Terraform-provider-aws: AWS Backup Plan: Add support to SNS notifications

[hashibot[bot]]

_This issue was originally opened by @caiohasouza as hashicorp/terraform#21375. It was migrated here as a result of the provider split. The original body of the issue is below._

---

Current Terraform Version

v0.11.13

Use-cases

When configure a backup plan it's possible create a SNS notificaiton to be notified when some events happen (BACKUP_JOB_STARTED, BACKUP_JOB_COMPLETED, RESTORE_JOB_STARTED, RESTORE_JOB_COMPLETED, RECOVERY_POINT_MODIFIED). The new aws_backup_plan feature doesn't have this option, i guess that feature is similary to "autoscaling_notification" (https://www.terraform.io/docs/providers/aws/r/autoscaling_notification.html).

Attempted Solutions

I don't found the feature.

Proposal

I don't know.

References

https://docs.aws.amazon.com/aws-backup/latest/devguide/sns-notifications.html

[dannyleesmith]

Looks like it's supported in the SDK with functions like https://docs.aws.amazon.com/sdk-for-go/api/service/backup/#Backup.PutBackupVaultNotifications and the equivalent CloudFormation resources (now it supports Backup) allows this functionality at vault creation.

[SN71]

Support for this would be really nice. I moved all the backups from the resource specific solutions to AWS Backup, but now I'm blind regarding the success of the backups. I don't know, why Amazon not created an event in CloudWatch and one could filter it and send it to SNS like other services are doing :(

[dannyleesmith]

@SN71 this issue is about Terraform not having allowed you to send SNS notifications when there's activity in the vault. When this was first raised there were a handful of things you could have notifications for but they were mostly completion, change, etc., with no real detail. There was also no aws.backup filtering in CloudWatch of the CloudTrail logs.

Both of those things have recently changed.

A week or so ago an old SNS topic I had configured to received aws.backup CloudTrail events from CloudWatch started firing, and this AWS Announcement was made: https://aws.amazon.com/about-aws/whats-new/2019/10/aws-backup-enhances-sns-notifications-to-filter-on-job-status/

You will find a link on the announcement that takes you to: https://docs.aws.amazon.com/aws-backup/latest/devguide/sns-notifications.html#aws-backup-sns-apis

Whilst you cannot currently implement that within the Terraform AWS provider, you should still be able to get the functionality you need.

Hope that helps!

-- Danny

[ewbankkit]

It looks like this should be implemented as a new aws_backup_vault_notification resource.

[oh-diego-sanchez]

Is there any plan to implement this in the near future?

[ericrichtert]

It looks like this should be implemented as a new aws_backup_vault_notification resource.

That would be nice!

[bushong1]

Still looking for this.

[farragar]

We could really do with this as well

[VMGlobantGNBSudameris]

Hello!

Any status/plans for aws backup sns notifications & copy to region?

[dannyleesmith]

Hello!

Any status/plans for aws backup sns notifications & copy to region?

Hey @VMGlobantGNBSudameris, I have an issue open for the region copy here: https://github.com/terraform-providers/terraform-provider-aws/issues/11589

[jdrowne]

Reiterating we have a real life need for this feature.

[bilelov]

We really need this feature

[VMGlobantGNBSudameris]

Hello.. so.. since I needed this really bad I can out with this module as a "solution"...

// We need an extra aws provider for the replica vault
provider "aws" {
  region = var.replication_zone
  alias  = "replica"
}

// and yes, we need this local provider for the aws cli
provider "local" {}

// we will need this to get the account id
data "aws_caller_identity" "current" {}

# IAM Role & Policy Attachment
module "backup_role" {
  source      = "../../../security_identity_compliance/iam/iam_role"
  name        = "awsbackup-role-for-${var.name}"
  type        = "backup"
  environment = var.environment
}

module "backup_role_policy_attachment" {
  source      = "../../../security_identity_compliance/iam/iam_policy_attachment"
  name        = "awsbackup-policy-attachment-for-${var.name}"
  policy_arn  = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
  roles       = [module.backup_role.iam_role_name]
  environment = var.environment
}


# Backup plan
resource "aws_backup_plan" "awsbackup_plan" {
  name = "${var.plan_name}-${var.environment}"

  # a rule
  rule {
    rule_name         = "${var.rule_name}-${var.environment}"
    target_vault_name = var.vault_main_name
    schedule          = var.schedule

    lifecycle {
      delete_after       = var.delete_after
      cold_storage_after = var.cold_storage
    }
  }
}

# Protected Resources
resource "aws_backup_selection" "plan_selection" {
  iam_role_arn = module.backup_role.arn
  name         = "${var.plan_name}-resource-selection-${var.environment}"
  plan_id      = aws_backup_plan.awsbackup_plan.id

  selection_tag {
    key   = var.resource_tag_key
    type  = "STRINGEQUALS"
    value = var.resource_tag_value
  }
}

resource "random_string" "random_copy_filename" {
  length  = 20
  special = false
  number  = false
  lower   = true
  upper   = false
}

resource "local_file" "copy_vault_input_file" {
  provider = local
  content  = <<EOF
{
    "BackupPlanId": "${aws_backup_plan.awsbackup_plan.id}",
    "BackupPlan": {
      "BackupPlanName": "${var.plan_name}-${var.environment}",
      "Rules": [
        {
          "RuleName": "${var.rule_name}-${var.environment}",
          "TargetBackupVaultName": "${var.vault_main_name}",
          "ScheduleExpression": "${var.schedule}",
          "Lifecycle": {
            %{if var.cold_storage != null} "MoveToColdStorageAfterDays": ${var.cold_storage}, %{endif}
            "DeleteAfterDays": ${var.delete_after}
          },
          "CopyActions": [
            {
              "Lifecycle": {
                %{if var.cold_storage != null} "MoveToColdStorageAfterDays": ${var.cold_storage}, %{endif}
                "DeleteAfterDays":  ${var.delete_after}
              },
              "DestinationBackupVaultArn": "${var.vault_replica_arn}"
            }
          ]
        }
      ]
    }
  }
EOF
  filename = "${random_string.random_copy_filename.result}.json"
}

resource "null_resource" "add_copy_vault" {
  provisioner "local-exec" {
    command = "aws backup update-backup-plan --cli-input-json file://$JSON_FILE"

    environment = {
      JSON_FILE = local_file.copy_vault_input_file.filename
    }
  }

}

resource "aws_sns_topic" "sns_backup_topic" {
  name         = "${var.name}-sns-main-${var.environment}"
  display_name = "${var.name}-sns-main-${var.environment}"

}

resource "aws_sns_topic_subscription" "sms_subscriptions" {
  count     = length(var.phones_to_sms)
  endpoint  = var.phones_to_sms[count.index]
  protocol  = "sms"
  topic_arn = aws_sns_topic.sns_backup_topic.arn
}


resource "null_resource" "email_sns_notifications" {
  count = length(var.emails_to_notify)
  provisioner "local-exec" {
    command = "aws sns subscribe --topic-arn $TOPIC_ARN  --protocol email --notification-endpoint $EMAIL"

    environment = {
      TOPIC_ARN = aws_sns_topic.sns_backup_topic.arn
      EMAIL     = var.emails_to_notify[count.index]
    }
  }
}


resource "null_resource" "enable_sns_integration" {
  provisioner "local-exec" {
    command = "aws backup put-backup-vault-notifications --endpoint-url https://backup.$AWS_REGION.amazonaws.com --backup-vault-name $VAULT_NAME  --sns-topic-arn $SNS_TOPIC --backup-vault-events $EVENTS"

    environment = {
      AWS_REGION = var.aws_region
      VAULT_NAME = var.vault_main_name
      SNS_TOPIC  = aws_sns_topic.sns_backup_topic.arn
      EVENTS     = var.backup_events
    }
  }
  depends_on = [aws_sns_topic.sns_backup_topic]

}

[hashibot[bot]]

This has been released in version 3.9.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!