diff --git a/roles/aws/aws_backup/tasks/resource.yml b/roles/aws/aws_backup/tasks/resource.yml index 44924f6ff..c939a5805 100644 --- a/roles/aws/aws_backup/tasks/resource.yml +++ b/roles/aws/aws_backup/tasks/resource.yml @@ -52,8 +52,9 @@ instance: "ec2" file-system: "elasticfilesystem" db: "rds" + cluster: "rds" ansible.builtin.set_fact: - _resource_arn: "arn:aws:{{ arn_construct[backup.resource_type] }}:{{ _aws_region }}:{{ caller_info.account }}:{{ backup.resource_type }}{% if backup.resource_type == 'db' %}:{% else %}/{% endif %}{{ backup.resource_id }}" + _resource_arn: "arn:aws:{{ arn_construct[backup.resource_type] }}:{{ _aws_region }}:{{ caller_info.account }}:{{ backup.resource_type }}{% if backup.resource_type == 'db' or backup.resource_type == 'cluster' %}:{% else %}/{% endif %}{{ backup.resource_id }}" - name: Check if the resource selection exists. ansible.builtin.command: > diff --git a/roles/aws/aws_backup_validation/tasks/testing_resources.yml b/roles/aws/aws_backup_validation/tasks/testing_resources.yml index 56fd50eda..63c79421d 100644 --- a/roles/aws/aws_backup_validation/tasks/testing_resources.yml +++ b/roles/aws/aws_backup_validation/tasks/testing_resources.yml @@ -30,26 +30,32 @@ register: _main_subnets_info - name: Create SG for restored instances. - amazon.aws.ec2_security_group: - name: Restore_testing - description: This SG is used to allow SSM and SSH access to the server - region: "{{ _aws_region }}" - vpc_id: "{{ _main_vpc_info.vpcs[0].vpc_id }}" - rules: - - proto: tcp - from_port: 80 - to_port: 80 - cidr_ip: 0.0.0.0/0 - - proto: tcp - from_port: 443 - to_port: 443 - cidr_ip: 0.0.0.0/0 - - proto: tcp - from_port: 22 - to_port: 22 - cidr_ip: 0.0.0.0/0 - rules_egress: [] - register: _restore_testing_sg + ansible.builtin.include_role: + name: aws/aws_vpc + tasks_from: security_group + vars: + aws_vpc: + name: "Restore_testing" + region: "{{ aws_ec2_autoscale_cluster.region }}" + id: "{{ _main_vpc_info.vpcs[0].vpc_id }}" + description: "This SG is used to allow SSM and SSH access to the server" + rules: + - proto: tcp + from_port: 80 + to_port: 80 + cidr_ip: 0.0.0.0/0 + - proto: tcp + from_port: 443 + to_port: 443 + cidr_ip: 0.0.0.0/0 + - proto: tcp + from_port: 22 + to_port: 22 + cidr_ip: 0.0.0.0/0 + +- name: Construct AWS instance type dict. + ansible.builtin.set_fact: + _restore_testing_sg: "{{ aws_vpc._result['Restore_testing'] }}" - name: Remove restore testing query file. ansible.builtin.file: @@ -62,6 +68,7 @@ instance: "EC2" file-system: "EFS" db: "RDS" + cluster: "AURORA" - name: Set instance type for template. ansible.builtin.set_fact: diff --git a/roles/aws/aws_backup_validation/templates/AURORA_restore_testing.j2 b/roles/aws/aws_backup_validation/templates/AURORA_restore_testing.j2 new file mode 100644 index 000000000..1cb7e06f7 --- /dev/null +++ b/roles/aws/aws_backup_validation/templates/AURORA_restore_testing.j2 @@ -0,0 +1,16 @@ +{ + "RestoreTestingPlanName": "{{ _testing_plan_info.stdout | from_json | json_query("RestoreTestingPlanName") }}", + "RestoreTestingSelection": { + "IamRoleArn": "{{ _default_backup_role_arn.iam_roles[0].arn }}", + "ProtectedResourceArns": [ + "{{ _resource_arn }}" + ], + "ProtectedResourceType": "{{ _instance_type_restore }}", + "RestoreMetadataOverrides": { + "vpcSecurityGroupIds": "[\"{{ _restore_testing_sg.group_id }}\"]", + "dbsubnetgroupname": "{{ aws_rds.name }}" + }, + "RestoreTestingSelectionName": "{{ backup.selection_name | replace("-", "_") }}", + "ValidationWindowHours": 1 + } +} diff --git a/roles/aws/aws_cloudfront_distribution/defaults/main.yml b/roles/aws/aws_cloudfront_distribution/defaults/main.yml index f264cac35..66b17fd9d 100644 --- a/roles/aws/aws_cloudfront_distribution/defaults/main.yml +++ b/roles/aws/aws_cloudfront_distribution/defaults/main.yml @@ -12,6 +12,7 @@ aws_cloudfront_distribution: # description: "This is example function." # runtime: "nodejs22.x" # lambda runtimes can be found here https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html # code: "lambda-function-example.zip" # Name of the function file in files folder next to plays and vars, can handle git URLs +# handler: "main_file.main_function" aws_profile: "{{ _aws_profile }}" region: "{{ _aws_region }}" tags: {} diff --git a/roles/aws/aws_ec2_autoscale_cluster/tasks/main.yml b/roles/aws/aws_ec2_autoscale_cluster/tasks/main.yml index e8f63de73..36ed43672 100644 --- a/roles/aws/aws_ec2_autoscale_cluster/tasks/main.yml +++ b/roles/aws/aws_ec2_autoscale_cluster/tasks/main.yml @@ -772,3 +772,10 @@ when: - aws_ec2_autoscale_cluster.route_53.zone is defined - aws_ec2_autoscale_cluster.route_53.zone | length > 0 + +- name: Copy AMI to backup region. + community.aws.ec2_ami_copy: + aws_profile: "{{ aws_ec2_autoscale_cluster.aws_profile }}" + source_region: "{{ aws_ec2_autoscale_cluster.region }}" + region: "{{ aws_backup.copy_vault.region }}" + source_image_id: "{{ aws_ec2_autoscale_cluster_image_latest }}" diff --git a/roles/aws/aws_rds/tasks/main.yml b/roles/aws/aws_rds/tasks/main.yml index 28aff345a..602f13439 100644 --- a/roles/aws/aws_rds/tasks/main.yml +++ b/roles/aws/aws_rds/tasks/main.yml @@ -233,3 +233,18 @@ - aws_rds.backup is defined - aws_rds.backup | length > 0 - "'aurora' not in aws_rds.engine" + +- name: Assign Aurora resource to backup plan. + ansible.builtin.include_role: + name: aws/aws_backup + tasks_from: resource + vars: + backup: + backup_plan_name: "{{ aws_rds.backup }}" + selection_name: "AURORA-{{ aws_rds.name }}-{{ _env_type }}" + resource_id: "{{ aws_rds.name }}" + resource_type: "cluster" + when: + - aws_rds.backup is defined + - aws_rds.backup | length > 0 + - "'aurora' in aws_rds.engine"