118 lines
2.7 KiB
HCL
118 lines
2.7 KiB
HCL
resource "aws_backup_vault" "ab-vault" {
|
|
name = "BackupVault"
|
|
kms_key_arn = aws_kms_key.ab-kms-key.arn
|
|
tags = var.default-tags
|
|
}
|
|
|
|
resource "aws_backup_vault_policy" "ab-vault-policy" {
|
|
backup_vault_name = aws_backup_vault.ab-vault.name
|
|
policy = <<POLICY
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Id": "default",
|
|
"Statement": [
|
|
{
|
|
"Sid": "default",
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": "*"
|
|
},
|
|
"Action": [
|
|
"backup:DescribeBackupVault",
|
|
"backup:DeleteBackupVault",
|
|
"backup:PutBackupVaultAccessPolicy",
|
|
"backup:DeleteBackupVaultAccessPolicy",
|
|
"backup:GetBackupVaultAccessPolicy",
|
|
"backup:StartBackupJob",
|
|
"backup:GetBackupVaultNotifications",
|
|
"backup:PutBackupVaultNotifications"
|
|
],
|
|
"Resource": "${aws_backup_vault.ab-vault.arn}"
|
|
}
|
|
]
|
|
}
|
|
POLICY
|
|
}
|
|
|
|
resource "aws_backup_region_settings" "ab-settings" {
|
|
resource_type_opt_in_preference = {
|
|
"Aurora" = true
|
|
# not in ap-east-1 "DocumentDB" = false
|
|
"DynamoDB" = true
|
|
"EBS" = true
|
|
"EC2" = true
|
|
"EFS" = true
|
|
"FSx" = true
|
|
"Neptune" = false
|
|
"RDS" = true
|
|
"Storage Gateway" = false
|
|
"VirtualMachine" = false
|
|
}
|
|
|
|
resource_type_management_preference = {
|
|
"DynamoDB" = true
|
|
"EFS" = true
|
|
}
|
|
}
|
|
|
|
resource "aws_backup_plan" "ab-plan" {
|
|
name = var.backup-plan-name
|
|
|
|
rule {
|
|
rule_name = var.backup-plan-name
|
|
target_vault_name = aws_backup_vault.ab-vault.name
|
|
schedule = var.backup-plan-cron
|
|
start_window = 60
|
|
completion_window = 240
|
|
|
|
lifecycle {
|
|
delete_after = var.backup-plan-retention
|
|
}
|
|
}
|
|
|
|
advanced_backup_setting {
|
|
backup_options = {
|
|
WindowsVSS = "enabled"
|
|
}
|
|
resource_type = "EC2"
|
|
}
|
|
|
|
tags = var.default-tags
|
|
}
|
|
|
|
resource "aws_iam_role" "ab-iam-role" {
|
|
name = "AwsBackupRole"
|
|
assume_role_policy = <<POLICY
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Action": ["sts:AssumeRole"],
|
|
"Effect": "allow",
|
|
"Principal": {
|
|
"Service": ["backup.amazonaws.com"]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
POLICY
|
|
tags = var.default-tags
|
|
}
|
|
|
|
resource "aws_iam_role_policy_attachment" "ab-iam-role-policy" {
|
|
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
|
|
role = aws_iam_role.ab-iam-role.name
|
|
}
|
|
|
|
resource "aws_backup_selection" "ab-selection-tag" {
|
|
iam_role_arn = aws_iam_role.ab-iam-role.arn
|
|
name = "AwsBackupSelectionByTag"
|
|
plan_id = aws_backup_plan.ab-plan.id
|
|
|
|
selection_tag {
|
|
type = "STRINGEQUALS"
|
|
key = "AwsBackup"
|
|
value = var.backup-plan-name
|
|
}
|
|
}
|