at_snapshots_tool_rds_source.yaml

---
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  CodeBucket:
    Type: String
    Default: DEFAULT_BUCKET
    Description: Name of the bucket that contains the lambda functions to deploy.
      Leave the default value to download the code from the AWS Managed buckets
  InstanceNamePattern:
    Type: String
    Default: ALL_INSTANCES
    Description: Python regex for matching cluster identifiers to backup. Use "ALL_INSTANCES"
      to back up every RDS instance in the region.
  KmsKeyId:
    Type: String
    Description: The ARN of the non-default KMS key to be used in encrytption of an RDS instance.
  BackupInterval:
    Type: Number
    Default: '24'
    Description: Interval for backups in hours. Default is 24
  DestinationAccount:
    Type: Number
    Default: '000000000000'
    Description: Destination account with no dashes.
  ShareSnapshots:
    Type: String
    Default: 'TRUE'
    AllowedValues:
    - 'TRUE'
    - 'FALSE'
  BackupSchedule:
    Type: String
    Default: 0 1 * * ? *
    Description: 'Backup schedule in Cloudwatch Event cron format. Needs to run at
      least once for every Interval. The default value runs once every at 1AM UTC.
      More information: http://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html'
  RetentionDays:
    Type: Number
    Default: '7'
    Description: Number of days to keep snapshots in retention before deleting them
  LogLevel:
    Type: String
    Default: ERROR
    Description: Log level for Lambda functions (DEBUG, INFO, WARN, ERROR, CRITICAL
      are valid values).
  LambdaCWLogRetention:
    Type: Number
    Default: '7'
    Description: Number of days to retain logs from the lambda functions in CloudWatch
      Logs
  SourceRegionOverride:
    Type: String
    Default: 'NO'
    Description: Set to the region where your RDS instances run, only if such region
      does not support Step Functions. Leave as NO otherwise
  DeleteOldSnapshots:
    Type: String
    Default: 'TRUE'
    Description: Set to TRUE to enable deletion of snapshot based on RetentionDays.
      Set to FALSE to disable
    AllowedValues:
    - 'TRUE'
    - 'FALSE'
  TaggedInstance:
    Type: String
    Default: 'FALSE'
    Description: Set to TRUE to filter instances that have tag share_snapshot  set
      to True. Set to FALSE to disable
    AllowedValues:
    - 'TRUE'
    - 'FALSE'
Conditions:
  Share:
    Fn::Equals:
    - Ref: ShareSnapshots
    - 'TRUE'
  DeleteOld:
    Fn::Equals:
    - Ref: DeleteOldSnapshots
    - 'TRUE'
  DefaultBucket:
    Fn::Equals:
    - Ref: CodeBucket
    - DEFAULT_BUCKET
Mappings:
  Buckets:
    us-east-1:
      Bucket: snapshots-tool-rds-us-east-1
    us-west-2:
      Bucket: snapshots-tool-rds-us-west-2
    us-east-2:
      Bucket: snapshots-tool-rds-us-east-2
    ap-southeast-2:
      Bucket: snapshots-tool-rds-ap-southeast-2
    ap-northeast-1:
      Bucket: snapshots-tool-rds-ap-northeast-1
    eu-west-1:
      Bucket: snapshots-tool-rds-eu-west-1
    eu-central-1:
      Bucket: snapshots-tool-rds-eu-central-1
    ca-central-1:
      Bucket: snapshots-tool-rds-ca-central-1
    eu-west-2:
      Bucket: snapshots-tool-rds-eu-west-2
    us-west-1:
      Bucket: snapshots-tool-rds-us-west-1
    ap-northeast-2:
      Bucket: snapshots-tool-rds-ap-northeast-2
    ap-southeast-1:
      Bucket: snapshots-tool-rds-ap-southeast-1-real
Resources:
  topicBackupsFailed:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: backups_failed_rds
  topicShareFailed:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: share_failed_rds
  topicDeleteOldFailed:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: delete_old_failed_rds
  snspolicySnapshotsRDS:
    Type: AWS::SNS::TopicPolicy
    Properties:
      Topics:
      - Ref: topicBackupsFailed
      - Ref: topicShareFailed
      - Ref: topicDeleteOldFailed
      PolicyDocument:
        Version: '2008-10-17'
        Id: __default_policy_ID
        Statement:
        - Sid: __default_statement_ID
          Effect: Allow
          Principal:
            AWS: "*"
          Action:
          - SNS:GetTopicAttributes
          - SNS:SetTopicAttributes
          - SNS:AddPermission
          - SNS:RemovePermission
          - SNS:DeleteTopic
          - SNS:Subscribe
          - SNS:ListSubscriptionsByTopic
          - SNS:Publish
          - SNS:Receive
          Resource: "*"
          Condition:
            StringEquals:
              AWS:SourceOwner:
                Ref: AWS::AccountId

  alarmcwBackupsFailed:
    Type: AWS::CloudWatch::Alarm
    Properties:
      ActionsEnabled: 'true'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: '1'
      MetricName: ExecutionsFailed
      Namespace: AWS/States
      Period: '300'
      Statistic: Sum
      Threshold: '1.0'
      AlarmActions:
      - Ref: topicBackupsFailed
      Dimensions:
      - Name: StateMachineArn
        Value:
          Ref: stateMachineTakeSnapshotsRDS
  alarmcwShareFailed:
    Condition: Share
    Type: AWS::CloudWatch::Alarm
    Properties:
      ActionsEnabled: 'true'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: '2'
      MetricName: ExecutionsFailed
      Namespace: AWS/States
      Period: '3600'
      Statistic: Sum
      Threshold: '2.0'
      AlarmActions:
      - Ref: topicShareFailed
      Dimensions:
      - Name: StateMachineArn
        Value:
          Ref: statemachineShareSnapshotsRDS
  alarmcwDeleteOldFailed:
    Condition: DeleteOld
    Type: AWS::CloudWatch::Alarm
    Properties:
      ActionsEnabled: 'true'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: '2'
      MetricName: ExecutionsFailed
      Namespace: AWS/States
      Period: '3600'
      Statistic: Sum
      Threshold: '2.0'
      AlarmActions:
      - Ref: topicDeleteOldFailed
      Dimensions:
      - Name: StateMachineArn
        Value:
          Ref: statemachineDeleteOldSnapshotsRDS
  iamroleSnapshotsRDS:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action: sts:AssumeRole
      Policies:
      - PolicyName: inline_policy_snapshots_rds_cw_logs
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: arn:aws:logs:*:*:*
      - PolicyName: inline_policy_snapshots_rds
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - rds:CreateDBSnapshot
            - rds:DeleteDBSnapshot
            - rds:CopyDBSnapshot
            - rds:DescribeDBInstances
            - rds:DescribeDBSnapshots
            - rds:ModifyDBSnapshotAttribute
            - rds:DescribeDBSnapshotAttributes
            - rds:ListTagsForResource
            - rds:RemoveTagsFromResource
            Resource: "*"
      - PolicyName: inline_policy_snapshot_rds_kms_access
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Sid: AllowUseOfTheKey
            Effect: Allow
            Action:
            - kms:Encrypt
            - kms:Decrypt
            - kms:ReEncrypt*
            - kms:GenerateDataKey*
            - kms:DescribeKey
            Resource:
            - "*"
          - Sid: AllowAttachmentOfPersistentResources
            Effect: Allow
            Action:
            - kms:CreateGrant
            - kms:ListGrants
            - kms:RevokeGrant
            Resource:
            - "*"
  lambdaTakeSnapshotsRDS:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket:
          Fn::If:
          - DefaultBucket
          - Fn::FindInMap:
            - Buckets
            - Ref: AWS::Region
            - Bucket
          - Ref: CodeBucket
        S3Key: take_snapshots_rds.zip
      MemorySize: 512
      Description: 'This functions triggers snapshots creation for RDS instances.
        It checks for existing snapshots following the pattern and interval specified
        in the environment variables with the following format: <dbinstancename>-YYYY-MM-DD-HH-MM'
      Environment:
        Variables:
          INTERVAL:
            Ref: BackupInterval
          PATTERN:
            Ref: InstanceNamePattern
          LOG_LEVEL:
            Ref: LogLevel
          REGION_OVERRIDE:
            Ref: SourceRegionOverride
          TAGGEDINSTANCE:
            Ref: TaggedInstance
          KMS_KEY_ID:
            Ref: KmsKeyId
      Role:
        Fn::GetAtt:
        - iamroleSnapshotsRDS
        - Arn
      Runtime: python3.6
      Handler: lambda_function.lambda_handler
      Timeout: 300
  lambdaShareSnapshotsRDS:
    Type: AWS::Lambda::Function
    Condition: Share
    Properties:
      Code:
        S3Bucket:
          Fn::If:
          - DefaultBucket
          - Fn::FindInMap:
            - Buckets
            - Ref: AWS::Region
            - Bucket
          - Ref: CodeBucket
        S3Key: share_snapshots_rds.zip
      MemorySize: 512
      Description: 'This function shares snapshots created by the take_snapshots_rds
        function with DEST_ACCOUNT specified in the environment variables. '
      Environment:
        Variables:
          DEST_ACCOUNT:
            Ref: DestinationAccount
          LOG_LEVEL:
            Ref: LogLevel
          PATTERN:
            Ref: InstanceNamePattern
          REGION_OVERRIDE:
            Ref: SourceRegionOverride
          KMS_KEY_ID:
            Ref: KmsKeyId
      Role:
        Fn::GetAtt:
        - iamroleSnapshotsRDS
        - Arn
      Runtime: python3.6
      Handler: lambda_function.lambda_handler
      Timeout: 300
  lambdaDeleteOldSnapshotsRDS:
    Type: AWS::Lambda::Function
    Condition: DeleteOld
    Properties:
      Code:
        S3Bucket:
          Fn::If:
          - DefaultBucket
          - Fn::FindInMap:
            - Buckets
            - Ref: AWS::Region
            - Bucket
          - Ref: CodeBucket
        S3Key: delete_old_snapshots_rds.zip
      MemorySize: 512
      Description: 'This function deletes snapshots created by the take_snapshots_rds
        function. '
      Environment:
        Variables:
          RETENTION_DAYS:
            Ref: RetentionDays
          PATTERN:
            Ref: InstanceNamePattern
          LOG_LEVEL:
            Ref: LogLevel
          REGION_OVERRIDE:
            Ref: SourceRegionOverride
      Role:
        Fn::GetAtt:
        - iamroleSnapshotsRDS
        - Arn
      Runtime: python3.6
      Handler: lambda_function.lambda_handler
      Timeout: 300
  iamroleStateExecution:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
              Fn::Join:
              - ''
              - - states.
                - Ref: AWS::Region
                - ".amazonaws.com"
          Action: sts:AssumeRole
      Policies:
      - PolicyName: inline_policy_snapshots_rds
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - lambda:InvokeFunction
            Resource: "*"
  stateMachineTakeSnapshotsRDS:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      DefinitionString:
        Fn::Join:
        - ''
        - - Fn::Join:
            - "\n"
            - - ' {"Comment":"Triggers snapshot backup for RDS instances",'
              - ' "StartAt":"TakeSnapshots",'
              - ' "States":{'
              - '   "TakeSnapshots":{'
              - '     "Type":"Task",'
              - '     "Resource": '
          - "\""
          - Fn::GetAtt:
            - lambdaTakeSnapshotsRDS
            - Arn
          - |-
            "
            ,
          - Fn::Join:
            - "\n"
            - - '     "Retry":['
              - "       {"
              - '       "ErrorEquals":[ '
              - '         "SnapshotToolException"'
              - "       ],"
              - '       "IntervalSeconds":300,'
              - '       "MaxAttempts":20,'
              - '       "BackoffRate":1'
              - "     },"
              - "     {"
              - '      "ErrorEquals":[ '
              - '         "States.ALL"], '
              - '         "IntervalSeconds": 30,'
              - '         "MaxAttempts": 20,'
              - '         "BackoffRate": 1'
              - "     }"
              - "    ],"
              - '    "End": true '
              - "   }"
              - " }}"
      RoleArn:
        Fn::GetAtt:
        - iamroleStateExecution
        - Arn
  statemachineShareSnapshotsRDS:
    Type: AWS::StepFunctions::StateMachine
    Condition: Share
    Properties:
      DefinitionString:
        Fn::Join:
        - ''
        - - Fn::Join:
            - "\n"
            - - ' {"Comment":"Shares snapshots with DEST_ACCOUNT",'
              - ' "StartAt":"ShareSnapshots",'
              - ' "States":{'
              - '   "ShareSnapshots":{'
              - '     "Type":"Task",'
              - '     "Resource": '
          - "\""
          - Fn::GetAtt:
            - lambdaShareSnapshotsRDS
            - Arn
          - |-
            "
            ,
          - Fn::Join:
            - "\n"
            - - '     "Retry":['
              - "       {"
              - '       "ErrorEquals":[ '
              - '         "SnapshotToolException"'
              - "       ],"
              - '       "IntervalSeconds":300,'
              - '       "MaxAttempts":3,'
              - '       "BackoffRate":1'
              - "     },"
              - "     {"
              - '      "ErrorEquals":[ '
              - '         "States.ALL"], '
              - '         "IntervalSeconds": 30,'
              - '         "MaxAttempts": 20,'
              - '         "BackoffRate": 1'
              - "     }"
              - "    ],"
              - '    "End": true '
              - "   }"
              - " }}"
      RoleArn:
        Fn::GetAtt:
        - iamroleStateExecution
        - Arn
  statemachineDeleteOldSnapshotsRDS:
    Type: AWS::StepFunctions::StateMachine
    Condition: DeleteOld
    Properties:
      DefinitionString:
        Fn::Join:
        - ''
        - - Fn::Join:
            - "\n"
            - - ' {"Comment":"DeleteOld management for RDS snapshots",'
              - ' "StartAt":"DeleteOld",'
              - ' "States":{'
              - '   "DeleteOld":{'
              - '     "Type":"Task",'
              - '     "Resource": '
          - "\""
          - Fn::GetAtt:
            - lambdaDeleteOldSnapshotsRDS
            - Arn
          - |-
            "
            ,
          - Fn::Join:
            - "\n"
            - - '     "Retry":['
              - "       {"
              - '       "ErrorEquals":[ '
              - '         "SnapshotToolException"'
              - "       ],"
              - '       "IntervalSeconds":300,'
              - '       "MaxAttempts":7,'
              - '       "BackoffRate":1'
              - "     },"
              - "     {"
              - '      "ErrorEquals":[ '
              - '         "States.ALL"], '
              - '         "IntervalSeconds": 30,'
              - '         "MaxAttempts": 20,'
              - '         "BackoffRate": 1'
              - "     }"
              - "    ],"
              - '    "End": true '
              - "   }"
              - " }}"
      RoleArn:
        Fn::GetAtt:
        - iamroleStateExecution
        - Arn
  iamroleStepInvocation:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: events.amazonaws.com
          Action: sts:AssumeRole
      Policies:
      - PolicyName: inline_policy_state_invocation
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - states:StartExecution
            Resource: "*"
  cwEventBackupRDS:
    Type: AWS::Events::Rule
    Properties:
      Description: Triggers the TakeSnapshotsRDS state machine
      ScheduleExpression:
        Fn::Join:
        - ''
        - - cron(
          - Ref: BackupSchedule
          - ")"
      State: ENABLED
      Targets:
      - Arn:
          Ref: stateMachineTakeSnapshotsRDS
        Id: Target1
        RoleArn:
          Fn::GetAtt:
          - iamroleStepInvocation
          - Arn
  cwEventShareSnapshotsRDS:
    Type: AWS::Events::Rule
    Condition: Share
    Properties:
      Description: Triggers the ShareSnapshotsRDS state machine
      ScheduleExpression:
        Fn::Join:
        - ''
        - - cron(
          - "/10 * * * ? *"
          - ")"
      State: ENABLED
      Targets:
      - Arn:
          Ref: statemachineShareSnapshotsRDS
        Id: Target1
        RoleArn:
          Fn::GetAtt:
          - iamroleStepInvocation
          - Arn
  cwEventDeleteOldSnapshotsRDS:
    Type: AWS::Events::Rule
    Condition: DeleteOld
    Properties:
      Description: Triggers the DeleteOldSnapshotsRDS state machine
      ScheduleExpression:
        Fn::Join:
        - ''
        - - cron(
          - 0 /1 * * ? *
          - ")"
      State: ENABLED
      Targets:
      - Arn:
          Ref: statemachineDeleteOldSnapshotsRDS
        Id: Target1
        RoleArn:
          Fn::GetAtt:
          - iamroleStepInvocation
          - Arn
  cwloggrouplambdaTakeSnapshotsRDS:
    Type: AWS::Logs::LogGroup
    Description: Log group for the lambdaTakeSnapshotsRDS function's logs
    DependsOn: lambdaTakeSnapshotsRDS
    Properties:
      RetentionInDays:
        Ref: LambdaCWLogRetention
      LogGroupName:
        Fn::Sub:
        - "/aws/lambda/${func}"
        - func:
            Ref: lambdaTakeSnapshotsRDS
  cwloggrouplambdaShareSnapshotsRDS:
    Condition: Share
    Type: AWS::Logs::LogGroup
    Description: Log group for the lambdaShareSnapshotsRDS function's logs
    DependsOn: lambdaShareSnapshotsRDS
    Properties:
      RetentionInDays:
        Ref: LambdaCWLogRetention
      LogGroupName:
        Fn::Sub:
        - "/aws/lambda/${func}"
        - func:
            Ref: lambdaShareSnapshotsRDS
  cwloggrouplambdaDeleteOldSnapshotsRDS:
    Type: AWS::Logs::LogGroup
    Description: Log group for the lambdaDeleteOldSnapshotsRDS function's logs
    DependsOn: lambdaDeleteOldSnapshotsRDS
    Properties:
      RetentionInDays:
        Ref: LambdaCWLogRetention
      LogGroupName:
        Fn::Sub:
        - "/aws/lambda/${func}"
        - func:
            Ref: lambdaDeleteOldSnapshotsRDS
Outputs:
  BackupFailedTopic:
    Description: Subscribe to this topic to receive alerts of failed backups
    Value:
      Ref: topicBackupsFailed
  ShareFailedTopic:
    Condition: Share
    Description: Subscribe to this topic to receive alerts of failures at sharing
      snapshots with destination account
    Value:
      Ref: topicShareFailed
  DeleteOldFailedTopic:
    Condition: DeleteOld
    Description: Subscribe to this topic to receive alerts of failures at deleting
      old snapshots
    Value:
      Ref: topicDeleteOldFailed
  SourceURL:
    Description: For more information and documentation, see the source repository
      at GitHub.
    Value: https://github.com/awslabs/rds-snapshot-tool
Description: Snapshots Tool for RDS cross-region and cross-account (source account
  stack)