template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Shelvery
Parameters:
  CreateBucketsSchedule:
    Type: String
    Default: "0 0 ? * * *"
  CreateBackupSchedule:
    Type: String
    Default: "0 1 ? * * *"
  CleanBackupsSchedule:
    Type: String
    Default: "0 2 ? * * *"
  PullSharedBackupsSchedule:
    Type: String
    Default: "0 2 ? * * *"
  S3BackupSchedule:
    Type: String
    Default: "0 1 ? * * *"
  ShelveryKeepDailyBackups:
    Type: String
    Default: '14'
  ShelveryKeepWeeklyBackups:
    Type: String
    Default: '8'
  ShelveryKeepMonthlyBackups:
    Type: String
    Default: '12'
  ShelveryKeepYearlyBackups:
    Type: String
    Default: '10'
  ShelverySourceAwsAccountIds:
    Type: String
    Default: ''
  ShelveryShareAwsAccountIds:
    Type: String
    Default: ''
  ShelveryRdsBackupMode:
    Type: String
    Default: 'RDS_COPY_AUTOMATED_SNAPSHOT'
    AllowedValues:
      - RDS_COPY_AUTOMATED_SNAPSHOT
      - RDS_CREATE_SNAPSHOT
  ShelveryDocDbBackupMode:
    Type: String
    Default: 'DOCDB_COPY_AUTOMATED_SNAPSHOT'
    AllowedValues:
      - DOCDB_COPY_AUTOMATED_SNAPSHOT
      - DOCDB_CREATE_SNAPSHOT
  ShelveryRedShiftBackupMode:
    Type: String
    Default: 'REDSHIFT_COPY_AUTOMATED_SNAPSHOT'
    AllowedValues:
      - REDSHIFT_COPY_AUTOMATED_SNAPSHOT
      - REDSHIFT_CREATE_SNAPSHOT
  ShelveryCustomRetentionTypes:
    Type: String
    Default: 'quarterHourly:86400,halfHourly:86400,hourly:86400'
  ShelveryEncryptCopy:
    Description: During the pull backup task, encrypt all unencrypted snapshots with kms
    Type: String
    AllowedValues:
      - true
      - false
    Default: false
  ShelveryCopyKmsKeyId:
    Description: Duing the pull backup task, Kms key id to encrypt snapshots with
    Type: String
    Default: ''
  ShelveryReencryptKmsKeyId:
    Description: During the share task, Kms key id to encrypt snapshots with
    Type: String
    Default: ''

Resources:

  SnsTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: Shelvery-Notifications

  SnsTopicErrors:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: Shelvery-Errors

  ShelveryWaitQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: Shelvery-Wait-Queue
      MessageRetentionPeriod: 3600
      VisibilityTimeout: 900 # must match function timeout
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt ShelveryWaitDLQ.Arn
        maxReceiveCount: 10
      Tags:
        - Key: Name
          Value: Shelvery-Wait
        - Key: CreatedBy
          Value: Shelvery

  ShelveryWaitDLQ:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: Shelvery-Wait-dlq
      MessageRetentionPeriod: 1209600
      Tags:
        - Key: Name
          Value: Shelvery-Wait-dlq
        - Key: CreatedBy
          Value: Shelvery

  Shelvery:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: ShelveryBackups
      Handler: shelvery_lambda/lambda_handler.lambda_handler
      Runtime: python3.11
      CodeUri: ./lib
      Timeout: 900

      Tags:
        Name: Shelvery
        CreatedBy: Shelvery
        ShelveryVersion: 0.9.11

      Environment:
        Variables:
          shelvery_keep_daily_backups: !Ref ShelveryKeepDailyBackups
          shelvery_keep_weekly_backups: !Ref ShelveryKeepWeeklyBackups
          shelvery_keep_monthly_backups: !Ref ShelveryKeepMonthlyBackups
          shelvery_keep_yearly_backups: !Ref ShelveryKeepYearlyBackups
          shelvery_source_aws_account_ids: !Ref ShelverySourceAwsAccountIds
          shelvery_share_aws_account_ids: !Ref ShelveryShareAwsAccountIds
          shelvery_rds_backup_mode: !Ref ShelveryRdsBackupMode
          shelvery_docdb_backup_mode: !Ref ShelveryDocDbBackupMode
          shelvery_redshift_backup_mode: !Ref ShelveryRedShiftBackupMode
          shelvery_sns_topic: !Ref SnsTopic
          shelvery_error_sns_topic: !Ref SnsTopicErrors
          shelvery_custom_retention_types: !Ref ShelveryCustomRetentionTypes
          shelvery_sqs_queue_url: !Ref ShelveryWaitQueue
          shelvery_sqs_queue_wait_period: 300
          shelvery_encrypt_copy: !Ref ShelveryEncryptCopy
          shelvery_copy_kms_key_id: !Ref ShelveryCopyKmsKeyId
          shelvery_reencrypt_kms_key_id: !Ref ShelveryReencryptKmsKeyId

      Events:

        WaitTrigger:
          Type: SQS
          Properties:
            Queue: !GetAtt ShelveryWaitQueue.Arn
            BatchSize: 1

        CreateDataBucket:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${CreateBucketsSchedule})
            Input: '{"backup_type":"ebs","action":"create_data_buckets"}'

        CreateEbs:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${CreateBackupSchedule})
            Input: '{"backup_type":"ebs","action":"create_backups"}'
        CreateRds:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${CreateBackupSchedule})
            Input: '{"backup_type":"rds","action":"create_backups"}'
        CreateRdsCluster:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${CreateBackupSchedule})
            Input: '{"backup_type":"rds_cluster","action":"create_backups"}'
        CreateAmi:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${CreateBackupSchedule})
            Input: '{"backup_type":"ec2ami","action":"create_backups"}'
        CreateDocDb:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${CreateBackupSchedule})
            Input: '{"backup_type":"docdb","action":"create_backups"}'

        CleanEbs:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${CleanBackupsSchedule})
            Input: '{"backup_type":"ebs","action":"clean_backups"}'
        CleanRds:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${CleanBackupsSchedule})
            Input: '{"backup_type":"rds","action":"clean_backups"}'
        CleanRdsCluster:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${CleanBackupsSchedule})
            Input: '{"backup_type":"rds_cluster","action":"clean_backups"}'
        CleanEC2:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${CleanBackupsSchedule})
            Input: '{"backup_type":"ec2ami","action":"clean_backups"}'
        CleanDocDb:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${CleanBackupsSchedule})
            Input: '{"backup_type":"docdb","action":"clean_backups"}'

        PullEbs:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${PullSharedBackupsSchedule})
            Input: '{"backup_type":"ebs","action":"pull_shared_backups"}'
        PullRds:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${PullSharedBackupsSchedule})
            Input: '{"backup_type":"rds","action":"pull_shared_backups"}'
        PullRdsCluster:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${PullSharedBackupsSchedule})
            Input: '{"backup_type":"rds_cluster","action":"pull_shared_backups"}'
        PullEC2:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${PullSharedBackupsSchedule})
            Input: '{"backup_type":"ec2ami","action":"pull_shared_backups"}'
        PullDocdb:
          Type: Schedule
          Properties:
            Schedule: !Sub cron(${PullSharedBackupsSchedule})
            Input: '{"backup_type":"docdb","action":"pull_shared_backups"}'

      Policies:
        - Version: "2012-10-17"
          Statement:
            # kms encryption
            - Effect: Allow
              Action:
              - kms:DescribeKey
              - kms:Decrypt
              - kms:Encrypt
              # add your kms keys here if you want to be more restrictive
              Resource: '*'
            # kms permissions for cross account copying of snapshots
            - Effect: Allow
              Action:
              - kms:RevokeGrant
              - kms:CreateGrant
              - kms:ListGrants
              # add your kms keys here if you want to be more restrictive
              Resource: '*'
              Condition:
                Bool:
                  kms:GrantIsForAWSResource: 'true'
            - Effect: Allow
              Action:
              - lambda:Invoke*
              Resource: '*'
            # read only ec2, rds
            - Effect: Allow
              Action:
                - 'ec2:Describe*'
                - 'rds:Describe*'
                - 'rds:ListTagsForResource'
              Resource: '*'
            # manage ebs snapshots and tags
            - Effect: Allow
              Action:
                - ec2:CreateSnapshot
                - ec2:ModifySnapshotAttribute
                - ec2:ResetSnapshotAttribute
                - ec2:DeleteSnapshot
                - ec2:DescribeTags
                - ec2:CreateTags
                - ec2:DeleteTags
                - ec2:CopySnapshot
              Resource: '*'
            # manage rds snaphosts and tags
            - Effect: Allow
              Action:
                - rds:ModifyDBSnapshotAttribute
                - rds:ModifyDBClusterSnapshotAttribute
                - rds:CopyDBSnapshot
                - rds:CopyDBClusterSnapshot
                - rds:DeleteDBSnapshot
                - rds:DeleteDBClusterSnapshot
                - rds:CreateDBSnapshot
                - rds:CreateDBClusterSnapshot
                - rds:AddTagsToResource
                - rds:RemoveTagsFromResource
              Resource: '*'
            - Effect: Allow
              Action:
                - 'lambda:Invoke*'
              Resource:
                - !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:shelvery"
            # manage AMIs (limited)
            - Effect: Allow
              Action:
                - ec2:CopyImage
                - ec2:CreateImage
                - ec2:DeregisterImage
                - ec2:DescribeImageAttribute
                - ec2:DescribeImages
                - ec2:DescribeInstances
                - ec2:ModifyImageAttribute
                - ec2:DeleteSnapshot
              Resource: '*'
            - Effect: Allow
              Action:
                - s3:Get*
                - s3:List*
                - s3:CreateBucket
                - s3:PutBucketPolicy
                - s3:PutBucketAcl
                - s3:PutObject
                - s3:PutObjectAcl
                - s3:DeleteObject
                - s3:PutPublicAccessBlock
                - s3:GetBucketPolicyStatus
                - s3:GetBucketPublicAccessBlock
                - s3:PutBucketPublicAccessBlock
                - s3:GetAccountPublicAccessBlock
                - s3:PutAccountPublicAccessBlock
              Resource: '*'
            - Effect: Allow
              Action:
                - sns:Publish*
              Resource:
                - !Ref SnsTopic
            - Effect: Allow
              Action:
                - sqs:ChangeMessageVisibility
                - sqs:DeleteMessage
                - sqs:GetQueueAttributes
                - sqs:ReceiveMessage
                - sqs:SendMessage
              Resource:
                - !GetAtt ShelveryWaitQueue.Arn

  ShelveryErrors:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: If Shelvery errors is equal to 1 for 5 minutes
      Namespace: AWS/Lambda
      MetricName: Errors
      AlarmActions:
        - !Ref SnsTopicErrors
      OKActions:
        - !Ref SnsTopicErrors
      ComparisonOperator: GreaterThanThreshold
      EvaluationPeriods: 1
      Period: 300
      Statistic: Maximum
      Threshold: 0
      TreatMissingData: ignore
      Dimensions:
        - Name: FunctionName
          Value: ShelveryBackups