forked from cevoaustralia/aws-backup-lambda
-
Notifications
You must be signed in to change notification settings - Fork 0
/
cloudformation.yaml
129 lines (125 loc) · 4.59 KB
/
cloudformation.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: A simple backup process for EC2 and RDS datastores, tag your resources with 'MakeSnapshot' = 'True' (casesensitive) to have snapshots taken and managed
Parameters:
SuccessSNSTopicOption:
Description: Supply an either '' (disabled), 'CreateSNS' (build new SNS for this stack), '<sns_arn>' (connect to existing Topic).
Default: ""
Type: String
ErrorSNSTopicOption:
Description: Supply an either '' (disabled), 'CreateSNS' (build new SNS for this stack), '<sns_arn>' (connect to existing Topic).
Default: ""
Type: String
Conditions:
EnableSuccessSNSTopic: !Not [!Equals [!Ref SuccessSNSTopicOption, ""]] #
EnableErrorSNSTopic: !Not [!Equals [!Ref ErrorSNSTopicOption, ""]]
CreateSuccessSNSTopic: !And # We only need to create the Success SNS when it is enabled and not supplied
- Condition: EnableSuccessSNSTopic
- !Equals [!Ref SuccessSNSTopicOption, "CreateSNS"]
CreateErrorSNSTopic: !And # We only need to create the Error SNS when it is enabled and not supplied
- Condition: EnableErrorSNSTopic
- !Equals [!Ref ErrorSNSTopicOption, "CreateSNS"]
Resources:
LambdaExecutionRole:
Type: "AWS::IAM::Role"
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
-
Effect: "Allow"
Principal:
Service:
- "lambda.amazonaws.com"
Action:
- "sts:AssumeRole"
Path: "/"
Policies:
-
PolicyName: "Lambda_execution"
PolicyDocument:
Version: "2012-10-17"
Statement:
-
Effect: "Allow"
Action:
- "logs:*"
Resource: "arn:aws:logs:*:*:*"
-
PolicyName: "sns_publish_policy"
PolicyDocument:
Version: "2012-10-17"
Statement:
-
Effect: "Allow"
Action:
- "sns:Publish"
Resource: "*"
-
PolicyName: "ec2_snapshot_policy"
PolicyDocument:
Version: "2012-10-17"
Statement:
-
Effect: "Allow"
Action:
- "ec2:CreateTags"
- "ec2:UpdateTags"
- "ec2:DescribeTags"
- "ec2:DescribeInstances"
- "ec2:CreateSnapshot"
- "ec2:DescribeSnapshots"
- "ec2:DeleteSnapshot"
- "ec2:DescribeVolumes"
Resource: "*"
-
PolicyName: "rds_snapshot_policy"
PolicyDocument:
Version: "2012-10-17"
Statement:
-
Effect: "Allow"
Action:
- "rds:DescribeDBInstances"
- "rds:DescribeDBSnapshots"
- "rds:ListTagsForResource"
- "rds:DescribeDBSecurityGroups"
- "rds:CreateDBSnapshot"
- "rds:DeleteDBSnapshot"
- "rds:DescribeDBClusterSnapshots"
- "rds:CreateDBClusterSnapshot"
- "rds:DeleteDBClusterSnapshot"
Resource: "*"
SuccessSNSTopic:
Type: "AWS::SNS::Topic"
Condition : CreateSuccessSNSTopic
ErrorSNSTopic:
Type: "AWS::SNS::Topic"
Condition : CreateErrorSNSTopic
BackupFunction:
Type: AWS::Serverless::Function
Properties:
Handler: backuplambda.lambda_handler
Runtime: python2.7
Timeout: 300
Role: !GetAtt LambdaExecutionRole.Arn
CodeUri: 'lambda'
Events:
DailyBackupEvent:
Type: Schedule
Properties:
Schedule: rate(1 day)
Input:
Fn::Join:
- ''
- - '{"period_label": "day", "period_format": "%a%H-%M", "keep_count": 14,'
- '"arn": "'
- !If [EnableSuccessSNSTopic, !If [ CreateSuccessSNSTopic, Ref: SuccessSNSTopic, Ref: SuccessSNSTopicOption], '']
- '", '
- '"error_arn": "'
- !If [EnableErrorSNSTopic, !If [ CreateErrorSNSTopic, Ref: ErrorSNSTopic, Ref: ErrorSNSTopicOption], '']
- '", '
- '"rds_region_name": "'
- Ref: AWS::Region
- '", '
- '"tag_name": "MakeSnapshot", "tag_value": "True" }'