Skip to content

Commit 14b0df9

Browse files
claude[bot]lgallard
claude[bot]
and
lgallard
committed
feat: add support for aws_backup_global_settings
- Add enable_global_settings and global_settings variables with comprehensive validation - Implement conditional aws_backup_global_settings resource in main.tf - Add outputs for global settings management and monitoring - Create backup_global_settings example with full documentation - Enable centralized cross-account backup governance capabilities - Support enterprise compliance and security requirements Closes #235 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Luis M. Gallardo D. <lgallard@users.noreply.github.com>
1 parent 1bc55d9 commit 14b0df9

File tree

8 files changed

+374
-0
lines changed

8 files changed

+374
-0
lines changed

‎examples/backup_global_settings/README.md‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
# AWS Backup Global Settings Example
2+
3+
This example demonstrates how to configure AWS Backup global settings for centralized cross-account backup governance.
4+
5+
## Features Demonstrated
6+
7+
- **Global Settings Management**: Enable and configure AWS Backup global settings
8+
- **Cross-Account Backup**: Enable centralized backup governance across multiple AWS accounts
9+
- **Enterprise Governance**: Account-level settings for backup operations
10+
- **Backup Configuration**: Basic vault, plan, and selection setup with global settings
11+
12+
## Architecture
13+
14+
```
15+
AWS Account (Management/Central)
16+
├── Global Settings (Account-level)
17+
│ └── isCrossAccountBackupEnabled: true
18+
├── Backup Vault
19+
├── Backup Plan
20+
└── Resource Selections
21+
```
22+
23+
## Usage
24+
25+
To run this example you need to execute:
26+
27+
```bash
28+
$ terraform init
29+
$ terraform plan
30+
$ terraform apply
31+
```
32+
33+
Note that this example will create resources which may cost money. Run `terraform destroy` when you don't need these resources.
34+
35+
## Requirements
36+
37+
| Name | Version |
38+
|------|---------|
39+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
40+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.0 |
41+
42+
## Providers
43+
44+
| Name | Version |
45+
|------|---------|
46+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.0 |
47+
48+
## Modules
49+
50+
| Name | Source | Version |
51+
|------|--------|---------|
52+
| <a name="module_aws_backup_global_settings"></a> [aws\_backup\_global\_settings](#module\_aws\_backup\_global\_settings) | ../.. | n/a |
53+
54+
## Resources
55+
56+
Created by the module:
57+
- `aws_backup_global_settings` - Account-level backup settings
58+
- `aws_backup_vault` - Backup vault for storing recovery points
59+
- `aws_backup_plan` - Backup plan with scheduling and lifecycle policies
60+
- `aws_backup_selection` - Resource selection for automated backups
61+
62+
## Inputs
63+
64+
| Name | Description | Type | Default | Required |
65+
|------|-------------|------|---------|:--------:|
66+
| <a name="input_backup_retention_days"></a> [backup\_retention\_days](#input\_backup\_retention\_days) | Number of days to retain backups | `number` | `30` | no |
67+
| <a name="input_backup_schedule"></a> [backup\_schedule](#input\_backup\_schedule) | Cron expression for backup schedule | `string` | `"cron(0 2 * * ? *)"` | no |
68+
| <a name="input_enable_cross_account_backup"></a> [enable\_cross\_account\_backup](#input\_enable\_cross\_account\_backup) | Enable cross-account backup functionality | `bool` | `true` | no |
69+
| <a name="input_tags"></a> [tags](#input\_tags) | A mapping of tags to assign to resources | `map(string)` | `{"BackupGovernance": "centralized", "Environment": "production", "Owner": "backup-team", "Terraform": true}` | no |
70+
| <a name="input_vault_name"></a> [vault\_name](#input\_vault\_name) | Name of the backup vault to create | `string` | `"centralized-backup-vault"` | no |
71+
72+
## Outputs
73+
74+
| Name | Description |
75+
|------|-------------|
76+
| <a name="output_cross_account_backup_enabled"></a> [cross\_account\_backup\_enabled](#output\_cross\_account\_backup\_enabled) | Whether cross-account backup is enabled |
77+
| <a name="output_global_settings"></a> [global\_settings](#output\_global\_settings) | Configured global settings |
78+
| <a name="output_global_settings_id"></a> [global\_settings\_id](#output\_global\_settings\_id) | AWS Account ID where global settings are applied |
79+
| <a name="output_global_settings_summary"></a> [global\_settings\_summary](#output\_global\_settings\_summary) | Summary of global settings configuration |
80+
| <a name="output_plan_arn"></a> [plan\_arn](#output\_plan\_arn) | ARN of the backup plan |
81+
| <a name="output_vault_arn"></a> [vault\_arn](#output\_vault\_arn) | ARN of the backup vault |
82+
83+
## Global Settings Configuration
84+
85+
### Cross-Account Backup Enablement
86+
87+
When `isCrossAccountBackupEnabled` is set to `"true"`:
88+
89+
1. **Centralized Governance**: Enables centralized backup management across AWS accounts
90+
2. **Organization Policies**: Allows AWS Organizations backup policies to be applied
91+
3. **Cross-Account IAM**: Enables backup operations across account boundaries
92+
4. **Compliance**: Supports enterprise compliance frameworks requiring centralized backup
93+
94+
### Enterprise Use Cases
95+
96+
- **Multi-Account Organizations**: Centralized backup governance for AWS Organizations
97+
- **Compliance Requirements**: Meeting regulatory requirements for backup management
98+
- **Security**: Controlled cross-account backup operations
99+
- **Cost Optimization**: Centralized backup strategies and policies
100+
101+
## Next Steps
102+
103+
After deploying this example:
104+
105+
1. **Configure AWS Organizations Backup Policies** for centralized governance
106+
2. **Set up cross-account IAM roles** for backup operations
107+
3. **Implement backup compliance frameworks** across accounts
108+
4. **Monitor backup activities** through AWS CloudTrail and CloudWatch
109+
110+
## Important Notes
111+
112+
- Global settings are **account-level** configurations (one per AWS account)
113+
- Cross-account backup requires proper **IAM permissions** across accounts
114+
- This feature is particularly valuable for **enterprise environments**
115+
- Consider **AWS Organizations integration** for complete centralized governance
116+
117+
## Compliance and Security
118+
119+
This configuration supports:
120+
- SOC 2 compliance for backup governance
121+
- GDPR requirements for data retention
122+
- HIPAA backup and recovery standards
123+
- Financial services backup regulations

‎examples/backup_global_settings/main.tf‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# AWS Backup Global Settings Example
2+
#
3+
# This example demonstrates how to configure AWS Backup global settings
4+
# for centralized cross-account backup governance.
5+
6+
# AWS Backup with Global Settings
7+
module "aws_backup_global_settings" {
8+
source = "../.."
9+
10+
# Enable global settings management
11+
enable_global_settings = true
12+
13+
# Configure global settings for cross-account backup governance
14+
global_settings = {
15+
"isCrossAccountBackupEnabled" = "true"
16+
}
17+
18+
# Basic vault configuration
19+
vault_name = "centralized-backup-vault"
20+
21+
# Basic plan for demonstration
22+
plan_name = "global-settings-plan"
23+
24+
# Simple rule
25+
rules = [
26+
{
27+
name = "daily-backup"
28+
schedule = "cron(0 2 * * ? *)" # Daily at 2 AM
29+
start_window = 120
30+
completion_window = 360
31+
lifecycle = {
32+
delete_after = 30
33+
}
34+
copy_actions = []
35+
recovery_point_tags = {
36+
BackupType = "Automated"
37+
Governance = "Centralized"
38+
Environment = "production"
39+
}
40+
}
41+
]
42+
43+
# Resource selection
44+
selections = [
45+
{
46+
name = "production-resources"
47+
resources = [
48+
"arn:aws:ec2:*:*:instance/*",
49+
"arn:aws:rds:*:*:db:*"
50+
]
51+
selection_tags = [
52+
{
53+
type = "STRINGEQUALS"
54+
key = "Environment"
55+
value = "production"
56+
},
57+
{
58+
type = "STRINGEQUALS"
59+
key = "BackupRequired"
60+
value = "true"
61+
}
62+
]
63+
}
64+
]
65+
66+
tags = {
67+
Owner = "backup-team"
68+
Environment = "production"
69+
BackupGovernance = "centralized"
70+
Terraform = true
71+
}
72+
}

‎examples/backup_global_settings/outputs.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Global Settings Outputs
2+
output "global_settings_id" {
3+
description = "AWS Account ID where global settings are applied"
4+
value = module.aws_backup_global_settings.global_settings_id
5+
}
6+
7+
output "global_settings" {
8+
description = "Configured global settings"
9+
value = module.aws_backup_global_settings.global_settings
10+
}
11+
12+
output "cross_account_backup_enabled" {
13+
description = "Whether cross-account backup is enabled"
14+
value = module.aws_backup_global_settings.cross_account_backup_enabled
15+
}
16+
17+
output "global_settings_summary" {
18+
description = "Summary of global settings configuration"
19+
value = module.aws_backup_global_settings.global_settings_summary
20+
}
21+
22+
# Additional backup outputs for reference
23+
output "vault_arn" {
24+
description = "ARN of the backup vault"
25+
value = module.aws_backup_global_settings.vault_arn
26+
}
27+
28+
output "plan_arn" {
29+
description = "ARN of the backup plan"
30+
value = module.aws_backup_global_settings.plan_arn
31+
}

‎examples/backup_global_settings/variables.tf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Optional variables for customizing the example
2+
3+
variable "vault_name" {
4+
description = "Name of the backup vault to create"
5+
type = string
6+
default = "centralized-backup-vault"
7+
}
8+
9+
variable "enable_cross_account_backup" {
10+
description = "Enable cross-account backup functionality"
11+
type = bool
12+
default = true
13+
}
14+
15+
variable "backup_schedule" {
16+
description = "Cron expression for backup schedule"
17+
type = string
18+
default = "cron(0 2 * * ? *)" # Daily at 2 AM
19+
}
20+
21+
variable "backup_retention_days" {
22+
description = "Number of days to retain backups"
23+
type = number
24+
default = 30
25+
}
26+
27+
variable "tags" {
28+
description = "A mapping of tags to assign to resources"
29+
type = map(string)
30+
default = {
31+
Owner = "backup-team"
32+
Environment = "production"
33+
BackupGovernance = "centralized"
34+
Terraform = true
35+
}
36+
}

‎examples/backup_global_settings/versions.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 5.0"
8+
}
9+
}
10+
}

‎main.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,20 @@ resource "aws_backup_plan" "ab_plan" {
206206
}
207207
}
208208

209+
# AWS Backup Global Settings
210+
resource "aws_backup_global_settings" "ab_global_settings" {
211+
count = var.enabled && var.enable_global_settings ? 1 : 0
212+
213+
global_settings = var.global_settings
214+
215+
lifecycle {
216+
precondition {
217+
condition = var.enable_global_settings ? length(var.global_settings) > 0 : true
218+
error_message = "When enable_global_settings is true, global_settings map cannot be empty. At minimum, specify isCrossAccountBackupEnabled."
219+
}
220+
}
221+
}
222+
209223
# Multiple AWS Backup plans with optimized timeouts
210224
resource "aws_backup_plan" "ab_plans" {
211225
for_each = var.enabled ? local.plans_map : {}

‎outputs.tf‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,3 +185,55 @@ output "restore_testing_summary" {
185185
}
186186
} : null
187187
}
188+
189+
#
190+
# Global Settings
191+
#
192+
output "global_settings_id" {
193+
description = "AWS Account ID where global settings are applied"
194+
value = try(aws_backup_global_settings.ab_global_settings[0].id, null)
195+
}
196+
197+
output "global_settings" {
198+
description = "AWS Backup global settings configuration"
199+
value = try(aws_backup_global_settings.ab_global_settings[0].global_settings, null)
200+
}
201+
202+
output "cross_account_backup_enabled" {
203+
description = "Whether cross-account backup is enabled for centralized governance"
204+
value = try(aws_backup_global_settings.ab_global_settings[0].global_settings["isCrossAccountBackupEnabled"], null) == "true"
205+
}
206+
207+
#
208+
# Global Settings Summary
209+
#
210+
output "global_settings_summary" {
211+
description = "Summary of global settings configuration and governance capabilities"
212+
value = var.enable_global_settings ? {
213+
enabled = true
214+
cross_account_backup_enabled = try(aws_backup_global_settings.ab_global_settings[0].global_settings["isCrossAccountBackupEnabled"], "false") == "true"
215+
account_id = try(aws_backup_global_settings.ab_global_settings[0].id, null)
216+
configured_settings = var.global_settings
217+
218+
# Governance and compliance information
219+
governance_impact = {
220+
"cross_account_backup" = try(aws_backup_global_settings.ab_global_settings[0].global_settings["isCrossAccountBackupEnabled"], "false") == "true" ? "Enabled - centralized backup governance active" : "Disabled - account-level backup management"
221+
"enterprise_ready" = try(aws_backup_global_settings.ab_global_settings[0].global_settings["isCrossAccountBackupEnabled"], "false") == "true"
222+
}
223+
224+
# Next steps and recommendations
225+
next_steps = {
226+
"1" = "Configure AWS Organizations backup policies for centralized governance"
227+
"2" = "Set up cross-account IAM roles for backup operations"
228+
"3" = "Implement backup compliance frameworks across accounts"
229+
"4" = "Monitor backup activities through AWS CloudTrail and CloudWatch"
230+
}
231+
232+
# CLI commands for management
233+
management_commands = {
234+
describe_settings = "aws backup describe-global-settings"
235+
list_backup_policies = "aws organizations list-policies --filter BACKUP_POLICY"
236+
check_compliance = "aws backup list-backup-jobs --by-account-id ${try(aws_backup_global_settings.ab_global_settings[0].id, "ACCOUNT_ID")}"
237+
}
238+
} : null
239+
}

‎variables.tf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -770,3 +770,39 @@ variable "restore_testing_iam_role_arn" {
770770
error_message = "The restore_testing_iam_role_arn must be a valid IAM role ARN. Avoid using 'test', 'temp', 'delete', or 'remove' in role names for security reasons."
771771
}
772772
}
773+
774+
#
775+
# AWS Backup Global Settings
776+
#
777+
variable "enable_global_settings" {
778+
description = "Whether to manage AWS Backup global settings. Enable this to configure account-level backup settings."
779+
type = bool
780+
default = false
781+
}
782+
783+
variable "global_settings" {
784+
description = "Global settings for AWS Backup. Currently supports isCrossAccountBackupEnabled for centralized cross-account backup governance."
785+
type = map(string)
786+
default = {
787+
"isCrossAccountBackupEnabled" = "false"
788+
}
789+
790+
validation {
791+
condition = can(var.global_settings["isCrossAccountBackupEnabled"]) ? contains(["true", "false"], var.global_settings["isCrossAccountBackupEnabled"]) : true
792+
error_message = "isCrossAccountBackupEnabled must be either 'true' or 'false' as a string (not boolean). This setting controls cross-account backup capabilities for enterprise governance."
793+
}
794+
795+
validation {
796+
condition = alltrue([
797+
for key, value in var.global_settings : can(regex("^[a-zA-Z][a-zA-Z0-9]*$", key))
798+
])
799+
error_message = "Global setting keys must start with a letter and contain only alphanumeric characters. Currently supported: 'isCrossAccountBackupEnabled'."
800+
}
801+
802+
validation {
803+
condition = alltrue([
804+
for key, value in var.global_settings : length(value) > 0
805+
])
806+
error_message = "Global setting values cannot be empty strings. Use 'true' or 'false' for boolean settings."
807+
}
808+
}

0 commit comments

Comments
 (0)