Skip to content

Allow backup plans to be unset. #116

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
TurboNHS wants to merge 1 commit into
base: main
Choose a base branch
from
+41 −14
Open

Allow backup plans to be unset. #116

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions modules/aws-backup-source/backup_framework.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
resource "aws_backup_framework" "main" {
count = var.backup_plan_config.enable ? 1 : 0

# must be underscores instead of dashes
name = replace("${local.resource_name_prefix}-framework", "-", "_")
description = "${var.project_name} Backup Framework"
Expand Down Expand Up @@ -292,3 +294,10 @@ resource "aws_backup_framework" "parameter_store" {
}
}
}

# -----

moved {
from = aws_backup_framework.main
to = aws_backup_framework.main[0]
}
20 changes: 18 additions & 2 deletions modules/aws-backup-source/backup_plan.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,10 @@
resource "aws_backup_plan" "default" {
count = var.backup_plan_config.enable ? 1 : 0

name = "${local.resource_name_prefix}-plan"

dynamic "rule" {
for_each = var.backup_plan_config.rules
for_each = var.backup_plan_config.enable ? var.backup_plan_config.rules : []
content {
recovery_point_tags = {
backup_rule_name = rule.value.name
Expand Down Expand Up @@ -157,9 +159,11 @@ resource "aws_backup_plan" "parameter_store" {


resource "aws_backup_selection" "default" {
count = var.backup_plan_config.enable ? 1 : 0

iam_role_arn = aws_iam_role.backup.arn
name = "${local.resource_name_prefix}-selection"
plan_id = aws_backup_plan.default.id
plan_id = aws_backup_plan.default[0].id

selection_tag {
key = var.backup_plan_config.selection_tag
Expand Down Expand Up @@ -255,3 +259,15 @@ resource "aws_backup_selection" "parameter_store" {
}
}
}

# -----

moved {
from = aws_backup_plan.default
to = aws_backup_plan.default[0]
}

moved {
from = aws_backup_selection.default
to = aws_backup_selection.default[0]
}
2 changes: 1 addition & 1 deletion modules/aws-backup-source/locals.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ locals {
selection_tag_value_parameter_store_null_checked = (var.backup_plan_config_parameter_store.selection_tag_value == null) ? "True" : var.backup_plan_config_parameter_store.selection_tag_value
selection_tags_parameter_store_null_checked = (var.backup_plan_config_parameter_store.selection_tags == null) ? [{ "key" : var.backup_plan_config_parameter_store.selection_tag, "value" : local.selection_tag_value_parameter_store_null_checked }] : var.backup_plan_config_parameter_store.selection_tags
framework_arn_list = flatten(concat(
[aws_backup_framework.main.arn],
[var.backup_plan_config.enable ? aws_backup_framework.main[0].arn : []],
var.backup_plan_config_ebsvol.enable ? [aws_backup_framework.ebsvol[0].arn] : [],
var.backup_plan_config_dynamodb.enable ? [aws_backup_framework.dynamodb[0].arn] : [],
var.backup_plan_config_aurora.enable ? [aws_backup_framework.aurora[0].arn] : [],
Expand Down
24 changes: 13 additions & 11 deletions modules/aws-backup-source/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,14 +88,15 @@ variable "backup_copy_vault_account_id" {
variable "backup_plan_config" {
description = "Configuration for backup plans"
type = object({
selection_tag = string
enable = bool
selection_tag = optional(string)
selection_tag_value = optional(string)
selection_tags = optional(list(object({
key = optional(string)
value = optional(string)
})))
compliance_resource_types = list(string)
rules = list(object({
compliance_resource_types = optional(list(string))
rules = optional(list(object({
name = string
schedule = string
completion_window = optional(number)
Expand All @@ -107,9 +108,10 @@ variable "backup_plan_config" {
copy_action = optional(object({
delete_after = optional(number)
}))
}))
})))
})
default = {
enable = true
selection_tag = "BackupLocal"
selection_tag_value = "True"
selection_tags = []
Expand Down Expand Up @@ -165,13 +167,13 @@ variable "backup_plan_config_dynamodb" {
description = "Configuration for backup plans with dynamodb"
type = object({
enable = bool
selection_tag = string
selection_tag = optional(string)
selection_tag_value = optional(string)
selection_tags = optional(list(object({
key = optional(string)
value = optional(string)
})))
compliance_resource_types = list(string)
compliance_resource_types = optional(list(string))
rules = optional(list(object({
name = string
schedule = string
Expand Down Expand Up @@ -242,13 +244,13 @@ variable "backup_plan_config_ebsvol" {
description = "Configuration for backup plans with EBS"
type = object({
enable = bool
selection_tag = string
selection_tag = optional(string)
selection_tag_value = optional(string)
selection_tags = optional(list(object({
key = optional(string)
value = optional(string)
})))
compliance_resource_types = list(string)
compliance_resource_types = optional(list(string))
Comment thread
susana-zhou1 marked this conversation as resolved.
rules = optional(list(object({
name = string
schedule = string
Expand Down Expand Up @@ -306,8 +308,8 @@ variable "backup_plan_config_aurora" {
description = "Configuration for backup plans with aurora"
type = object({
enable = bool
selection_tag = string
compliance_resource_types = list(string)
selection_tag = optional(string)
compliance_resource_types = optional(list(string))
restore_testing_overrides = optional(string)
rules = optional(list(object({
name = string
Expand Down Expand Up @@ -366,7 +368,7 @@ variable "backup_plan_config_parameter_store" {
description = "Configuration for backup plans with parameter store"
type = object({
enable = bool
selection_tag = string
selection_tag = optional(string)

@susana-zhou1 susana-zhou1 Jul 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can't be optional, would fail on aws_backup_framework creation as tag keys can't be null

@TurboNHS TurboNHS Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It can, if there's a default for it (which there are). Besides, the selection_tag = optional(string) is what's in all the other configs.

@susana-zhou1 susana-zhou1 Jul 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The default would only work if backup_plan_config isn't passed, if backup_plan_config is passed but without selection_tag it would read it as null

@TurboNHS TurboNHS Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But that's true for all the other backup_plan_config* variables. THEY have these optional()s..

@susana-zhou1 susana-zhou1 Jul 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see the requirement for optional in the scenario where the enable is set to false. some of the keys need to be set when enable is set to true, or terraform will fail. would it be possible to add those defaults on the optional. so optional(string, "default") to add that fallback

@TurboNHS TurboNHS Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's the point of this PR, to allow these (all) to be unset, and then their enable = false.

selection_tag_value = optional(string)
selection_tags = optional(list(object({
key = optional(string)
Expand Down