws_secretsmanager_secret_version" "destination_vault_arn" {
6-
secret_id = data.aws_secretsmanager_secret.destination_vault_arn.id
7-
}
8-
9-
data "aws_secretsmanager_secret" "destination_account_id" {
10-
name = "destination_account_id"
11-
}
12-
13-
data "aws_secretsmanager_secret_version" "destination_account_id" {
14-
secret_id = data.aws_secretsmanager_secret.destination_account_id.id
15-
}
16-
17-
# First, we create an S3 bucket for compliance reports. You may already have a module for creating
18-
# S3 buckets with more refined access rules, which you may prefer to use.
19-
20-
resource "aws_s3_bucket" "backup_reports" {
21-
bucket_prefix = "${local.project}-backup-reports"
22-
}
23-
24-
# Now we have to configure access to the report bucket.
25-
26-
resource "aws_s3_bucket_ownership_controls" "backup_reports" {
27-
bucket = aws_s3_bucket.backup_reports.id
28-
rule {
29-
object_ownership = "BucketOwnerPreferred"
30-
}
31-
}
32-
33-
resource "aws_s3_bucket_acl" "backup_reports" {
34-
depends_on = [aws_s3_bucket_ownership_controls.backup_reports]
35-
36-
bucket = aws_s3_bucket.backup_reports.id
37-
acl = "private"
38-
}
39-
40-
# We need a key for the SNS topic that will be used for notifications from AWS Backup. This key
41-
# will be used to encrypt the messages sent to the topic before they are sent to the subscribers,
42-
# but isn't needed by the recipients of the messages.
43-
44-
45-
# Now we can define the key itself
46-
resource "aws_kms_key" "backup_notifications" {
47-
description = "KMS key for AWS Backup notifications"
48-
deletion_window_in_days = 7
49-
enable_key_rotation = true
50-
policy = jsonencode({
51-
Version = "2012-10-17"
52-
Statement = [
53-
{
54-
Effect = "Allow"
55-
Sid = "Enable IAM User Permissions"
56-
Principal = {
57-
AWS = "arn:aws:iam::${var.assume_account}:root"
58-
}
59-
Action = "kms:*"
60-
Resource = "*"
61-
},
62-
{
63-
Effect = "Allow"
64-
Principal = {
65-
Service = "sns.amazonaws.com"
66-
}
67-
Action = ["kms:GenerateDataKey*", "kms:Decrypt"]
68-
Resource = "*"
69-
},
70-
]
71-
})
72-
}
73-
74-
# Now we can deploy the source and destination modules, referencing the resources we've created above.
75-
76-
module "source" {
77-
source = "../../modules/aws-backup-source"
78-
79-
backup_copy_vault_account_id = data.aws_secretsmanager_secret_version.destination_account_id.secret_string
80-
backup_copy_vault_arn = data.aws_secretsmanager_secret_version.destination_vault_arn.secret_string
81-
environment_name = var.environment
82-
bootstrap_kms_key_arn = aws_kms_key.backup_notifications.arn
83-
project_name = local.project
84-
reports_bucket = aws_s3_bucket.backup_reports.bucket
85-
terraform_role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
86-
87-
backup_plan_config = {
88-
"compliance_resource_types" : [
89-
"S3"
90-
],
91-
"rules" : [
92-
{
93-
"copy_action" : {
94-
"delete_after" : 4
95-
},
96-
"lifecycle" : {
97-
"delete_after" : 2
98-
},
99-
"name" : "daily_kept_for_2_days",
100-
"schedule" : "cron(0 0 * * ? *)"
101-
}
102-
],
103-
"selection_tag" : "NHSE-Enable-Backup"
104-
}
105-
106-
backup_plan_config_dynamodb = {
107-
"enable" : true,
108-
"compliance_resource_types" : [
109-
"DynamoDB"
110-
],
111-
"rules" : [
112-
{
113-
"copy_action" : {
114-
"delete_after" : 4
115-
},
116-
"lifecycle" : {
117-
"delete_after" : 2
118-
},
119-
"name" : "daily_kept_for_2_days",
120-
"schedule" : "cron(0 0 * * ? *)"
121-
}
122-
],
123-
"selection_tag" : "NHSE-Enable-Backup"
124-
}
125-
}
1+
# data "aws_secretsmanager_secret" "destination_vault_arn" {
2+
# name = "destination_vault_arn"
3+
# }
4+
5+
# data "aws_secretsmanager_secret_version" "destination_vault_arn" {
6+
# secret_id = data.aws_secretsmanager_secret.destination_vault_arn.id
7+
# }
8+
9+
# data "aws_secretsmanager_secret" "destination_account_id" {
10+
# name = "destination_account_id"
11+
# }
12+
13+
# data "aws_secretsmanager_secret_version" "destination_account_id" {
14+
# secret_id = data.aws_secretsmanager_secret.destination_account_id.id
15+
# }
16+
17+
# # First, we create an S3 bucket for compliance reports. You may already have a module for creating
18+
# # S3 buckets with more refined access rules, which you may prefer to use.
19+
20+
# resource "aws_s3_bucket" "backup_reports" {
21+
# bucket_prefix = "${local.project}-backup-reports"
22+
# }
23+
24+
# # Now we have to configure access to the report bucket.
25+
26+
# resource "aws_s3_bucket_ownership_controls" "backup_reports" {
27+
# bucket = aws_s3_bucket.backup_reports.id
28+
# rule {
29+
# object_ownership = "BucketOwnerPreferred"
30+
# }
31+
# }
32+
33+
# resource "aws_s3_bucket_acl" "backup_reports" {
34+
# depends_on = [aws_s3_bucket_ownership_controls.backup_reports]
35+
36+
# bucket = aws_s3_bucket.backup_reports.id
37+
# acl = "private"
38+
# }
39+
40+
# # We need a key for the SNS topic that will be used for notifications from AWS Backup. This key
41+
# # will be used to encrypt the messages sent to the topic before they are sent to the subscribers,
42+
# # but isn't needed by the recipients of the messages.
43+
44+
45+
# # Now we can define the key itself
46+
# resource "aws_kms_key" "backup_notifications" {
47+
# description = "KMS key for AWS Backup notifications"
48+
# deletion_window_in_days = 7
49+
# enable_key_rotation = true
50+
# policy = jsonencode({
51+
# Version = "2012-10-17"
52+
# Statement = [
53+
# {
54+
# Effect = "Allow"
55+
# Sid = "Enable IAM User Permissions"
56+
# Principal = {
57+
# AWS = "arn:aws:iam::${var.assume_account}:root"
58+
# }
59+
# Action = "kms:*"
60+
# Resource = "*"
61+
# },
62+
# {
63+
# Effect = "Allow"
64+
# Principal = {
65+
# Service = "sns.amazonaws.com"
66+
# }
67+
# Action = ["kms:GenerateDataKey*", "kms:Decrypt"]
68+
# Resource = "*"
69+
# },
70+
# ]
71+
# })
72+
# }
73+
74+
# # Now we can deploy the source and destination modules, referencing the resources we've created above.
75+
76+
# module "source" {
77+
# source = "../../modules/aws-backup-source"
78+
79+
# backup_copy_vault_account_id = data.aws_secretsmanager_secret_version.destination_account_id.secret_string
80+
# backup_copy_vault_arn = data.aws_secretsmanager_secret_version.destination_vault_arn.secret_string
81+
# environment_name = var.environment
82+
# bootstrap_kms_key_arn = aws_kms_key.backup_notifications.arn
83+
# project_name = local.project
84+
# reports_bucket = aws_s3_bucket.backup_reports.bucket
85+
# terraform_role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
86+
87+
# backup_plan_config = {
88+
# "compliance_resource_types" : [
89+
# "S3"
90+
# ],
91+
# "rules" : [
92+
# {
93+
# "copy_action" : {
94+
# "delete_after" : 4
95+
# },
96+
# "lifecycle" : {
97+
# "delete_after" : 2
98+
# },
99+
# "name" : "daily_kept_for_2_days",
100+
# "schedule" : "cron(0 0 * * ? *)"
101+
# }
102+
# ],
103+
# "selection_tag" : "NHSE-Enable-Backup"
104+
# }
105+
106+
# backup_plan_config_dynamodb = {
107+
# "enable" : true,
108+
# "compliance_resource_types" : [
109+
# "DynamoDB"
110+
# ],
111+
# "rules" : [
112+
# {
113+
# "copy_action" : {
114+
# "delete_after" : 4
115+
# },
116+
# "lifecycle" : {
117+
# "delete_after" : 2
118+
# },
119+
# "name" : "daily_kept_for_2_days",
120+
# "schedule" : "cron(0 0 * * ? *)"
121+
# }
122+
# ],
123+
# "selection_tag" : "NHSE-Enable-Backup"
124+
# }
125+
# }

0 commit comments

Comments
 (0)