-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* aws-backup init * update readme * add enabled option * exclude tf validate root dir * add separate copy_action * update validate path * refactor format * refactor tags * add tag resource selection, add params * added tags to kms, iam role * change delete_after value * update tflint ruleset * update tf-lint version * fix tf-lint version * fix * notation to brackets * edit example args * rename example resources * substitute naming * rename * add copy_action_lifecycle * fix outputs error when module disabled * fix typo * fix typo, refactor labels * add context to label module
- Loading branch information
Showing
26 changed files
with
866 additions
and
25 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -49,4 +49,4 @@ jobs: | |
|
|
||
| - name: Terraform Validate | ||
| id: validate | ||
| run: terraform validate | ||
| run: terraform -chdir=examples validate | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,130 @@ | ||
| # Source vault | ||
| resource "aws_backup_vault" "source" { | ||
| count = var.enabled ? 1 : 0 | ||
| provider = aws.source | ||
| name = module.source_label.id | ||
| kms_key_arn = module.source_kms_key.key_arn | ||
| tags = module.source_label.tags | ||
| force_destroy = true | ||
| } | ||
|
|
||
| resource "aws_backup_vault_policy" "source" { | ||
| count = var.enabled ? 1 : 0 | ||
| provider = aws.source | ||
| backup_vault_name = aws_backup_vault.source[0].name | ||
| policy = data.aws_iam_policy_document.source_vault.json | ||
| } | ||
|
|
||
| resource "aws_backup_plan" "source" { | ||
| provider = aws.source | ||
| for_each = { for bp in var.backup_plans : bp.name => bp if var.enabled } | ||
|
|
||
| name = each.value.name | ||
| tags = module.source_label.tags | ||
|
|
||
| dynamic "rule" { | ||
| for_each = each.value.rules | ||
| content { | ||
| rule_name = rule.value.name | ||
| target_vault_name = aws_backup_vault.source[0].name | ||
| schedule = rule.value.schedule | ||
| start_window = try(rule.value.start_window, 60) | ||
| completion_window = try(rule.value.completion_window, 180) | ||
| recovery_point_tags = try(rule.value.recovery_point_tags, null) | ||
| enable_continuous_backup = try(rule.value.enable_continuous_backup, null) | ||
|
|
||
|
|
||
| dynamic "lifecycle" { | ||
| for_each = try(rule.value.lifecycle, null) != null ? [true] : [] | ||
| content { | ||
| cold_storage_after = try(rule.value.lifecycle.cold_storage_after, null) | ||
| delete_after = try(rule.value.lifecycle.delete_after, null) | ||
| } | ||
| } | ||
|
|
||
| dynamic "copy_action" { | ||
| for_each = var.is_cross_account_backup_enabled == true ? [true] : [] | ||
| content { | ||
| dynamic "lifecycle" { | ||
| for_each = try(rule.value.copy_action_lifecycle, null) != null ? [true] : [] | ||
| content { | ||
| cold_storage_after = try(rule.value.copy_action_lifecycle.cold_storage_after, null) | ||
| delete_after = try(rule.value.copy_action_lifecycle.delete_after, null) | ||
| } | ||
| } | ||
| destination_vault_arn = aws_backup_vault.target[0].arn | ||
| } | ||
|
|
||
| } | ||
| } | ||
| } | ||
|
|
||
| dynamic "advanced_backup_setting" { | ||
| for_each = try(each.value.advanced_backup_setting, null) != null ? [true] : [] | ||
|
|
||
| content { | ||
| backup_options = { | ||
| WindowsVSS = try(each.value.advanced_backup_setting.WindowsVSS, null) | ||
| } | ||
| resource_type = try(each.value.advanced_backup_setting.resource_type, null) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| # Resource selection by arn | ||
| resource "aws_backup_selection" "source" { | ||
| for_each = { for bp in flatten([ | ||
| for bp_plan in var.backup_plans : [ | ||
| for resource in bp_plan.resources : { | ||
| backup_plan_key : bp_plan.name | ||
| resource_arn : resource | ||
| } | ||
| ] | ||
| ]) : md5("${bp.backup_plan_key}${bp.resource_arn}") => bp if var.enabled } | ||
|
|
||
| provider = aws.source | ||
| iam_role_arn = module.source_role.arn | ||
| plan_id = aws_backup_plan.source[each.value.backup_plan_key].id | ||
| name = substr("${module.source_label.id}-${each.key}", 0, 50) | ||
| resources = [each.value.resource_arn] | ||
| } | ||
|
|
||
| # Resource selection by tag | ||
| resource "aws_backup_selection" "tag" { | ||
| for_each = { for bp in flatten([ | ||
| for bp_plan in var.backup_plans : [ | ||
| for selection_tag in bp_plan.selection_tags : { | ||
| backup_plan_key : bp_plan.name | ||
| selection_tag : selection_tag | ||
| } | ||
| ] | ||
| ]) : md5("${bp.backup_plan_key}${bp.selection_tag["type"]}${bp.selection_tag["key"]}${bp.selection_tag["value"]}") => bp if var.enabled } | ||
|
|
||
| provider = aws.source | ||
| iam_role_arn = module.source_role.arn | ||
| plan_id = aws_backup_plan.source[each.value.backup_plan_key].id | ||
| name = substr("${module.source_label.id}-${each.key}", 0, 50) | ||
| resources = ["*"] | ||
| selection_tag { | ||
| type = each.value.selection_tag["type"] | ||
| key = each.value.selection_tag["key"] | ||
| value = each.value.selection_tag["value"] | ||
| } | ||
| } | ||
|
|
||
| # Target vault | ||
| resource "aws_backup_vault" "target" { | ||
| count = var.enabled && var.is_cross_account_backup_enabled ? 1 : 0 | ||
| provider = aws.target | ||
| name = module.target_label.id | ||
| kms_key_arn = module.target_kms_key.key_arn | ||
| tags = module.source_label.tags | ||
| force_destroy = true | ||
| } | ||
|
|
||
| resource "aws_backup_vault_policy" "target" { | ||
| count = var.enabled && var.is_cross_account_backup_enabled ? 1 : 0 | ||
| provider = aws.target | ||
| backup_vault_name = aws_backup_vault.target[0].name | ||
| policy = data.aws_iam_policy_document.target_vault[0].json | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| variable "namespace" { | ||
| type = string | ||
| default = null | ||
| description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique" | ||
| } | ||
|
|
||
| variable "environment" { | ||
| type = string | ||
| default = null | ||
| description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'" | ||
| } | ||
|
|
||
| variable "stage" { | ||
| type = string | ||
| default = null | ||
| description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'" | ||
| } | ||
|
|
||
| variable "name" { | ||
| type = string | ||
| default = null | ||
| description = <<-EOT | ||
| ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. | ||
| This is the only ID element not also included as a `tag`. | ||
| The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | ||
| EOT | ||
| } | ||
|
|
||
| variable "attributes" { | ||
| type = list(string) | ||
| default = [] | ||
| description = <<-EOT | ||
| ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, | ||
| in the order they appear in the list. New attributes are appended to the | ||
| end of the list. The elements of the list are joined by the `delimiter` | ||
| and treated as a single ID element. | ||
| EOT | ||
| } | ||
|
|
||
| variable "tags" { | ||
| type = map(string) | ||
| default = {} | ||
| description = <<-EOT | ||
| Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). | ||
| Neither the tag keys nor the tag values will be modified by this module. | ||
| EOT | ||
| } | ||
|
|
||
| variable "context" { | ||
| type = any | ||
| default = { | ||
| enabled = true | ||
| namespace = null | ||
| tenant = null | ||
| environment = null | ||
| stage = null | ||
| name = null | ||
| delimiter = null | ||
| attributes = [] | ||
| tags = {} | ||
| additional_tag_map = {} | ||
| regex_replace_chars = null | ||
| label_order = [] | ||
| id_length_limit = null | ||
| label_key_case = null | ||
| label_value_case = null | ||
| descriptor_formats = {} | ||
| # Note: we have to use [] instead of null for unset lists due to | ||
| # https://github.com/hashicorp/terraform/issues/28137 | ||
| # which was not fixed until Terraform 1.0.0, | ||
| # but we want the default to be all the labels in `label_order` | ||
| # and we want users to be able to prevent all tag generation | ||
| # by setting `labels_as_tags` to `[]`, so we need | ||
| # a different sentinel to indicate "default" | ||
| labels_as_tags = ["unset"] | ||
| } | ||
| description = <<-EOT | ||
| Single object for setting entire context at once. | ||
| See description of individual variables for details. | ||
| Leave string and numeric variables as `null` to use default value. | ||
| Individual variable settings (non-null) override settings in context object, | ||
| except for attributes, tags, and additional_tag_map, which are merged. | ||
| EOT | ||
|
|
||
| validation { | ||
| condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) | ||
| error_message = "Allowed values: `lower`, `title`, `upper`." | ||
| } | ||
|
|
||
| validation { | ||
| condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) | ||
| error_message = "Allowed values: `lower`, `title`, `upper`, `none`." | ||
| } | ||
| } |
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.