diff --git a/README.md b/README.md index bed065a..30ee543 100644 --- a/README.md +++ b/README.md @@ -26,7 +26,6 @@ | [aws_backup_plan.daily](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_plan) | resource | | [aws_backup_selection.tagged_daily](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_selection) | resource | | [aws_backup_vault.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_vault) | resource | -| [aws_backup_vault_notifications.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_vault_notifications) | resource | | [aws_iam_role.backup](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role_policy_attachment.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.s3_backup](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | @@ -55,10 +54,11 @@ | [backup\_schedule](#input\_backup\_schedule) | Schedule of aws backup plan | `string` | `"cron(0 1 * * ? *)"` | no | | [enable\_continuous\_backup](#input\_enable\_continuous\_backup) | Flag to enable continuos backup | `bool` | `false` | no | | [enable\_sns\_notifications](#input\_enable\_sns\_notifications) | Create an SNS topic where backup notifications go | `bool` | `true` | no | -| [env](#input\_env) | Deployment environment | `string` | n/a | yes | -| [plan\_selection\_tag](#input\_plan\_selection\_tag) | Resource selection for the plan | `list(map)` |
[
{
"key": "",
"value": ""
}
]
| no | +| [env](#input\_env) | Envrionment for the plan | `string` | `"prod"` | no | +| [plan\_selection\_tag](#input\_plan\_selection\_tag) | Resource selection for the plan | `list(map(string))` |
[
{
"key": "Environment",
"value": "Production"
}
]
| no | | [region](#input\_region) | The region where resources should be managed. | `string` | `"eu-central-1"` | no | -| [rules](#input\_rules) | List of rules to attach to the plan | `list(map)` |
[
{
"continuous_backup": true,
"name": "daily",
"recovery_point_tags": {
"Environment": "dev",
"Plan": "plan name"
},
"schedule": "cron(0 12 * * ? *)",
"vault": "Backup"
}
]
| no | +| [rules](#input\_rules) | List of rules to attach to the plan | `list(any)` |
[
{
"continuous_backup": true,
"name": "daily",
"schedule": "cron(0 12 * * ? *)",
"vault": "Backup"
}
]
| no | +| [vault\_name](#input\_vault\_name) | Backup vault name | `string` | `"backup_vault"` | no | ## Outputs diff --git a/iam.tf b/iam.tf index 9285788..5e141cb 100644 --- a/iam.tf +++ b/iam.tf @@ -39,7 +39,7 @@ data "aws_iam_policy_document" "assume_backup_role" { } resource "aws_iam_role" "backup" { - name = local.vault_name + name = var.vault_name assume_role_policy = data.aws_iam_policy_document.assume_backup_role.json } diff --git a/locals.tf b/locals.tf deleted file mode 100644 index 1a7329e..0000000 --- a/locals.tf +++ /dev/null @@ -1,3 +0,0 @@ -locals { - vault_name = "backup-${var.env}" -} diff --git a/main.tf b/main.tf index 758b8bd..c212eb7 100644 --- a/main.tf +++ b/main.tf @@ -8,34 +8,34 @@ resource "aws_kms_key" "backup" { } resource "aws_kms_alias" "backup" { - name = "alias/aws_backup-${var.env}" + name = "alias/aws_backup-${var.vault_name}" target_key_id = aws_kms_key.backup.arn } resource "aws_backup_vault" "this" { - name = local.vault_name + name = var.vault_name kms_key_arn = aws_kms_key.backup.arn lifecycle { - prevent_destroy = true + prevent_destroy = false } } resource "aws_backup_plan" "daily" { name = "daily-${var.env}" - rule { - rule_name = "daily" - target_vault_name = aws_backup_vault.this.name - schedule = var.backup_schedule - enable_continuous_backup = var.enable_continuous_backup + dynamic "rule" { + for_each = var.rules + content { + rule_name = rule.value.name + target_vault_name = aws_backup_vault.this.name + schedule = rule.value.schedule + enable_continuous_backup = rule.value.continuous_backup - lifecycle { - delete_after = var.backup_retention_days - } + lifecycle { + delete_after = var.backup_retention_days + } - recovery_point_tags = { - Environment = var.env } } } @@ -44,16 +44,14 @@ resource "aws_backup_selection" "tagged_daily" { name = "daily-tagged-${var.env}" plan_id = aws_backup_plan.daily.id - # selection rules + # Selection rules dynamic "selection_tag" { for_each = var.plan_selection_tag content { type = "STRINGEQUALS" key = selection_tag.value["key"] value = selection_tag.value["value"] - } - } iam_role_arn = aws_iam_role.backup.arn diff --git a/monitoring.tf b/monitoring.tf index ed3ce3c..6899d46 100644 --- a/monitoring.tf +++ b/monitoring.tf @@ -129,13 +129,13 @@ locals { EOT } -resource "aws_backup_vault_notifications" "this" { - count = var.enable_sns_notifications ? 1 : 0 - backup_vault_name = local.vault_name - sns_topic_arn = module.sns_topic.sns_topic_arn - backup_vault_events = [ - "BACKUP_JOB_COMPLETED", # filter successful backups on sns subscription! - "RESTORE_JOB_STARTED", "RESTORE_JOB_COMPLETED", - "S3_BACKUP_OBJECT_FAILED", "S3_RESTORE_OBJECT_FAILED" - ] -} +# resource "aws_backup_vault_notifications" "this" { +# count = var.enable_sns_notifications ? 1 : 0 +# backup_vault_name = var.vault_name +# sns_topic_arn = module.sns_topic.sns_topic_arn +# backup_vault_events = [ +# "BACKUP_JOB_COMPLETED", # filter successful backups on sns subscription! +# "RESTORE_JOB_STARTED", "RESTORE_JOB_COMPLETED", +# "S3_BACKUP_OBJECT_FAILED", "S3_RESTORE_OBJECT_FAILED" +# ] +# } diff --git a/tests/example.tf b/tests/example.tf new file mode 100644 index 0000000..c4a8dfc --- /dev/null +++ b/tests/example.tf @@ -0,0 +1,22 @@ +provider "aws" { + region = "eu-central-1" +} + +module "aws_backup" { + source = "./.." + + plan_selection_tag = [ + { + key = "Environment" + value = "dev" + } + ] + + rules = [ + { + name = "rule1" + schedule = "cron(0 12 * * ? *)" + continuous_backup = true + } + ] +} diff --git a/variables.tf b/variables.tf index d3d1e4a..593d305 100644 --- a/variables.tf +++ b/variables.tf @@ -1,8 +1,14 @@ -variable "env" { - description = "Deployment environment" +variable "vault_name" { + description = "Backup vault name" type = string + default = "backup_vault" } +variable "env" { + description = "Envrionment for the plan" + type = string + default = "prod" +} variable "region" { description = "The region where resources should be managed." type = string @@ -53,18 +59,18 @@ variable "backup_plan_name" { variable "plan_selection_tag" { description = "Resource selection for the plan" - type = list(map) + type = list(map(string)) default = [ { - key = "" - value = "" + key = "Environment" + value = "Production" } ] } variable "rules" { description = "List of rules to attach to the plan" - type = list(map) + type = list(any) default = [ { name = "daily" @@ -72,10 +78,6 @@ variable "rules" { continuous_backup = true vault = "Backup" - recovery_point_tags = { - Environment = "dev" - Plan = "plan name" - } } ] }