terraform.aws-baseline-infra/modules/storage/aws-backup/awsbackup.tf

resource "aws_backup_vault" "ab-vault" {
  name        = "BackupVault"
  kms_key_arn = aws_kms_key.ab-kms-key.arn
  tags        = var.default-tags
}

resource "aws_backup_vault_policy" "ab-vault-policy" {
  backup_vault_name = aws_backup_vault.ab-vault.name
  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Id": "default",
  "Statement": [
    {
      "Sid": "default",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "backup:DescribeBackupVault",
        "backup:DeleteBackupVault",
        "backup:PutBackupVaultAccessPolicy",
        "backup:DeleteBackupVaultAccessPolicy",
        "backup:GetBackupVaultAccessPolicy",
        "backup:StartBackupJob",
        "backup:GetBackupVaultNotifications",
        "backup:PutBackupVaultNotifications"
      ],
      "Resource": "${aws_backup_vault.ab-vault.arn}"
    }
  ]
}
POLICY
}

resource "aws_backup_region_settings" "ab-settings" {
  resource_type_opt_in_preference = {
    "Aurora"          = true
    # not in ap-east-1 "DocumentDB"      = false
    "DynamoDB"        = true
    "EBS"             = true
    "EC2"             = true
    "EFS"             = true
    "FSx"             = true
    "Neptune"         = false
    "RDS"             = true
    "Storage Gateway" = false
    "VirtualMachine"  = false
  }

  resource_type_management_preference = {
    "DynamoDB" = true
    "EFS"      = true
  }
}

resource "aws_backup_plan" "ab-plan" {
  name = var.backup-plan-name

  rule {
    rule_name         = var.backup-plan-name
    target_vault_name = aws_backup_vault.ab-vault.name
    schedule          = var.backup-plan-cron
    start_window = 60
    completion_window = 240

    lifecycle {
      delete_after = var.backup-plan-retention
    }
  }

  advanced_backup_setting {
    backup_options = {
      WindowsVSS = "enabled"
    }
    resource_type = "EC2"
  }

  tags = var.default-tags
}

resource "aws_iam_role" "ab-iam-role" {
  name               = "AwsBackupRole"
  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": ["sts:AssumeRole"],
      "Effect": "allow",
      "Principal": {
        "Service": ["backup.amazonaws.com"]
      }
    }
  ]
}
POLICY
  tags = var.default-tags
}

resource "aws_iam_role_policy_attachment" "ab-iam-role-policy" {
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
  role       = aws_iam_role.ab-iam-role.name
}

resource "aws_backup_selection" "ab-selection-tag" {
  iam_role_arn = aws_iam_role.ab-iam-role.arn
  name         = "AwsBackupSelectionByTag"
  plan_id      = aws_backup_plan.ab-plan.id

  selection_tag {
    type  = "STRINGEQUALS"
    key   = "AwsBackup"
    value = var.backup-plan-name
  }
}