Need backups of DynamoDB table (config)

[cuppett]

Need to create AWS Backup of the DynamoDB table so it's easy to restore should something happen to it.

[cuppett]

AWS Backup can be used for this purpose. DynamoDB integrates directly with AWS Backup to provide a centralized and automated way to manage backups.

Using AWS Backup for DynamoDB tables offers several advantages:

1. Centralized Management: Automate and manage backups not just for DynamoDB, but across various AWS services from a single console.
2. Automation and Scheduling: Backup plans with configurable schedules and retention policies to automate the entire backup lifecycle.
3. Advanced Features: Copy on-demand backups across different AWS accounts and Regions, apply cost allocation tags to your backups, and transition backups to cold storage for long-term archival.

[cuppett]

Sample CloudFormation:

Parameters:
  # ... your existing parameters like ProjectName, Environment, etc. ...
  
  # New Parameters for AWS Backup
  LifecycleDeleteAfterDays:
    Type: Number
    Description: "Specifies the number of days after creation that a recovery point is deleted. Must be greater than 90 days."
    Default: 100
  LifecycleMoveToColdStorageAfterDays:
    Type: Number
    Description: "Specifies the number of days after creation that a recovery point is moved to cold storage."
    Default: 10

Resources:
  # ... your existing TenantConfigTable resource ...
  TenantConfigTable:
    Type: AWS::DynamoDB::Table
    Properties:
      # ... your table properties ...
      Tags:
        - Key: Name
          Value: !Sub '${ProjectName}-${Environment}-tenant-configs'
        - Key: Project
          Value: !Ref ProjectName
        - Key: Environment
          Value: !Ref Environment
        - Key: ManagedBy
          Value: cloudformation
        - Key: Schema
          Value: composite-key-v2

  # 1. The Backup Vault to store the recovery points
  ConfigBackupVault:
    Type: "AWS::Backup::BackupVault"
    Properties:
      BackupVaultName: !Sub '${ProjectName}-${Environment}-config-vault'
      # You can specify an KMS key for encryption and access policies here if needed

  # 2. The Backup Plan defining the schedule and lifecycle
  ConfigBackupPlan:
    Type: "AWS::Backup::BackupPlan"
    Properties:
      BackupPlan:
        BackupPlanName: !Sub '${ProjectName}-${Environment}-daily-backup-plan'
        BackupPlanRule:
          - RuleName: "DailyBackups"
            TargetBackupVault: !Ref ConfigBackupVault
            ScheduleExpression: "cron(0 5 ? * * *)" # Runs daily at 5:00 AM UTC
            StartWindowMinutes: 60
            CompletionWindowMinutes: 120
            Lifecycle:
              DeleteAfterDays: !Ref LifecycleDeleteAfterDays
              MoveToColdStorageAfterDays: !Ref LifecycleMoveToColdStorageAfterDays
    DependsOn: ConfigBackupVault

  # IAM Role for AWS Backup Service
  BackupRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: backup.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup
        - arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores
  
  # 3. The Backup Selection to link the Plan to your DynamoDB table via tags
  DynamoDBBackupSelection:
    Type: "AWS::Backup::BackupSelection"
    Properties:
      BackupPlanId: !GetAtt ConfigBackupPlan.BackupPlanId
      BackupSelection:
        SelectionName: 'TenantConfigTables'
        IamRoleArn: !GetAtt BackupRole.Arn
        ListOfTags:
          - ConditionType: "STRINGEQUALS"
            ConditionKey: "Project"
            ConditionValue: !Ref ProjectName
          - ConditionType: "STRINGEQUALS"
            ConditionKey: "Environment"
            ConditionValue: !Ref Environment
          - ConditionType: "STRINGEQUALS"
            ConditionKey: "Name"
            ConditionValue: !Sub '${ProjectName}-${Environment}-tenant-configs'
    DependsOn: ConfigBackupPlan

How This Works:

• ConfigBackupVault: Creates a dedicated vault to hold the backups for your configuration table.
• ConfigBackupPlan: Sets up a plan with a daily schedule (cron(0 5 ? * * *) means 5:00 AM UTC every day) and lifecycle rules based on the parameters you provide.
• BackupRole: Creates the necessary IAM Role that grants AWS Backup permission to perform backup and restore actions on your behalf.
• DynamoDBBackupSelection: This is the key component that connects everything. It uses the Project, Environment, and Name tags that already exist on your TenantConfigTable to identify it as a resource that should be backed up according to the ConfigBackupPlan. Any other resource you create with these exact tags will also be included in this backup plan automatically.