module.yml

---
# Copyright 2018 widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'cfn-modules: AWS EBS volume'
# cfn-modules:implements(ExposeId)
Parameters:
  VpcModule:
    Description: 'Stack name of vpc module.'
    Type: String
  AlertingModule:
    Description: 'Optional but recommended stack name of alerting module.'
    Type: String
    Default: ''
  KmsKeyModule:
    Description: 'Optional but recommended stack name of kms-key module.'
    Type: String
    Default: ''
  AZChar:
    Description: 'Availability zone char.'
    Type: String
    Default: A
    AllowedValues: [A, B, C]
  Size:
    Description: 'The size of the volume, in gibibytes (GiBs).'
    Type: Number
    Default: 64
    MinValue: 4
    MaxValue: 16384
  Iops:
    Description: 'The number of I/O operations per second (IOPS) that the volume supports (set to 99 to disable).'
    Type: Number
    Default: 99
    MinValue: 99
    MaxValue: 32000
  BackupRetentionPeriod:
    Description: 'The number of days to keep backups of the EBS volume (set to 0 to disable).'
    Type: Number
    MinValue: 0
    MaxValue: 35
    Default: 30
  BackupScheduleExpression:
    Description: 'A CRON expression specifying when AWS Backup initiates a backup job.'
    Type: String
    Default: 'cron(0 5 ? * * *)'
Conditions:
  HasAlertingModule: !Not [!Equals [!Ref AlertingModule, '']]
  HasKmsKeyModule: !Not [!Equals [!Ref KmsKeyModule, '']]
  HasIops: !Not [!Equals [!Ref Iops, 99]]
  HasBackupRetentionPeriod: !Not [!Equals [!Ref BackupRetentionPeriod, 0]]
Resources:
  # TODO add alarms and remove limitation
  Volume:
    DeletionPolicy: Snapshot
    UpdateReplacePolicy: Snapshot
    Type: 'AWS::EC2::Volume'
    Properties:
      AvailabilityZone: {'Fn::ImportValue': !Sub '${VpcModule}-AvailabilityZone${AZChar}'}
      Encrypted: !If [HasKmsKeyModule, true, false]
      Iops: !If [HasIops, !Ref Iops, !Ref 'AWS::NoValue']
      KmsKeyId: !If [HasKmsKeyModule, {'Fn::ImportValue': !Sub '${KmsKeyModule}-Arn'}, !Ref 'AWS::NoValue']
      Size: !Ref Size
      # TODO support SnapshotId
      VolumeType: !If [HasIops, io1, gp2]
  BackupVault: # cannot be deleted with data
    Condition: HasBackupRetentionPeriod
    Type: 'AWS::Backup::BackupVault'
    Properties:
      BackupVaultName: !Ref 'AWS::StackName'
      Notifications: !If [HasAlertingModule, {BackupVaultEvents: [BACKUP_JOB_STARTED, BACKUP_JOB_COMPLETED, RESTORE_JOB_STARTED, RESTORE_JOB_COMPLETED, RECOVERY_POINT_MODIFIED], SNSTopicArn: {'Fn::ImportValue': !Sub '${AlertingModule}-Arn'}}, !Ref 'AWS::NoValue']
  BackupPlan:
    Condition: HasBackupRetentionPeriod
    Type: 'AWS::Backup::BackupPlan'
    Properties:
      BackupPlan:
        BackupPlanName: !Ref 'AWS::StackName'
        BackupPlanRule:
        - CompletionWindowMinutes: 1440
          Lifecycle:
            DeleteAfterDays: !Ref BackupRetentionPeriod
          RuleName: !Ref 'AWS::StackName'
          ScheduleExpression: !Ref BackupScheduleExpression
          StartWindowMinutes: 60
          TargetBackupVault: !Ref BackupVault
  BackupRole:
    Condition: HasBackupRetentionPeriod
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'backup.amazonaws.com'
          Action: 'sts:AssumeRole'
      Policies:
      - PolicyName: backup # https://docs.aws.amazon.com/aws-backup/latest/devguide/access-control.html#managed-policies
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action: 'ec2:CreateTags'
            Resource: !Sub 'arn:${AWS::Partition}:ec2:${AWS::Region}::snapshot/*'
          - Effect: Allow
            Action:
            - 'ec2:CreateSnapshot'
            - 'ec2:DeleteSnapshot'
            Resource:
            - !Sub 'arn:${AWS::Partition}:ec2:${AWS::Region}::snapshot/*'
            - !Sub 'arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:volume/${Volume}'
          - Effect: Allow
            Action:
            - 'ec2:DescribeVolumes'
            - 'ec2:DescribeSnapshots'
            - 'ec2:DescribeTags'
            Resource: '*'
  BackupSelection:
    Condition: HasBackupRetentionPeriod
    Type: 'AWS::Backup::BackupSelection'
    Properties:
      BackupPlanId: !Ref BackupPlan
      BackupSelection:
        IamRoleArn: !GetAtt 'BackupRole.Arn'
        Resources:
        - !Sub 'arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:volume/${Volume}'
        SelectionName: !Ref 'AWS::StackName'
Outputs:
  ModuleId:
    Value: 'ebs-volume'
  ModuleVersion:
    Value: '1.2.0'
  StackName:
    Value: !Ref 'AWS::StackName'
  Id:
    Description: 'The id of the volume.'
    Value: !Ref Volume
    Export:
      Name: !Sub '${AWS::StackName}-Id'