From 346acca7fd27153e6648f67ffbd33e037cc04950 Mon Sep 17 00:00:00 2001
From: xpk <xpk@headdesk.me>
Date: Tue, 6 Sep 2022 11:41:06 +0800
Subject: [PATCH] NEW: aws backup

---
 modules/storage/aws-backup/awsbackup.tf | 117 ++++++++++++++++++++++++
 modules/storage/aws-backup/kms-key.tf   |  67 ++++++++++++++
 modules/storage/aws-backup/variables.tf |   9 ++
 3 files changed, 193 insertions(+)
 create mode 100644 modules/storage/aws-backup/awsbackup.tf
 create mode 100644 modules/storage/aws-backup/kms-key.tf
 create mode 100644 modules/storage/aws-backup/variables.tf

diff --git a/modules/storage/aws-backup/awsbackup.tf b/modules/storage/aws-backup/awsbackup.tf
new file mode 100644
index 0000000..3a41769
--- /dev/null
+++ b/modules/storage/aws-backup/awsbackup.tf
@@ -0,0 +1,117 @@
+resource "aws_backup_vault" "ab-vault" {
+  name        = "BackupVault"
+  kms_key_arn = aws_kms_key.ab-kms-key.arn
+  tags        = var.default-tags
+}
+
+resource "aws_backup_vault_policy" "ab-vault-policy" {
+  backup_vault_name = aws_backup_vault.ab-vault.name
+  policy = <<POLICY
+{
+  "Version": "2012-10-17",
+  "Id": "default",
+  "Statement": [
+    {
+      "Sid": "default",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "*"
+      },
+      "Action": [
+        "backup:DescribeBackupVault",
+        "backup:DeleteBackupVault",
+        "backup:PutBackupVaultAccessPolicy",
+        "backup:DeleteBackupVaultAccessPolicy",
+        "backup:GetBackupVaultAccessPolicy",
+        "backup:StartBackupJob",
+        "backup:GetBackupVaultNotifications",
+        "backup:PutBackupVaultNotifications"
+      ],
+      "Resource": "${aws_backup_vault.ab-vault.arn}"
+    }
+  ]
+}
+POLICY
+}
+
+resource "aws_backup_region_settings" "ab-settings" {
+  resource_type_opt_in_preference = {
+    "Aurora"          = true
+    # not in ap-east-1 "DocumentDB"      = false
+    "DynamoDB"        = true
+    "EBS"             = true
+    "EC2"             = true
+    "EFS"             = true
+    "FSx"             = true
+    "Neptune"         = false
+    "RDS"             = true
+    "Storage Gateway" = false
+    "VirtualMachine"  = false
+  }
+
+  resource_type_management_preference = {
+    "DynamoDB" = true
+    "EFS"      = true
+  }
+}
+
+resource "aws_backup_plan" "ab-plan" {
+  name = var.backup-plan-name
+
+  rule {
+    rule_name         = var.backup-plan-name
+    target_vault_name = aws_backup_vault.ab-vault.name
+    schedule          = var.backup-plan-cron
+    start_window = 60
+    completion_window = 240
+
+    lifecycle {
+      delete_after = var.backup-plan-retention
+    }
+  }
+
+  advanced_backup_setting {
+    backup_options = {
+      WindowsVSS = "enabled"
+    }
+    resource_type = "EC2"
+  }
+
+  tags = var.default-tags
+}
+
+resource "aws_iam_role" "ab-iam-role" {
+  name               = "AwsBackupRole"
+  assume_role_policy = <<POLICY
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": ["sts:AssumeRole"],
+      "Effect": "allow",
+      "Principal": {
+        "Service": ["backup.amazonaws.com"]
+      }
+    }
+  ]
+}
+POLICY
+  tags = var.default-tags
+}
+
+resource "aws_iam_role_policy_attachment" "ab-iam-role-policy" {
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
+  role       = aws_iam_role.ab-iam-role.name
+}
+
+resource "aws_backup_selection" "ab-selection-tag" {
+  iam_role_arn = aws_iam_role.ab-iam-role.arn
+  name         = "AwsBackupSelectionByTag"
+  plan_id      = aws_backup_plan.ab-plan.id
+
+  selection_tag {
+    type  = "STRINGEQUALS"
+    key   = "AwsBackup"
+    value = var.backup-plan-name
+  }
+}
diff --git a/modules/storage/aws-backup/kms-key.tf b/modules/storage/aws-backup/kms-key.tf
new file mode 100644
index 0000000..0d8b4ad
--- /dev/null
+++ b/modules/storage/aws-backup/kms-key.tf
@@ -0,0 +1,67 @@
+data aws_caller_identity this {}
+
+resource "aws_kms_key" "ab-kms-key" {
+  description             = "KMS key for aws backup"
+  deletion_window_in_days = 10
+  tags = var.default-tags
+  policy = <<EOD
+{
+    "Version": "2012-10-17",
+    "Id": "key-consolepolicy-3",
+    "Statement": [
+        {
+            "Sid": "Enable IAM User Permissions",
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::${data.aws_caller_identity.this.id}:root"
+            },
+            "Action": "kms:*",
+            "Resource": "*"
+        },
+        {
+            "Sid": "Allow attachment of persistent resources",
+            "Effect": "Allow",
+            "Principal": "*",
+            "Action": [
+                "kms:CreateGrant",
+                "kms:ListGrants",
+                "kms:RevokeGrant"
+            ],
+            "Resource": "*",
+            "Condition": {
+                "Bool": {
+                    "kms:GrantIsForAWSResource": "true"
+                }
+            }
+        },
+        {
+            "Sid": "Allow use of the KMS key for organization",
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "*"
+            },
+            "Action": [
+                "kms:Decrypt",
+                "kms:DescribeKey",
+                "kms:Encrypt",
+                "kms:ReEncrypt*",
+                "kms:GetKeyPolicy",
+                "kms:CreateGrant",
+                "kms:GenerateDataKey*"
+            ],
+            "Resource": "*",
+            "Condition": {
+                "StringEquals": {
+                    "aws:PrincipalOrgID": "${var.aws-org-id}"
+                }
+            }
+        }
+    ]
+}
+EOD
+}
+
+resource "aws_kms_alias" "ab-kms-key-alias" {
+  name          = "alias/awsbackup-kms-key"
+  target_key_id = aws_kms_key.ab-kms-key.id
+}
diff --git a/modules/storage/aws-backup/variables.tf b/modules/storage/aws-backup/variables.tf
new file mode 100644
index 0000000..9c736ec
--- /dev/null
+++ b/modules/storage/aws-backup/variables.tf
@@ -0,0 +1,9 @@
+variable default-tags {}
+variable aws-org-id {}
+variable backup-plan-name {}
+variable backup-plan-cron {
+  type = string
+  default = "cron(0 20 * * ? *)"
+  # cron(Minutes Hours Day-of-month Month Day-of-week Year)
+}
+variable backup-plan-retention {}
\ No newline at end of file