-
Notifications
You must be signed in to change notification settings - Fork 45
/
backup_function.tf
127 lines (114 loc) · 4.27 KB
/
backup_function.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
resource "aws_iam_role" "ebs_backup_role" {
name = "ebs_backup_role"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Effect": "Allow",
"Sid": ""
}
]
}
EOF
}
resource "aws_iam_role_policy" "ebs_backup_policy" {
name = "ebs_backup_policy"
role = "${aws_iam_role.ebs_backup_role.id}"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["logs:*"],
"Resource": "arn:aws:logs:*:*:*"
},
{
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot",
"ec2:DeleteSnapshot",
"ec2:CreateTags",
"ec2:ModifySnapshotAttribute",
"ec2:ResetSnapshotAttribute"
],
"Resource": ["*"]
}
]
}
EOF
}
data "archive_file" "schedule_ebs_snapshot_backups_zip" {
type = "zip"
source_file = "${path.module}/schedule-ebs-snapshot-backups.py"
output_path = "${path.module}/schedule-ebs-snapshot-backups.zip"
}
resource "aws_lambda_function" "schedule_ebs_snapshot_backups" {
filename = "${path.module}/schedule-ebs-snapshot-backups.zip"
function_name = "schedule_ebs_snapshot_backups"
description = "Automatically backs up instances tagged with backup: true"
role = "${aws_iam_role.ebs_backup_role.arn}"
timeout = 60
handler = "schedule-ebs-snapshot-backups.lambda_handler"
runtime = "python2.7"
source_code_hash = "${data.archive_file.schedule_ebs_snapshot_backups_zip.output_base64sha256}"
}
data "archive_file" "ebs_snapshot_janitor_zip" {
type = "zip"
source_file = "${path.module}/ebs-snapshot-janitor.py"
output_path = "${path.module}/ebs-snapshot-janitor.zip"
}
resource "aws_lambda_function" "ebs_snapshot_janitor" {
filename = "${path.module}/ebs-snapshot-janitor.zip"
function_name = "ebs_snapshot_janitor"
description = "Cleans up old EBS backups"
role = "${aws_iam_role.ebs_backup_role.arn}"
timeout = 60
handler = "ebs-snapshot-janitor.lambda_handler"
runtime = "python2.7"
source_code_hash = "${data.archive_file.ebs_snapshot_janitor_zip.output_base64sha256}"
}
resource "aws_cloudwatch_event_rule" "schedule_ebs_snapshot_backups" {
name = "schedule_ebs_snapshot_backups"
description = "Schedule for ebs snapshot backups"
schedule_expression = "${var.ebs_snapshot_backups_schedule}"
}
resource "aws_cloudwatch_event_rule" "schedule_ebs_snapshot_janitor" {
name = "schedule_ebs_snapshot_janitor"
description = "Schedule for ebs snapshot janitor"
schedule_expression = "${var.ebs_snapshot_janitor_schedule}"
}
resource "aws_cloudwatch_event_target" "schedule_ebs_snapshot_backups" {
rule = "${aws_cloudwatch_event_rule.schedule_ebs_snapshot_backups.name}"
target_id = "schedule_ebs_snapshot_backups"
arn = "${aws_lambda_function.schedule_ebs_snapshot_backups.arn}"
}
resource "aws_cloudwatch_event_target" "schedule_ebs_snapshot_janitor" {
rule = "${aws_cloudwatch_event_rule.schedule_ebs_snapshot_janitor.name}"
target_id = "ebs_snapshot_janitor"
arn = "${aws_lambda_function.ebs_snapshot_janitor.arn}"
}
resource "aws_lambda_permission" "allow_cloudwatch_to_call_backup" {
statement_id = "AllowExecutionFromCloudWatch_schedule_ebs_snapshot_backups"
action = "lambda:InvokeFunction"
function_name = "${aws_lambda_function.schedule_ebs_snapshot_backups.function_name}"
principal = "events.amazonaws.com"
source_arn = "${aws_cloudwatch_event_rule.schedule_ebs_snapshot_backups.arn}"
}
resource "aws_lambda_permission" "allow_cloudwatch_to_call_janitor" {
statement_id = "AllowExecutionFromCloudWatch_ebs_snapshot_janitor"
action = "lambda:InvokeFunction"
function_name = "${aws_lambda_function.ebs_snapshot_janitor.function_name}"
principal = "events.amazonaws.com"
source_arn = "${aws_cloudwatch_event_rule.schedule_ebs_snapshot_janitor.arn}"
}