Skip to content

Commit e999304

Browse files
aidenvaines-cgiaidenvaines-cgi
committed
CCM-7890 Adding backup template resources
1 parent f24aa0c commit e999304

File tree

9 files changed

+281
-74
lines changed

9 files changed

+281
-74
lines changed

‎infrastructure/terraform/components/acct/module_s3bucket_backup_reports.tf‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
module "s3bucket_backup_reports" {
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket?ref=v1.0.5"
3+
4+
name = "backup-reports"
5+
6+
aws_account_id = var.aws_account_id
7+
region = var.region
8+
project = var.project
9+
environment = var.environment
10+
component = var.component
11+
12+
acl = "private"
13+
force_destroy = false
14+
versioning = true
15+
16+
lifecycle_rules = [
17+
{
18+
prefix = ""
19+
enabled = true
20+
21+
noncurrent_version_transition = [
22+
{
23+
noncurrent_days = "30"
24+
storage_class = "STANDARD_IA"
25+
}
26+
]
27+
28+
noncurrent_version_expiration = {
29+
noncurrent_days = "90"
30+
}
31+
32+
abort_incomplete_multipart_upload = {
33+
days = "1"
34+
}
35+
}
36+
]
37+
38+
policy_documents = [
39+
data.aws_iam_policy_document.s3bucket_backup_reports.json
40+
]
41+
42+
public_access = {
43+
block_public_acls = true
44+
block_public_policy = true
45+
ignore_public_acls = true
46+
restrict_public_buckets = true
47+
}
48+
49+
50+
default_tags = {
51+
Name = "AWS Backup Reports for enabled environments"
52+
}
53+
}
54+
55+
data "aws_iam_policy_document" "s3bucket_backup_reports" {
56+
statement {
57+
sid = "DontAllowNonSecureConnection"
58+
effect = "Deny"
59+
60+
actions = [
61+
"s3:*",
62+
]
63+
64+
resources = [
65+
module.s3bucket_backup_reports.arn,
66+
"${module.s3bucket_backup_reports.arn}/*",
67+
]
68+
69+
principals {
70+
type = "AWS"
71+
72+
identifiers = [
73+
"*",
74+
]
75+
}
76+
77+
condition {
78+
test = "Bool"
79+
variable = "aws:SecureTransport"
80+
81+
values = [
82+
"false",
83+
]
84+
}
85+
}
86+
87+
statement {
88+
sid = "AllowManagedAccountsToList"
89+
effect = "Allow"
90+
91+
actions = [
92+
"s3:ListBucket",
93+
]
94+
95+
resources = [
96+
module.s3bucket_backup_reports.arn,
97+
]
98+
99+
principals {
100+
type = "AWS"
101+
identifiers = [
102+
"arn:aws:iam::${var.aws_account_id}:root"
103+
]
104+
}
105+
}
106+
107+
statement {
108+
sid = "AllowManagedAccountsToGet"
109+
effect = "Allow"
110+
111+
actions = [
112+
"s3:GetObject",
113+
]
114+
115+
resources = [
116+
"${module.s3bucket_backup_reports.arn}/*",
117+
]
118+
119+
principals {
120+
type = "AWS"
121+
identifiers = [
122+
"arn:aws:iam::${var.aws_account_id}:root"
123+
]
124+
}
125+
}
126+
}

‎infrastructure/terraform/components/acct/outputs.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,13 @@ output "dns_zone" {
99
output "github_pat_ssm_param_name" {
1010
value = aws_ssm_parameter.github_pat.name
1111
}
12+
13+
output "s3_buckets" {
14+
value = {
15+
backup_reports = {
16+
arn = module.s3bucket_backup_reports.arn
17+
bucket = module.s3bucket_backup_reports.bucket
18+
id = module.s3bucket_backup_reports.id
19+
}
20+
}
21+
}

‎infrastructure/terraform/components/app/iam_role_backup.tf‎

Lines changed: 0 additions & 73 deletions
This file was deleted.

‎infrastructure/terraform/components/app/module_backend_api.tf‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,7 @@ module "backend_api" {
1212
log_retention_in_days = var.log_retention_in_days
1313
email_domain_name = local.root_domain_name
1414

15-
cognito_config = jsondecode(aws_ssm_parameter.cognito_config.value)
15+
cognito_config = jsondecode(aws_ssm_parameter.cognito_config.value)
16+
17+
enable_backup = var.destination_vault_arn != null ? true : false
1618
}

‎infrastructure/terraform/components/app/module_kms.tf‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
module "kms" {
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/kms?ref=v1.0.6"
3+
4+
aws_account_id = var.aws_account_id
5+
component = var.component
6+
environment = var.environment
7+
project = var.project
8+
region = var.region
9+
10+
name = "main"
11+
deletion_window = var.kms_deletion_window
12+
alias = "alias/${local.csi}"
13+
key_policy_documents = [data.aws_iam_policy_document.kms.json]
14+
iam_delegation = true
15+
}
16+
17+
data "aws_iam_policy_document" "kms" {
18+
# '*' resource scope is permitted in access policies as as the resource is itself
19+
# https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-services.html
20+
21+
statement {
22+
sid = "AllowCloudWatchEncrypt"
23+
effect = "Allow"
24+
25+
principals {
26+
type = "Service"
27+
28+
identifiers = [
29+
"logs.${var.region}.amazonaws.com",
30+
"sns.amazonaws.com",
31+
]
32+
}
33+
34+
actions = [
35+
"kms:Encrypt*",
36+
"kms:Decrypt*",
37+
"kms:ReEncrypt*",
38+
"kms:GenerateDataKey*",
39+
"kms:Describe*"
40+
]
41+
42+
resources = [
43+
"*",
44+
]
45+
}
46+
}

‎infrastructure/terraform/components/app/module_nhse_backup_vault.tf‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
module "nhse_backup_vault" {
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/aws-backup-source?ref=v1.0.6"
3+
count = var.destination_vault_arn != null ? 1:0
4+
5+
project_name = local.csi
6+
environment_name = var.environment
7+
8+
backup_copy_vault_account_id = data.aws_arn.destination_vault_arn[0].account
9+
backup_copy_vault_arn = data.aws_arn.destination_vault_arn[0].arn
10+
11+
reports_bucket = local.acct.s3_buckets["backup_reports"]["bucket"]
12+
13+
bootstrap_kms_key_arn = module.kms.key_id
14+
terraform_role_arn = local.bootstrap.iam_github_deploy_role["arn"]
15+
16+
backup_plan_config = {
17+
"compliance_resource_types": [
18+
"S3"
19+
],
20+
"rules": [
21+
{
22+
"copy_action": {
23+
"delete_after": var.retention_period
24+
},
25+
"lifecycle": {
26+
"delete_after": var.retention_period
27+
},
28+
"name": "${local.csi}-backup-rule",
29+
"schedule": var.backup_schedule_cron
30+
}
31+
],
32+
"selection_tag": "NHSE-Enable-Backup"
33+
}
34+
35+
# Note here that we need to explicitly disable DynamoDB backups in the source account.
36+
# The default config in the module enables backups for all resource types.
37+
backup_plan_config_dynamodb = {
38+
"compliance_resource_types": [
39+
"DynamoDB"
40+
],
41+
"rules": [
42+
{
43+
"copy_action": {
44+
"delete_after": var.retention_period
45+
},
46+
"lifecycle": {
47+
"delete_after": var.retention_period
48+
},
49+
"name": "${local.csi}-backup-rule",
50+
"schedule": var.backup_schedule_cron
51+
}
52+
],
53+
"enable": true,
54+
"selection_tag": "NHSE-Enable-Backup"
55+
}
56+
}
57+
58+
data "aws_arn" "destination_vault_arn" {
59+
count = var.destination_vault_arn != null ? 1:0
60+
61+
arn = var.destination_vault_arn
62+
}

‎infrastructure/terraform/components/app/variables.tf‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,3 +124,27 @@ variable "disable_content" {
124124
description = "Value for turning switching disable conten true/false"
125125
default = "false"
126126
}
127+
128+
variable "destination_vault_arn" {
129+
type = string
130+
description = "ARN of the backup vault in the destination account, if this environment should be backed up"
131+
default = null
132+
}
133+
134+
variable "backup_schedule_cron" {
135+
type = string
136+
description = "Defines the backup schedule in AWS Cron Expression format"
137+
default = "cron(0 0/6 * * ? *)"
138+
}
139+
140+
variable "retention_period" {
141+
type = number
142+
description = "Backup Vault Retention Period"
143+
default = 14
144+
}
145+
146+
variable "backup_report_recipient" {
147+
type = string
148+
description = "Primary recipient of the Backup reports"
149+
default = ""
150+
}

‎infrastructure/terraform/modules/backend-api/dynamodb_table_templates.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,4 +28,8 @@ resource "aws_dynamodb_table" "templates" {
2828
enabled = true
2929
kms_key_arn = aws_kms_key.dynamo.arn
3030
}
31+
32+
tags = {
33+
"NHSE-Enable-Backup" = var.enable_backup ? "True": "False"
34+
}
3135
}

‎infrastructure/terraform/modules/backend-api/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,9 @@ variable "email_domain_name" {
6565
type = string
6666
description = "Email domain name"
6767
}
68+
69+
variable "enable_backup" {
70+
type = bool
71+
description = "Enable Backups for the DynamoDB table?"
72+
default = true
73+
}

0 commit comments

Comments
 (0)