diff --git a/modules/aws-backup-source/README.md b/modules/aws-backup-source/README.md index 6129c28..8057f95 100644 --- a/modules/aws-backup-source/README.md +++ b/modules/aws-backup-source/README.md @@ -84,6 +84,7 @@ No modules. | [parameter_store_backup_config](#input_parameter_store_backup_config) | Configuration for the scheduled Lambda function to backup tagged Parameter Store parameters to S3. |
object({ enable = bool selection_tag = string selection_tag_value = optional(string) selection_tags = optional(list(object({ key = optional(string) value = optional(string) }))) lambda_backup_cron = optional(string) lambda_timeout_seconds = optional(number) air_gapped_kms_key_arn = optional(string) s3_bucket_name = optional(string) rules = optional(list(object({ name = string schedule = string completion_window = optional(number) enable_continuous_backup = optional(bool) lifecycle = object({ delete_after = number cold_storage_after = optional(number) }) copy_action = optional(object({ delete_after = optional(number) })) }))) })
|
{ "air_gapped_kms_key_arn": "", "enable": true, "lambda_backup_cron": "cron(0 6 * * ? *)", "lambda_timeout_seconds": 300, "rules": [ { "copy_action": { "delete_after": 365 }, "lifecycle": { "delete_after": 35 }, "name": "daily_kept_5_weeks", "schedule": "cron(0 0 * * ? *)" }, { "copy_action": { "delete_after": 365 }, "lifecycle": { "delete_after": 90 }, "name": "weekly_kept_3_months", "schedule": "cron(0 1 ? * SUN *)" }, { "copy_action": { "delete_after": 365 }, "lifecycle": { "cold_storage_after": 30, "delete_after": 2555 }, "name": "monthly_kept_7_years", "schedule": "cron(0 2 1 * ? *)" }, { "copy_action": { "delete_after": 365 }, "enable_continuous_backup": true, "lifecycle": { "delete_after": 35 }, "name": "point_in_time_recovery", "schedule": "cron(0 5 * * ? *)" } ], "s3_bucket_name": "", "selection_tag": "BackupParameterStore", "selection_tag_value": "True", "selection_tags": [] }
| no | | [bootstrap\_kms\_key\_arn](#input\_bootstrap\_kms\_key\_arn) | The ARN of the bootstrap KMS key used for encryption at rest of the SNS topic. | `string` | n/a | yes | | [environment\_name](#input\_environment\_name) | The name of the environment where AWS Backup is configured. | `string` | n/a | yes | +| [lambda\_insights\_enable](#input\_lambda\_insights\_enable) | Enable the Lambda functions to generate lambda-insights. | `bool` | `false` | no | | [name\_prefix](#input\_name\_prefix) | Optional name prefix for vault resources | `string` | `null` | no | | [notifications\_target\_email\_address](#input\_notifications\_target\_email\_address) | The email address to which backup notifications will be sent via SNS. | `string` | `""` | no | | [project\_name](#input\_project\_name) | The name of the project this relates to. | `string` | n/a | yes | diff --git a/modules/aws-backup-source/lambda_copy_recovery_point.tf b/modules/aws-backup-source/lambda_copy_recovery_point.tf index 860d150..6db3e21 100644 --- a/modules/aws-backup-source/lambda_copy_recovery_point.tf +++ b/modules/aws-backup-source/lambda_copy_recovery_point.tf @@ -69,6 +69,8 @@ resource "aws_lambda_function" "lambda_copy_recovery_point" { source_code_hash = data.archive_file.lambda_copy_recovery_point_zip[0].output_base64sha256 timeout = var.lambda_copy_recovery_point_max_wait_minutes * 60 + layers = var.lambda_insights_enable ? [local.lambda_insights_layer_arn] : [] + environment { variables = { POLL_INTERVAL_SECONDS = var.lambda_copy_recovery_point_poll_interval_seconds diff --git a/modules/aws-backup-source/lambda_parameter_store_backup.tf b/modules/aws-backup-source/lambda_parameter_store_backup.tf index db56553..6760b8e 100644 --- a/modules/aws-backup-source/lambda_parameter_store_backup.tf +++ b/modules/aws-backup-source/lambda_parameter_store_backup.tf @@ -126,6 +126,9 @@ resource "aws_lambda_function" "lambda_parameter_store_backup" { handler = "parameter_store_backup.lambda_handler" runtime = "python3.12" timeout = var.backup_plan_config_parameter_store.lambda_timeout_seconds + + layers = var.lambda_insights_enable ? [local.lambda_insights_layer_arn] : [] + environment { variables = { KMS_KEY_ARN = var.destination_parameter_store_kms_key_arn diff --git a/modules/aws-backup-source/lambda_post_build_version.tf b/modules/aws-backup-source/lambda_post_build_version.tf index 66d5f20..04dc666 100644 --- a/modules/aws-backup-source/lambda_post_build_version.tf +++ b/modules/aws-backup-source/lambda_post_build_version.tf @@ -66,6 +66,9 @@ resource "aws_lambda_function" "lambda_post_build_version" { role = aws_iam_role.iam_for_lambda_post_build_version.arn handler = "post_build_version.lambda_handler" runtime = "python3.12" + + layers = var.lambda_insights_enable ? [local.lambda_insights_layer_arn] : [] + environment { variables = { AWS_ACCOUNT_ID = data.aws_caller_identity.current.account_id diff --git a/modules/aws-backup-source/lambda_restore_to_s3.tf b/modules/aws-backup-source/lambda_restore_to_s3.tf index d7fead2..490a6c0 100644 --- a/modules/aws-backup-source/lambda_restore_to_s3.tf +++ b/modules/aws-backup-source/lambda_restore_to_s3.tf @@ -79,6 +79,8 @@ resource "aws_lambda_function" "lambda_restore_to_s3" { source_code_hash = data.archive_file.lambda_restore_to_s3_zip[0].output_base64sha256 timeout = var.lambda_restore_to_s3_max_wait_minutes * 60 + layers = var.lambda_insights_enable ? [local.lambda_insights_layer_arn] : [] + environment { variables = { POLL_INTERVAL_SECONDS = var.lambda_restore_to_s3_poll_interval_seconds diff --git a/modules/aws-backup-source/locals.tf b/modules/aws-backup-source/locals.tf index 64f4d5b..9a5bc56 100644 --- a/modules/aws-backup-source/locals.tf +++ b/modules/aws-backup-source/locals.tf @@ -21,4 +21,6 @@ locals { )) aurora_overrides = var.backup_plan_config_aurora.restore_testing_overrides == null ? null : jsondecode(var.backup_plan_config_aurora.restore_testing_overrides) terraform_role_arns = length(var.terraform_role_arns) > 0 ? var.terraform_role_arns : [var.terraform_role_arn] + + lambda_insights_layer_arn = "arn:aws:lambda:eu-west-2:580247275435:layer:LambdaInsightsExtension:66" } diff --git a/modules/aws-backup-source/variables.tf b/modules/aws-backup-source/variables.tf index 599072c..9b74a11 100644 --- a/modules/aws-backup-source/variables.tf +++ b/modules/aws-backup-source/variables.tf @@ -538,3 +538,9 @@ variable "lambda_restore_to_s3_max_wait_minutes" { type = number default = 5 } + +variable "lambda_insights_enable" { + description = "Enable the Lambda functions to generate insights from backup data." + type = bool + default = false +}