vbaws-lab-backup-secondary.template

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Veeam Backup for AWS Lab Setup - Backup Secondary Region",
  "Parameters": {
    "UserName": {
      "Description": "First letter of first name, first four letters of last name, all lowercase. Five letters total. Example: Victor Flex -> vflex, or Woo Hoo -> wohoo",
      "Type": "String",
      "MaxLength": 5,
      "ConstraintDescription": "Username must be lowercase and cannot contain more than 5 characters."
    }
  },
  "Resources": {
    "BackupSecondaryVPC": {
      "Type": "AWS::EC2::VPC",
      "Properties": {
        "CidrBlock": "10.20.0.0/16",
        "EnableDnsHostnames": true,
        "EnableDnsSupport": true,
        "InstanceTenancy": "default",
        "Tags": [
          {
            "Key": "Name",
            "Value": {
              "Fn::Join": [
                "-",
                [
                  {
                    "Ref": "UserName"
                  },
                  "backup-secondary-vpc"
                ]
              ]
            }
          }
        ]
      }
    },
    "BackupSecondarySubnetPrivate": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "VpcId": {
          "Ref": "BackupSecondaryVPC"
        },
        "CidrBlock": "10.20.0.0/24",
        "Tags": [
          {
            "Key": "Name",
            "Value": {
              "Fn::Join": [
                "-",
                [
                  {
                    "Ref": "UserName"
                  },
                  "backup-secondary-subnet-private"
                ]
              ]
            }
          }
        ]
      }
    },
    "BackupSecondaryIGW": {
      "Type": "AWS::EC2::InternetGateway",
      "Properties": {
        "Tags": [
          {
            "Key": "Name",
            "Value": {
              "Fn::Join": [
                "-",
                [
                  {
                    "Ref": "UserName"
                  },
                  "backup-secondary-igw"
                ]
              ]
            }
          }
        ]
      }
    },
    "BackupSecondaryAttachIGW": {
      "Type": "AWS::EC2::VPCGatewayAttachment",
      "Properties": {
        "VpcId": {
          "Ref": "BackupSecondaryVPC"
        },
        "InternetGatewayId": {
          "Ref": "BackupSecondaryIGW"
        }
      }
    },
    "BackupSecondaryRouteTablePrivate": {
      "Type": "AWS::EC2::RouteTable",
      "Properties": {
        "VpcId": {
          "Ref": "BackupSecondaryVPC"
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": {
              "Fn::Join": [
                "-",
                [
                  {
                    "Ref": "UserName"
                  },
                  "backup-secondary-rt-private"
                ]
              ]
            }
          }
        ]
      }
    },
    "BackupSecondarySubnetPrivateRouteTableAssociation": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "SubnetId": {
          "Ref": "BackupSecondarySubnetPrivate"
        },
        "RouteTableId": {
          "Ref": "BackupSecondaryRouteTablePrivate"
        }
      }
    },
    "BackupSecondarySG": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "VpcId": {
          "Ref": "BackupSecondaryVPC"
        },
        "GroupDescription": "Enable HTTPS access on TCP 443",
        "GroupName": {
          "Fn::Join": [
            "-",
            [
              {
                "Ref": "UserName"
              },
              "backup-veeam-sg"
            ]
          ]
        },
        "SecurityGroupIngress": [
          {
            "IpProtocol": "tcp",
            "FromPort": 443,
            "ToPort": 443,
            "CidrIp": "0.0.0.0/0"
          }
        ],
        "Tags": [
          {
            "Key": "Name",
            "Value": {
              "Fn::Join": [
                "-",
                [
                  {
                    "Ref": "UserName"
                  },
                  "backup-veeam-sg"
                ]
              ]
            }
          }
        ]
      }
    },
    "BackupSecondaryBucket": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "BucketName": {
          "Fn::Join": [
            "-",
            [
              {
                "Ref": "UserName"
              },
              "bucket-secondary-veeam-aws-lab"
            ]
          ]
        },
        "AccessControl": "Private",
        "PublicAccessBlockConfiguration": {
          "BlockPublicAcls": true,
          "BlockPublicPolicy": true,
          "IgnorePublicAcls": true,
          "RestrictPublicBuckets": true
        }
      }
    },
    "BackupSecondaryBucketEmptyOnDelete": {
      "Type": "Custom::EmptyOnDelete",
      "Properties": {
        "ServiceToken": {
          "Fn::GetAtt": [
            "BackupSecondaryBucketEmptyOnDeleteLambda",
            "Arn"
          ]
        },
        "BucketName": {
          "Ref": "BackupSecondaryBucket"
        }
      }
    },
    "BackupSecondaryBucketEmptyOnDeleteLambda": {
      "DependsOn": "BackupSecondaryBucket",
      "Type": "AWS::Lambda::Function",
      "Properties": {
        "Code": {
          "ZipFile": "import boto3\nimport json\nimport logging\nimport cfnresponse\n\ndef lambda_handler(event, context):\n  print('Received event: %s' % json.dumps(event))\n  status = cfnresponse.SUCCESS\n  try:\n      eventbucket = event['ResourceProperties']['BucketName']\n      if event['RequestType'] == 'Delete':\n          s3 = boto3.resource('s3')\n          bucket = s3.Bucket(eventbucket)\n          bucket.objects.all().delete()\n  except Exception as e:\n      logging.error('Exception: %s' % e, exc_info=True)\n      status = cfnresponse.FAILED\n  finally:\n      cfnresponse.send(event, context, status, {}, context.log_stream_name)\n"
        },
        "Description": "Lambda function which empties the bucket prior to deletion when the stack is deleted.",
        "Handler": "index.lambda_handler",
        "Role": {
          "Fn::GetAtt": [
            "BackupSecondaryBucketEmptyOnDeleteLambdaRole",
            "Arn"
          ]
        },
        "Runtime": "python3.7",
        "Timeout": 300
      }
    },
    "BackupSecondaryBucketEmptyOnDeleteLambdaRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "lambda.amazonaws.com"
                ]
              },
              "Action": [
                "sts:AssumeRole"
              ]
            }
          ]
        },
        "Path": "/",
        "Policies": [
          {
            "PolicyName": "BackupSecondaryBucketEmptyOnDeleteLambdaPolicy",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "logs:*",
                    "s3:*"
                  ],
                  "Resource": "*"
                },
                {
                  "Effect": "Deny",
                  "Action": [
                    "s3:DeleteBucket"
                  ],
                  "Resource": "*"
                }
              ]
            }
          }
        ]
      }
    },
    "BackupSecondaryVpceEbs": {
      "Type": "AWS::EC2::VPCEndpoint",
      "Properties": {
        "VpcId": {
          "Ref": "BackupSecondaryVPC"
        },
        "VpcEndpointType": "Interface",
        "SubnetIds": [
          {
            "Ref": "BackupSecondarySubnetPrivate"
          }
        ],
        "PrivateDnsEnabled": true,
        "ServiceName": {
          "Fn::Sub": "com.amazonaws.${AWS::Region}.ebs"
        }
      }
    },
    "BackupSecondaryVpceEc2messages": {
      "Type": "AWS::EC2::VPCEndpoint",
      "Properties": {
        "VpcId": {
          "Ref": "BackupSecondaryVPC"
        },
        "VpcEndpointType": "Interface",
        "SubnetIds": [
          {
            "Ref": "BackupSecondarySubnetPrivate"
          }
        ],
        "PrivateDnsEnabled": true,
        "SecurityGroupIds": [
          {
            "Ref": "BackupSecondarySG"
          }
        ],
        "ServiceName": {
          "Fn::Sub": "com.amazonaws.${AWS::Region}.ec2messages"
        }
      }
    },
    "BackupSecondaryVpceSqs": {
      "Type": "AWS::EC2::VPCEndpoint",
      "Properties": {
        "VpcId": {
          "Ref": "BackupSecondaryVPC"
        },
        "VpcEndpointType": "Interface",
        "SubnetIds": [
          {
            "Ref": "BackupSecondarySubnetPrivate"
          }
        ],
        "PrivateDnsEnabled": true,
        "SecurityGroupIds": [
          {
            "Ref": "BackupSecondarySG"
          }
        ],
        "ServiceName": {
          "Fn::Sub": "com.amazonaws.${AWS::Region}.sqs"
        }
      }
    },
    "BackupSecondaryVpceSsm": {
      "Type": "AWS::EC2::VPCEndpoint",
      "Properties": {
        "VpcId": {
          "Ref": "BackupSecondaryVPC"
        },
        "VpcEndpointType": "Interface",
        "SubnetIds": [
          {
            "Ref": "BackupSecondarySubnetPrivate"
          }
        ],
        "PrivateDnsEnabled": true,
        "SecurityGroupIds": [
          {
            "Ref": "BackupSecondarySG"
          }
        ],
        "ServiceName": {
          "Fn::Sub": "com.amazonaws.${AWS::Region}.ssm"
        }
      }
    },
    "BackupSecondaryDeleteS3Endpoint": {
      "Type": "Custom::DeleteS3Endpoint",
      "Properties": {
        "ServiceToken": {
          "Fn::GetAtt": [
            "BackupSecondaryDeleteS3EndpointLambda",
            "Arn"
          ]
        },
        "VpcId": {
          "Ref": "BackupSecondaryVPC"
        }
      }
    },
    "BackupSecondaryDeleteS3EndpointLambda": {
      "DependsOn": "BackupSecondaryVPC",
      "Type": "AWS::Lambda::Function",
      "Properties": {
        "Code": {
          "ZipFile": "import boto3\nimport json\nimport logging\nimport cfnresponse\nimport os\n\ndef lambda_handler(event, context):\n    print('Received event: %s' % json.dumps(event))\n    status = cfnresponse.SUCCESS\n    try:\n        eventvpc = event['ResourceProperties']['VpcId']\n        if event['RequestType'] == 'Delete':\n            ec2client = boto3.client('ec2')\n            region = os.environ['AWS_REGION']\n            s3servicename = 'com.amazonaws.' + region + '.s3'\n            for ep in ec2client.describe_vpc_endpoints(\n                    Filters=[\n                        {\n                            'Name': 'vpc-id',\n                            'Values': [eventvpc]\n                        },\n                        {\n                            'Name': 'service-name',\n                            'Values': [s3servicename]\n                        }\n                    ])['VpcEndpoints']:\n                ec2client.delete_vpc_endpoints(VpcEndpointIds=[ep['VpcEndpointId']])\n    except Exception as e:\n        logging.error('Exception: %s' % e, exc_info=True)\n        status = cfnresponse.FAILED\n    finally:\n        cfnresponse.send(event, context, status, {}, context.log_stream_name)\n"
        },
        "Description": "Lambda function which deletes the S3 endpoints in the VPC.",
        "Handler": "index.lambda_handler",
        "Role": {
          "Fn::GetAtt": [
            "BackupSecondaryDeleteS3EndpointLambdaRole",
            "Arn"
          ]
        },
        "Runtime": "python3.7",
        "Timeout": 300
      }
    },
    "BackupSecondaryDeleteS3EndpointLambdaRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "lambda.amazonaws.com"
                ]
              },
              "Action": [
                "sts:AssumeRole"
              ]
            }
          ]
        },
        "Path": "/",
        "Policies": [
          {
            "PolicyName": "BackupSecondaryDeleteS3EndpointLambdaPolicy",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "logs:*",
                    "ec2:*"
                  ],
                  "Resource": "*"
                }
              ]
            }
          }
        ]
      }
    }
  },
  "Outputs": {
    "VpcId": {
      "Description": "VpcId of the newly created backup VPC",
      "Value": {
        "Ref": "BackupSecondaryVPC"
      }
    }
  }
}