aws-backup/BACKUP-Bronze.yaml at master · ankitosh/aws-backup · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
Parameters:
  KMSKey:
   Description: "KMS KEY ARN to ENCRYPT the Vaults"
   Type: String
   Default: ""
Resources:
  BackupRoleBronze:
    Type: "AWS::IAM::Role"
    Properties:
     RoleName: "BRONZE-ROLE"
     AssumeRolePolicyDocument:
       Version: "2012-10-17"
       Statement:
         -
          Effect: "Allow"
          Principal:
            Service:
              - "backup.amazonaws.com"
          Action:
            - "sts:AssumeRole"
     ManagedPolicyArns:
       - "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
       - "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores"

## Weekly Backup

  BronzeBackups:
    Type: "AWS::Backup::BackupVault"
    Properties:
      BackupVaultName: "BRONZE-BACKUP-VAULT"
      EncryptionKeyArn: !Ref KMSKey

  BackupPlanWithWeeklyBackups:
    Type: "AWS::Backup::BackupPlan"
    Properties:
      BackupPlan:
        BackupPlanName: "BRONZE-BACKUP-PLAN"
        BackupPlanRule:
          -
            RuleName: "BRONZE-BACKUP-RULE"
            TargetBackupVault: !Ref BronzeBackups
            ScheduleExpression: "cron(0 0 ? * FRI *)"
            Lifecycle:
              DeleteAfterDays: 10
              #MoveToColdStorageAfterDays: 10
    DependsOn: BronzeBackups


  TagBasedBackupSelectionWeekly:
    Type: "AWS::Backup::BackupSelection"
    Properties:
      BackupSelection:
        SelectionName: "TagBasedBackupSelectionWeekly"
        IamRoleArn: !GetAtt BackupRoleBronze.Arn
        ListOfTags:
         -
           ConditionType: "STRINGEQUALS"
           ConditionKey: "BACKUP"
           ConditionValue: "Bronze"
      BackupPlanId: !Ref BackupPlanWithWeeklyBackups
    DependsOn: BackupPlanWithWeeklyBackups