terraform-aws-backup Terraform Module

The secure_backup_configuration example is designed to implement a high-security posture for AWS Backup. It is composed of several functional modules:

• Encryption at Rest: Uses customer-managed KMS keys with separate keys for primary and cross-region backups to ensure isolation and proper rotation.
• Access Control: Implements least-privilege IAM roles and resource-based policies.
• Compliance: Utilizes AWS Backup Vault Lock to prevent accidental or malicious deletion, alongside minimum retention periods.
• Monitoring: Integrates CloudWatch alarms for backup failures, SNS for security event notifications, and CloudTrail for audit logging.

File Structure:

• main.tf: Core backup configuration.
• kms.tf: KMS key management.
• monitoring.tf: CloudWatch alarms and monitoring setup.
• variables.tf: Input variable definitions.
• outputs.tf: Exported resource values.
• versions.tf: Provider version constraints.
• terraform.tfvars.example: Template for providing variable values.

The module uses a Terraform Hermes cron job to automate the discovery of new AWS Backup features and provider updates. This replaces the previous GitHub Actions workflow. The process runs weekly to identify new resources, arguments, or deprecations, ensuring the module stays up to date with the AWS provider and AWS Backup service.

Discovery Categories:

• New Features (enhancement label): Identifies new aws_backup_* resources, new arguments, new data sources, compliance capabilities, cross-region/DR features, cost optimization, organization-wide governance, and VSS/Windows integration.
• Deprecations (deprecation label): Identifies arguments marked for removal, phased-out resources, non-recommended patterns, or outdated configuration approaches.
• Bug Fixes (bug label): Identifies provider fixes, security patches, or performance/reliability improvements.

Findings are reported via Telegram and GitHub issues are only created if the finding is significant, actionable, and source-backed.

The cost-optimized strategy uses a multi-tier approach to balance protection and storage costs. It leverages two key features:

1. Archive Tier Support (opt_in_to_archive_for_supported_resources): Automatically transitions backups to archive storage for supported resources (EBS, RDS, Aurora, EFS, FSx, DocumentDB, and Neptune), providing up to 90% cost savings.
2. Timezone-Aware Scheduling (schedule_expression_timezone): Uses IANA timezones (e.g., America/New_York) to ensure consistent backup windows and automatic daylight saving time adjustments.

Tiered Strategy Model

The selections argument allows you to specify which AWS resources are included in a backup plan. There are three primary ways to define selections:

1. By Resources and Tags: Provide specific ARNs in resources and filter them using selection_tags. Each tag requires a type (e.g., STRINGEQUALS), a key, and a value.
2. By Resources Only: Provide a list of ARNs in the resources field.
3. By Resources and Conditions: Use the conditions map to apply complex logic to resource tags. Supported condition keys include:
   • string_equals
   • string_like
   • string_not_equals
   • string_not_like

Each condition entry uses a key (e.g., aws:ResourceTag/Component) and a value.

selections = [
  {
    name          = "selection-1"
    resources     = ["arn:aws:dynamodb:us-east-1:123456789101:table/mydynamodb-table1"]
    selection_tags = [
      {
        type  = "STRINGEQUALS"
        key   = "Environment"
        value = "production"
      }
    ]
  },
  {
    name      = "selection-2"
    resources = ["arn:aws:dynamodb:us-east-1:123456789101:table/mydynamodb-table2"]
  },
  {
    name      = "selection-3"
    resources = ["arn:aws:dynamodb:us-east-1:123456789101:table/mydynamodb-table3"
    conditions = {
      string_equals = [
        { key = "aws:ResourceTag/Component", value = "rds" }
      ]
      string_like = [
        { key = "aws:ResourceTag/Application", value = "app*" }
      ]
    }
  }
]

When defining a backup plan, you can control how backups are executed and which resources are targeted using rules and selections blocks.

Backup Rules (rules)

Each rule in the rules list defines a specific backup behavior:

• schedule: A cron expression defining when the backup runs.
• lifecycle: A map containing cold_storage_after (days before moving to cold storage) and delete_after (total retention days).
• target_vault_name: The name of the vault where the backup is stored. If null, it uses the module's primary vault_name.
• recovery_point_tags: Tags applied to the recovery points created by this rule.
• copy_actions: A list of actions to copy the recovery point to other vaults (must be initialized as an empty list [] if no actions are provided).

Resource Selections (selections)

Use the selections block to specify which AWS resources should be backed up based on tags:

• selection_tags: A list of tag filters. Each filter requires a type (e.g., STRINGEQUALS), a key, and a value.

Adjust start_window and completion_window (in minutes) based on the expected size of the resources to ensure backups complete within their allotted time without wasting window capacity.

• Small (< 1GB): 1h start, 2h completion.
• Medium (1-100GB): 2h start, 8h completion.
• Large (> 100GB): 4h start, 24h completion.

# Small resources (< 1GB)
rules = [
  {
    name              = "small_resources"
    schedule          = "cron(0 2 * * ? *)"
    start_window      = 60    # 1 hour
    completion_window = 120   # 2 hours
  }
]

# Medium resources (1-100GB)
rules = [
  {
    name              = "medium_resources"
    schedule          = "cron(0 2 * * ? *)"
    start_window      = 120   # 2 hours
    completion_window = 480   # 8 hours
  }
]

# Large resources (> 100GB)
rules = [
  {
    name              = "large_resources"
    schedule          = "cron(0 2 * * ? *)"
    start_window      = 240   # 4 hours
    completion_window = 1440  # 24 hours
  }
]

This example demonstrates how to use the terraform-aws-backup module to implement organization-wide backup policies using different criticality levels. It uses tag-based selection to automatically assign backup plans to resources.

Strategy Overview

• Critical Systems: High retention (365 days), uses cold storage after 30 days, and includes cross-region copies.
• Standard Systems: Lower retention (90 days), no cold storage, and includes cross-region copies.

Key Components

• Backup Plan Configuration: Defines rules for scheduling, lifecycle (cold storage and deletion), and recovery point tagging.
• Vault Configuration: Sets minimum and maximum retention periods to ensure compliance.
• Resource Selection: Uses selection_tag to identify resources based on specific key-value pairs (e.g., Criticality = high).

module "aws_backup_example" {
  source = "../.."

  # Backup Plan configuration
  plan_name = "organization_backup_plan"

  # Vault configuration
  vault_name         = "organization_backup_vault"
  min_retention_days = 7
  max_retention_days = 365

  rules = [
    {
      name                     = "critical_systems"
      target_vault_name        = "critical_systems_vault"
      schedule                 = "cron(0 5 ? * * *)"
      start_window             = 480
      completion_window        = 561
      enable_continuous_backup = false
      lifecycle = {
        cold_storage_after = 30
        delete_after       = 365
      }
      recovery_point_tags = {
        Environment = "prod"
        Criticality = "high"
      }
      copy_actions = [
        {
          destination_vault_arn = "arn:aws:backup:us-east-1:123456789012:backup-vault:secondary_vault"
          lifecycle = {
            cold_storage_after = 30
            delete_after       = 365
          }
        }
      ]
    },
    {
      name                     = "standard_systems"
      target_vault_name        = "standard_systems_vault"
      schedule                 = "cron(0 5 ? * * *)"
      start_window             = 480
      completion_window        = 561
      enable_continuous_backup = false
      lifecycle = {
        cold_storage_after = 0
        delete_after       = 90
      }
      recovery_point_tags = {
        Environment = "prod"
        Criticality = "standard"
      }
      copy_actions = [
        {
          destination_vault_arn = "arn:aws:backup:us-east-1:123456789012:backup-vault:secondary_vault"
          lifecycle = {
            cold_storage_after = 0
            delete_after       = 90
          }
        }
      ]
    }
  ]

  # Selection configuration
  selections = [
    {
      name = "critical_systems"
      selection_tag = {
        type  = "STRINGEQUALS"
        key   = "Criticality"
        value = "high"
      }
    },
    {
      name = "standard_systems"
      selection_tag = {
        type  = "STRINGEQUALS"
        key   = "Criticality"
        value = "standard"
      }
    }
  ]

  tags = {
    Environment = "prod"
    Project     = "organization_backup"
  }
}