如何通过AWS备份构建AWS CloudFormation YML

Question

我正在使用AWS备份服务来为我的DynamoDB创建备份，但是我不喜欢该解决方案，因为它非常手动且不可复制。

现在，如何构建AWS备份(来自CloudFormation Designer或模板(？

我正在搜索它，但我不能这样做。

注意：我不想使用Lambda使用任何计划事件进行备份。我需要使用AWS备份，但是在哪里可以使用一个云形式模板，以便于创建/更新。

Answer 1

Description: "Backup Plan template to back up all resources tagged with 
backup=daily daily at 5am UTC."
Resources:
  KMSKey:
    Type: AWS::KMS::Key
    Properties:
      Description: "Encryption key for daily"
      EnableKeyRotation: True
      Enabled: True
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              "AWS": { "Fn::Sub": "arn:aws:iam::***********:root" }
#              "AWS": 'arn:aws:iam::***********:root'
            Action:
              - kms:*
            Resource: "*"
  BackupVaultWithDailyBackups:
    Type: "AWS::Backup::BackupVault"
    Properties:
      BackupVaultName: "BackupVaultWithDailyBackups"
      EncryptionKeyArn: { "Fn::GetAtt": [ KMSKey, Arn ] } #${self:custom.keyArn}
  BackupPlanWithDailyBackups:
    Type: "AWS::Backup::BackupPlan"
    Properties:
      BackupPlan:
        BackupPlanName: "BackupPlanWithDailyBackups"
        BackupPlanRule:
          -
            RuleName: DailyBackups
            ScheduleExpression: cron(0 5 ? * * *)
            StartWindowMinutes: 480
            TargetBackupVault: {Ref: BackupVaultWithDailyBackups}
            Lifecycle:
              DeleteAfterDays: 35
          -
            RuleName: WeeklyBackups
            ScheduleExpression: cron(0 5 ? * 7 *)
            TargetBackupVault: {Ref: BackupVaultWithDailyBackups}
            StartWindowMinutes: 480
            Lifecycle:
              DeleteAfterDays: 90
          -
            RuleName: MonthlyBackups
            ScheduleExpression: cron(0 5 1 * ? *)
            TargetBackupVault: {Ref: BackupVaultWithDailyBackups}
            StartWindowMinutes: 480
            Lifecycle:
              MoveToColdStorageAfterDays: 90
              DeleteAfterDays: 1825
    DependsOn: BackupVaultWithDailyBackups

#  BackupRole:
#    Type: "AWS::IAM::Role"
#    Properties:
#      AssumeRolePolicyDocument:
#        Version: "2012-10-17"
#        Statement:
#          -
#            Effect: "Allow"
#            Principal:
#              Service:
#                - "backup.amazonaws.com"
#            Action:
#              - "sts:AssumeRole"
#      ManagedPolicyArns:
#        -
#          "arn:aws:iam::**********:role/service-role/AWSBackupDefaultServiceRole"
  TagBasedBackupSelection:
    Type: "AWS::Backup::BackupSelection"
    Properties:
      BackupSelection:
        SelectionName: "TagBasedBackupSelection"
        IamRoleArn: "arn:aws:iam::***********:role/service-role/AWSBackupDefaultServiceRole"
        ListOfTags:
          -
            ConditionType: "STRINGEQUALS"
            ConditionKey: "backup"
            ConditionValue: "dev-pci"
          -
            ConditionType: "STRINGEQUALS"
            ConditionKey: "backup"
            ConditionValue: "uat-pci"
          -
            ConditionType: "STRINGEQUALS"
            ConditionKey: "backup"
            ConditionValue: "prod-pci"
      BackupPlanId: {Ref: BackupPlanWithDailyBackups}
    DependsOn: BackupPlanWithDailyBackups

注意：替换您的AWS AccountID

替换***********

您需要添加DynamoDB标签，例如：

DDBTableWithDailyBackupTag:
        Type: "AWS::DynamoDB::Table"
        Properties:
          TableName: "TestTable"
          AttributeDefinitions:
            -
              AttributeName: "Album"
              AttributeType: "S"
          KeySchema:
            -
              AttributeName: "Album"
              KeyType: "HASH"
          ProvisionedThroughput:
            ReadCapacityUnits: "5"
            WriteCapacityUnits: "5"
          Tags:
            -
              Key: "backup"
              Value: "daily"

Answer 2

Description: "Backup Plan template to back up all resources tagged with backup=daily daily at 5am UTC."
Resources:
  KMSKey:
    Type: AWS::KMS::Key
    Properties:
      Description: "Encryption key for daily"
      EnableKeyRotation: True
      Enabled: True
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
        - Effect: Allow
          Principal:
            "AWS": { "Fn::Sub": "arn:${AWS::Partition}:iam::${AWS::AccountId}:root" }
          Action:
          - kms:*
          Resource: "*"
  BackupVaultWithDailyBackups:
    Type: "AWS::Backup::BackupVault"
    Properties:
      BackupVaultName: "BackupVaultWithDailyBackups"
      EncryptionKeyArn: !GetAtt KMSKey.Arn
  BackupPlanWithDailyBackups:
    Type: "AWS::Backup::BackupPlan"
    Properties:
      BackupPlan:
        BackupPlanName: "BackupPlanWithDailyBackups"
        BackupPlanRule:
          -
            RuleName: "RuleForDailyBackups"
            TargetBackupVault: !Ref BackupVaultWithDailyBackups
            ScheduleExpression: "cron(0 5 ? * * *)"
    DependsOn: BackupVaultWithDailyBackups
  DDBTableWithDailyBackupTag:
    Type: "AWS::DynamoDB::Table"
    Properties:
      TableName: "TestTable"
      AttributeDefinitions:
        -
          AttributeName: "Album"
          AttributeType: "S"
      KeySchema:
        -
          AttributeName: "Album"
          KeyType: "HASH"
      ProvisionedThroughput:
        ReadCapacityUnits: "5"
        WriteCapacityUnits: "5"
      Tags:
        - 
          Key: "backup"
          Value: "daily"
  BackupRole:
    Type: "AWS::IAM::Role"
    Properties:
     AssumeRolePolicyDocument:
       Version: "2012-10-17"
       Statement:
         -
          Effect: "Allow"
          Principal:
            Service:
              - "backup.amazonaws.com"
          Action:
            - "sts:AssumeRole"
     ManagedPolicyArns:
       -
        "arn:aws:iam::aws:policy/service-role/service role"
  TagBasedBackupSelection:
    Type: "AWS::Backup::BackupSelection"
    Properties:
      BackupSelection:
        SelectionName: "TagBasedBackupSelection"
        IamRoleArn: !GetAtt BackupRole.Arn
        ListOfTags:
         -
           ConditionType: "STRINGEQUALS"
           ConditionKey: "backup"
           ConditionValue: "daily"
      BackupPlanId: !Ref BackupPlanWithDailyBackups
    DependsOn: BackupPlanWithDailyBackups 

参考：
https://docs.aws.amazon.com/aws-backup/latest/devguide/integrate-cloudformation-with-aws-backup.html

https://docs.aws.amazon.com/awscloudformation/latest/userguide/aws_backup.html