Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(backup): Add vault lock configuration #4

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

feat(backup): Add vault lock configuration #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
81b9602
feat(backup): Add vault lock configuration
Balsir Dec 18, 2024
049de60
feat(backup): Add vault lock configuration
Balsir Dec 18, 2024
67fdf54
Update variables.tf
Balsir Dec 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,13 +10,15 @@ repos:
- id: end-of-file-fixer

- repo: https://github.com/antonbabenko/pre-commit-terraform
rev: v1.75.0
rev: v1.86.0
hooks:
- id: terraform_fmt
- id: terraform_tflint
- id: terraform_validate
exclude: '^[^/]+$'
- id: terraform_checkov
args:
- --args=--quiet --skip-check CKV2_GHA_1,CKV_TF_1
- id: terraform_docs
args:
- '--args=--config=.terraform-docs.yml'
Expand Down
4 changes: 4 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,8 @@ Check out other [terraform modules](https://github.com/orgs/lablabs/repositories
| [aws_backup_selection.tag](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_selection) | resource |
| [aws_backup_vault.source](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_vault) | resource |
| [aws_backup_vault.target](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_vault) | resource |
| [aws_backup_vault_lock_configuration.source](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_vault_lock_configuration) | resource |
| [aws_backup_vault_lock_configuration.target](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_vault_lock_configuration) | resource |
| [aws_backup_vault_policy.source](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_vault_policy) | resource |
| [aws_backup_vault_policy.target](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_vault_policy) | resource |
| [aws_caller_identity.source](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
Expand All @@ -73,6 +75,8 @@ Check out other [terraform modules](https://github.com/orgs/lablabs/repositories
| <a name="input_namespace"></a> [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
| <a name="input_stage"></a> [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
| <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).<br>Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no |
| <a name="input_vault_lock_configuration"></a> [vault\_lock\_configuration](#input\_vault\_lock\_configuration) | Vault lock configuration. If `changeable_for_days` is null, governance mode is set, otherwise, immutable compliance mode. | <pre>object({<br> changeable_for_days = optional(number, null) # If omitted, governance mode is set, otherwise, immutable compliance mode<br> max_retention_days = optional(number, null)<br> min_retention_days = optional(number, null)<br> })</pre> | `{}` | no |
| <a name="input_vault_lock_enabled"></a> [vault\_lock\_enabled](#input\_vault\_lock\_enabled) | Set to true to enable Vault Lock. Defaults to false. WARNING: If lock is enabled, backup plans and vaults may become immutable to all parties. | `bool` | `false` | no |

## Outputs

Expand Down
16 changes: 16 additions & 0 deletions aws_backup.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,14 @@ resource "aws_backup_selection" "tag" {
}
}

resource "aws_backup_vault_lock_configuration" "source" {
count = var.enabled && var.vault_lock_enabled ? 1 : 0
backup_vault_name = module.source_label.id
changeable_for_days = var.vault_lock_configuration.changeable_for_days
max_retention_days = var.vault_lock_configuration.max_retention_days
min_retention_days = var.vault_lock_configuration.min_retention_days
}

# Target vault
resource "aws_backup_vault" "target" {
count = var.enabled && var.is_cross_account_backup_enabled ? 1 : 0
Expand All @@ -127,3 +135,11 @@ resource "aws_backup_vault_policy" "target" {
backup_vault_name = aws_backup_vault.target[0].name
policy = data.aws_iam_policy_document.target_vault[0].json
}

resource "aws_backup_vault_lock_configuration" "target" {
count = var.enabled && var.is_cross_account_backup_enabled && var.vault_lock_enabled ? 1 : 0
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it make sense to have vault lock enabled only in the target account, but not in the source one? If so, can we add support for this setup?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Personally, I would only have this module handle just one vault, and have source/target replication handled in the integration via 2 module calls and extra params.

I haven't found any evidence as to how Backup behaves if lock is enabled only on one side, but yeah, we can split the config.

backup_vault_name = module.target_label.id
changeable_for_days = var.vault_lock_configuration.changeable_for_days
max_retention_days = var.vault_lock_configuration.max_retention_days
min_retention_days = var.vault_lock_configuration.min_retention_days
}
2 changes: 2 additions & 0 deletions iam.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,7 @@ data "aws_iam_policy_document" "source_vault" {
actions = ["backup:CopyIntoBackupVault"]

#checkov:skip=CKV_AWS_109
#checkov:skip=CKV_AWS_111
resources = ["*"]

principals {
Expand All @@ -94,6 +95,7 @@ data "aws_iam_policy_document" "target_vault" {
actions = ["backup:CopyIntoBackupVault"]

#checkov:skip=CKV_AWS_109
#checkov:skip=CKV_AWS_111
resources = ["*"]

principals {
Expand Down
4 changes: 4 additions & 0 deletions kms.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@ data "aws_iam_policy_document" "kms_source_policy" {
actions = ["kms:*"]

#checkov:skip=CKV_AWS_109
#checkov:skip=CKV_AWS_356
resources = ["*"]

principals {
Expand All @@ -71,6 +72,7 @@ data "aws_iam_policy_document" "kms_source_policy" {
]

#checkov:skip=CKV_AWS_109
#checkov:skip=CKV_AWS_356
resources = ["*"]

principals {
Expand All @@ -92,6 +94,7 @@ data "aws_iam_policy_document" "kms_target_policy" {
actions = ["kms:*"]

#checkov:skip=CKV_AWS_109
#checkov:skip=CKV_AWS_356
resources = ["*"]

principals {
Expand All @@ -115,6 +118,7 @@ data "aws_iam_policy_document" "kms_target_policy" {
]

#checkov:skip=CKV_AWS_109
#checkov:skip=CKV_AWS_356
resources = ["*"]

principals {
Expand Down
16 changes: 16 additions & 0 deletions variables.tf
View file
Open in desktop
jaygridley marked this conversation as resolved.
Show resolved Hide resolved
Original file line number Diff line number Diff line change
Expand Up @@ -43,3 +43,19 @@ variable "backup_plans" {
}), null)
}))
}

variable "vault_lock_enabled" {
type = bool
description = "Set to `true` to enable Vault Lock. Defaults to `false`. WARNING: If lock is enabled, backup plans and vaults may become immutable to all parties."
default = false
}

variable "vault_lock_configuration" {
type = object({
changeable_for_days = optional(number, null) # If omitted, governance mode is set, otherwise, immutable compliance mode
max_retention_days = optional(number, null)
min_retention_days = optional(number, null)
})
description = "Vault lock configuration. If `changeable_for_days` is null, governance mode is set, otherwise, immutable compliance mode."
default = {}
}
Loading