VED-985: Add new backup Terraform.

.github/dependabot.yml

@@ -75,7 +75,7 @@ updates:
     directories:
       - "/infrastructure/account"
       - "/infrastructure/instance"
-      - "/infrastructure/terraform_aws_backup/**"
+      - "/infrastructure/backup/**"
     schedule:
       interval: "daily"
     open-pull-requests-limit: 1

infrastructure/backup/destination/Makefile

@@ -0,0 +1,43 @@
+-include .env
+
+environment = prod-backup
+workspace_name = backup-destination
+
+tf_cmd = AWS_PROFILE=$(AWS_PROFILE) terraform
+tf_state = -backend-config="bucket=imms-$(environment)-terraform-state-files"
+
+.PHONY: lock-provider workspace init init-reconfigure plan apply clean destroy import tf-%
+
+lock-provider:
+	# Run this only when you install a new terraform provider. This will generate sha code in lock file for all platform
+	echo "This may take a while. Be patient!"
+	$(tf_cmd) providers lock -platform=darwin_arm64 -platform=darwin_amd64 -platform=linux_amd64 -platform=windows_amd64
+
+workspace:
+	$(tf_cmd) workspace select -or-create $(workspace_name) && echo "Switched to workspace: $(workspace_name)"
+
+init:
+	$(tf_cmd) init $(tf_state) -upgrade $(tf_vars)
+
+init-reconfigure:
+	$(tf_cmd) init $(tf_state) -upgrade $(tf_vars) -reconfigure
+
+plan: workspace
+	 $(tf_cmd) plan $(tf_vars)
+
+apply: workspace
+	$(tf_cmd) apply $(tf_vars)
+
+clean:
+	rm -rf .terraform
+
+destroy: workspace
+	$(tf_cmd) destroy $(tf_vars)
+	$(tf_cmd) workspace select default
+	$(tf_cmd) workspace delete $(workspace_name)
+
+import:
+	$(tf_cmd) import $(tf_vars) $(to) $(id)
+
+tf-%:
+	$(tf_cmd) $*

infrastructure/backup/destination/kms_key.tf

@@ -0,0 +1,24 @@
+resource "aws_kms_key" "destination_backup_key" {
+  description             = "KMS key for AWS Backup vaults"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Sid    = "Enable IAM User Permissions"
+        Principal = {
+          AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
+        }
+        Action   = "kms:*"
+        Resource = "*"
+      }
+    ]
+  })
+}
+
+resource "aws_kms_alias" "destination_backup_key" {
+  name          = "alias/imms-prod-backup-vault-encryption"
+  target_key_id = aws_kms_key.destination_backup_key.key_id
+}

infrastructure/backup/destination/main.tf

@@ -0,0 +1,28 @@
+terraform {
+  backend "s3" {
+    region       = "eu-west-2"
+    key          = "state"
+    use_lockfile = true
+  }
+  required_version = ">= 1.5.0"
+}
+
+data "aws_caller_identity" "current" {}
+
+module "aws_backup_destination" {
+  source = "git::https://github.com/nhsdigital/terraform-aws-backup.git//modules/aws-backup-destination?ref=v1.4.1"
+
+  account_id          = data.aws_caller_identity.current.account_id
+  kms_key             = aws_kms_key.destination_backup_key.arn
+  source_account_id   = "664418956997" # Immunisation Prod
+  source_account_name = "imms-prod"
+
+  # Copied from existing vault - keep or use defaults?
+  vault_lock_min_retention_days = 30
+  vault_lock_max_retention_days = 60
+
+  # To set once tested
+  # enable_vault_protection = true
+  # enable_iam_protection = true
+  # vault_lock_type = "compliance"
+}

infrastructure/backup/source/Makefile

@@ -0,0 +1,43 @@
+-include .env
+
+environment = prod
+workspace_name = backup-source
+
+tf_cmd = AWS_PROFILE=$(AWS_PROFILE) terraform
+tf_state = -backend-config="bucket=imms-$(environment)-terraform-state-files"
+
+.PHONY: lock-provider workspace init init-reconfigure plan apply clean destroy import tf-%
+
+lock-provider:
+	# Run this only when you install a new terraform provider. This will generate sha code in lock file for all platform
+	echo "This may take a while. Be patient!"
+	$(tf_cmd) providers lock -platform=darwin_arm64 -platform=darwin_amd64 -platform=linux_amd64 -platform=windows_amd64
+
+workspace:
+	$(tf_cmd) workspace select -or-create $(workspace_name) && echo "Switched to workspace: $(workspace_name)"
+
+init:
+	$(tf_cmd) init $(tf_state) -upgrade $(tf_vars)
+
+init-reconfigure:
+	$(tf_cmd) init $(tf_state) -upgrade $(tf_vars) -reconfigure
+
+plan: workspace
+	 $(tf_cmd) plan $(tf_vars)
+
+apply: workspace
+	$(tf_cmd) apply $(tf_vars)
+
+clean:
+	rm -rf .terraform
+
+destroy: workspace
+	$(tf_cmd) destroy $(tf_vars)
+	$(tf_cmd) workspace select default
+	$(tf_cmd) workspace delete $(workspace_name)
+
+import:
+	$(tf_cmd) import $(tf_vars) $(to) $(id)
+
+tf-%:
+	$(tf_cmd) $*

infrastructure/backup/source/kms_key.tf

@@ -0,0 +1,40 @@
+resource "aws_kms_key" "sns_encrypt_key" {
+  description             = "KMS key for AWS Backup notifications"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Sid    = "Enable IAM User Permissions"
+        Principal = {
+          AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
+        }
+        Action   = "kms:*"
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Principal = {
+          Service = "sns.amazonaws.com"
+        }
+        Action   = ["kms:GenerateDataKey*", "kms:Decrypt"]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Principal = {
+          Service = "backup.amazonaws.com"
+        }
+        Action   = ["kms:GenerateDataKey*", "kms:Decrypt"]
+        Resource = "*"
+      },
+    ]
+  })
+}
+
+resource "aws_kms_alias" "sns_encrypt_key" {
+  name          = "alias/prod/imms-sns-encryption"
+  target_key_id = aws_kms_key.sns_encrypt_key.key_id
+}

infrastructure/backup/source/main.tf

@@ -0,0 +1,71 @@
+terraform {
+  # backend "s3" {
+  #   region       = "eu-west-2"
+  #   key          = "state"
+  #   use_lockfile = true
+  # }
+  required_version = ">= 1.5.0"
+}
+
+data "aws_caller_identity" "current" {}
+
+data "aws_iam_role" "auto_ops" {
+  name = "auto-ops"
+}
+
+module "aws_backup_source" {
+  source = "git::https://github.com/nhsdigital/terraform-aws-backup.git//modules/aws-backup-source?ref=v1.4.1"
+
+  environment_name             = "prod"
+  project_name                 = "ImmsFhirApi"
+  backup_copy_vault_account_id = "918296738576"
+  backup_copy_vault_arn        = "arn:aws:backup:eu-west-2:918296738576:backup-vault:imms-prod-backup-vault"
+  reports_bucket               = "imms-fhir-api-prod-backup-reports"
+  bootstrap_kms_key_arn        = aws_kms_key.sns_encrypt_key.arn
+
+  # This is the existing email but not sure if anyone is looking at this mailbox
+  notifications_target_email_address = "ImmsFhirAPiBau_VDS@nhs.net"
+
+  # The existing config has this set to a non-existent role called "terraform"
+  terraform_role_arns = [data.aws_iam_role.auto_ops.arn]
+
+  # This is the existing backup config. Review retention periods?
+  backup_plan_config = {
+    "compliance_resource_types" : [
+      "S3"
+    ],
+    "rules" : [
+      {
+        "copy_action" : {
+          "delete_after" : 31
+        },
+        "lifecycle" : {
+          "delete_after" : 4
+        },
+        "name" : "daily_kept_for_4_days",
+        "schedule" : "cron(00 20 * * ? *)"
+      }
+    ],
+    "selection_tag" : "NHSE-Enable-S3-Backup"
+  }
+
+  backup_plan_config_dynamodb = {
+    "compliance_resource_types" : [
+      "DynamoDB"
+    ],
+    "enable" : true,
+    "rules" : [
+      {
+        "copy_action" : {
+          "delete_after" : 31
+        },
+        "lifecycle" : {
+          "delete_after" : 4
+        },
+        "name" : "daily_kept_for_4_days",
+        "schedule" : "cron(00 20 * * ? *)"
+      }
+    ],
+    "selection_tag" : "NHSE-Enable-Dynamo-Backup"
+  }
+}

infrastructure/instance/Makefile

@@ -38,9 +38,8 @@ plan-ci: workspace
 plan-changes: workspace
 	 $(tf_cmd) plan $(tf_vars) -out=plan && $(tf_cmd) show -no-color -json plan | jq -r '.resource_changes[] | select(.change.actions[0]=="update" or .change.actions[0]=="create" or .change.actions[0]=="add") | .address'
 
-# TODO - remove --auto-approve once we've switched to the new deployment pipeline in GitHub Actions
 apply: workspace
-	$(tf_cmd) apply $(tf_vars) --auto-approve
+	$(tf_cmd) apply $(tf_vars)
 
 apply-ci: workspace
 	$(tf_cmd) apply $(tf_vars) -input=false tfplan
@@ -54,7 +53,7 @@ destroy: workspace
 	$(tf_cmd) workspace delete $(sub_environment)
 
 graph: workspace
-	$(tf_cmd) graph 
+	$(tf_cmd) graph
 
 output:
 	$(tf_cmd) output -raw $(name)

infrastructure/terraform_aws_backup/TODO

@@ -0,0 +1 @@
+Delete this entire directory once the replacement Terraform in the /infrastructure/backup directory has been applied