diff --git a/modules/aws-backup-source/README.md b/modules/aws-backup-source/README.md index 6129c28..8057f95 100644 --- a/modules/aws-backup-source/README.md +++ b/modules/aws-backup-source/README.md @@ -84,6 +84,7 @@ No modules. | [parameter_store_backup_config](#input_parameter_store_backup_config) | Configuration for the scheduled Lambda function to backup tagged Parameter Store parameters to S3. |
object({ enable = bool selection_tag = string selection_tag_value = optional(string) selection_tags = optional(list(object({ key = optional(string) value = optional(string) }))) lambda_backup_cron = optional(string) lambda_timeout_seconds = optional(number) air_gapped_kms_key_arn = optional(string) s3_bucket_name = optional(string) rules = optional(list(object({ name = string schedule = string completion_window = optional(number) enable_continuous_backup = optional(bool) lifecycle = object({ delete_after = number cold_storage_after = optional(number) }) copy_action = optional(object({ delete_after = optional(number) })) }))) }) | { "air_gapped_kms_key_arn": "", "enable": true, "lambda_backup_cron": "cron(0 6 * * ? *)", "lambda_timeout_seconds": 300, "rules": [ { "copy_action": { "delete_after": 365 }, "lifecycle": { "delete_after": 35 }, "name": "daily_kept_5_weeks", "schedule": "cron(0 0 * * ? *)" }, { "copy_action": { "delete_after": 365 }, "lifecycle": { "delete_after": 90 }, "name": "weekly_kept_3_months", "schedule": "cron(0 1 ? * SUN *)" }, { "copy_action": { "delete_after": 365 }, "lifecycle": { "cold_storage_after": 30, "delete_after": 2555 }, "name": "monthly_kept_7_years", "schedule": "cron(0 2 1 * ? *)" }, { "copy_action": { "delete_after": 365 }, "enable_continuous_backup": true, "lifecycle": { "delete_after": 35 }, "name": "point_in_time_recovery", "schedule": "cron(0 5 * * ? *)" } ], "s3_bucket_name": "", "selection_tag": "BackupParameterStore", "selection_tag_value": "True", "selection_tags": [] } | no |
| [bootstrap\_kms\_key\_arn](#input\_bootstrap\_kms\_key\_arn) | The ARN of the bootstrap KMS key used for encryption at rest of the SNS topic. | `string` | n/a | yes |
| [environment\_name](#input\_environment\_name) | The name of the environment where AWS Backup is configured. | `string` | n/a | yes |
+| [lambda\_insights\_enable](#input\_lambda\_insights\_enable) | Enable the Lambda functions to generate lambda-insights. | `bool` | `false` | no |
| [name\_prefix](#input\_name\_prefix) | Optional name prefix for vault resources | `string` | `null` | no |
| [notifications\_target\_email\_address](#input\_notifications\_target\_email\_address) | The email address to which backup notifications will be sent via SNS. | `string` | `""` | no |
| [project\_name](#input\_project\_name) | The name of the project this relates to. | `string` | n/a | yes |
diff --git a/modules/aws-backup-source/lambda_copy_recovery_point.tf b/modules/aws-backup-source/lambda_copy_recovery_point.tf
index 860d150..6db3e21 100644
--- a/modules/aws-backup-source/lambda_copy_recovery_point.tf
+++ b/modules/aws-backup-source/lambda_copy_recovery_point.tf
@@ -69,6 +69,8 @@ resource "aws_lambda_function" "lambda_copy_recovery_point" {
source_code_hash = data.archive_file.lambda_copy_recovery_point_zip[0].output_base64sha256
timeout = var.lambda_copy_recovery_point_max_wait_minutes * 60
+ layers = var.lambda_insights_enable ? [local.lambda_insights_layer_arn] : []
+
environment {
variables = {
POLL_INTERVAL_SECONDS = var.lambda_copy_recovery_point_poll_interval_seconds
diff --git a/modules/aws-backup-source/lambda_parameter_store_backup.tf b/modules/aws-backup-source/lambda_parameter_store_backup.tf
index db56553..6760b8e 100644
--- a/modules/aws-backup-source/lambda_parameter_store_backup.tf
+++ b/modules/aws-backup-source/lambda_parameter_store_backup.tf
@@ -126,6 +126,9 @@ resource "aws_lambda_function" "lambda_parameter_store_backup" {
handler = "parameter_store_backup.lambda_handler"
runtime = "python3.12"
timeout = var.backup_plan_config_parameter_store.lambda_timeout_seconds
+
+ layers = var.lambda_insights_enable ? [local.lambda_insights_layer_arn] : []
+
environment {
variables = {
KMS_KEY_ARN = var.destination_parameter_store_kms_key_arn
diff --git a/modules/aws-backup-source/lambda_post_build_version.tf b/modules/aws-backup-source/lambda_post_build_version.tf
index 66d5f20..04dc666 100644
--- a/modules/aws-backup-source/lambda_post_build_version.tf
+++ b/modules/aws-backup-source/lambda_post_build_version.tf
@@ -66,6 +66,9 @@ resource "aws_lambda_function" "lambda_post_build_version" {
role = aws_iam_role.iam_for_lambda_post_build_version.arn
handler = "post_build_version.lambda_handler"
runtime = "python3.12"
+
+ layers = var.lambda_insights_enable ? [local.lambda_insights_layer_arn] : []
+
environment {
variables = {
AWS_ACCOUNT_ID = data.aws_caller_identity.current.account_id
diff --git a/modules/aws-backup-source/lambda_restore_to_s3.tf b/modules/aws-backup-source/lambda_restore_to_s3.tf
index d7fead2..490a6c0 100644
--- a/modules/aws-backup-source/lambda_restore_to_s3.tf
+++ b/modules/aws-backup-source/lambda_restore_to_s3.tf
@@ -79,6 +79,8 @@ resource "aws_lambda_function" "lambda_restore_to_s3" {
source_code_hash = data.archive_file.lambda_restore_to_s3_zip[0].output_base64sha256
timeout = var.lambda_restore_to_s3_max_wait_minutes * 60
+ layers = var.lambda_insights_enable ? [local.lambda_insights_layer_arn] : []
+
environment {
variables = {
POLL_INTERVAL_SECONDS = var.lambda_restore_to_s3_poll_interval_seconds
diff --git a/modules/aws-backup-source/locals.tf b/modules/aws-backup-source/locals.tf
index 64f4d5b..9a5bc56 100644
--- a/modules/aws-backup-source/locals.tf
+++ b/modules/aws-backup-source/locals.tf
@@ -21,4 +21,6 @@ locals {
))
aurora_overrides = var.backup_plan_config_aurora.restore_testing_overrides == null ? null : jsondecode(var.backup_plan_config_aurora.restore_testing_overrides)
terraform_role_arns = length(var.terraform_role_arns) > 0 ? var.terraform_role_arns : [var.terraform_role_arn]
+
+ lambda_insights_layer_arn = "arn:aws:lambda:eu-west-2:580247275435:layer:LambdaInsightsExtension:66"
}
diff --git a/modules/aws-backup-source/variables.tf b/modules/aws-backup-source/variables.tf
index 599072c..9b74a11 100644
--- a/modules/aws-backup-source/variables.tf
+++ b/modules/aws-backup-source/variables.tf
@@ -538,3 +538,9 @@ variable "lambda_restore_to_s3_max_wait_minutes" {
type = number
default = 5
}
+
+variable "lambda_insights_enable" {
+ description = "Enable the Lambda functions to generate insights from backup data."
+ type = bool
+ default = false
+}