cloudformation.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: A simple backup process for EC2 and RDS datastores, tag your resources with 'MakeSnapshot' = 'True' (casesensitive) to have snapshots taken and managed
Parameters:
    SuccessSNSTopicOption:
        Description: Supply an either '' (disabled), 'CreateSNS' (build new SNS for this stack), '<sns_arn>' (connect to existing Topic).
        Default: ""
        Type: String
    ErrorSNSTopicOption:
        Description: Supply an either '' (disabled), 'CreateSNS' (build new SNS for this stack), '<sns_arn>' (connect to existing Topic).
        Default: ""
        Type: String

Conditions:
    EnableSuccessSNSTopic: !Not [!Equals [!Ref SuccessSNSTopicOption, ""]] #
    EnableErrorSNSTopic:   !Not [!Equals [!Ref ErrorSNSTopicOption, ""]]

    CreateSuccessSNSTopic: !And                     # We only need to create the Success SNS when it is enabled and not supplied
            - Condition: EnableSuccessSNSTopic
            - !Equals [!Ref SuccessSNSTopicOption, "CreateSNS"]

    CreateErrorSNSTopic:   !And                     # We only need to create the Error SNS when it is enabled and not supplied
            - Condition: EnableErrorSNSTopic
            - !Equals [!Ref ErrorSNSTopicOption,   "CreateSNS"]

Resources:
  LambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        -
          PolicyName: "Lambda_execution"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                    - "logs:*"
                Resource: "arn:aws:logs:*:*:*"
        -
          PolicyName: "sns_publish_policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                    - "sns:Publish"
                Resource: "*"
        -
          PolicyName: "ec2_snapshot_policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                    - "ec2:CreateTags"
                    - "ec2:UpdateTags"
                    - "ec2:DescribeTags"
                    - "ec2:DescribeInstances"
                    - "ec2:CreateSnapshot"
                    - "ec2:DescribeSnapshots"
                    - "ec2:DeleteSnapshot"
                    - "ec2:DescribeVolumes"
                Resource: "*"
        -
          PolicyName: "rds_snapshot_policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                    - "rds:DescribeDBInstances"
                    - "rds:DescribeDBSnapshots"
                    - "rds:ListTagsForResource"
                    - "rds:DescribeDBSecurityGroups"
                    - "rds:CreateDBSnapshot"
                    - "rds:DeleteDBSnapshot"
                    - "rds:DescribeDBClusters"
                    - "rds:DescribeDBClusterSnapshots"
                    - "rds:CreateDBClusterSnapshot"
                    - "rds:DeleteDBClusterSnapshot"
                Resource: "*"
  SuccessSNSTopic:
    Type: "AWS::SNS::Topic"
    Condition : CreateSuccessSNSTopic
  ErrorSNSTopic:
    Type: "AWS::SNS::Topic"
    Condition : CreateErrorSNSTopic
  BackupFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: backuplambda.lambda_handler
      Runtime: python3.8
      Timeout: 300
      Role: !GetAtt LambdaExecutionRole.Arn
      CodeUri: 'lambda'
      Events:
        DailyBackupEvent:
          Type: Schedule
          Properties:
            Schedule: rate(1 day)
            Input:
              Fn::Join:
              - ''
              - - '{"period_label": "day", "period_format": "%a%H-%M", "keep_count": 14,'
                - '"arn": "'
                - !If [EnableSuccessSNSTopic, !If [ CreateSuccessSNSTopic, Ref: SuccessSNSTopic, Ref: SuccessSNSTopicOption], '']
                - '", '
                - '"error_arn": "'
                - !If [EnableErrorSNSTopic, !If [ CreateErrorSNSTopic, Ref: ErrorSNSTopic, Ref: ErrorSNSTopicOption], '']
                - '", '
                - '"ec2_region_name": "'
                - Ref: AWS::Region
                - '", '
                - '"rds_region_name": "'
                - Ref: AWS::Region
                - '", '
                - '"tag_name": "MakeSnapshot", "tag_value": "True" }'
        WeeklyBackupEvent:
          Type: Schedule
          Properties:
            Schedule: rate(7 days)
            Input:
              Fn::Join:
              - ''
              - - '{"period_label": "week", "period_format": "week-%U", "keep_count": 12,'
                - '"arn": "'
                - !If [EnableSuccessSNSTopic, !If [ CreateSuccessSNSTopic, Ref: SuccessSNSTopic, Ref: SuccessSNSTopicOption], '']
                - '", '
                - '"error_arn": "'
                - !If [EnableErrorSNSTopic, !If [ CreateErrorSNSTopic, Ref: ErrorSNSTopic, Ref: ErrorSNSTopicOption], '']
                - '", '
                - '"ec2_region_name": "'
                - Ref: AWS::Region
                - '", '
                - '"rds_region_name": "'
                - Ref: AWS::Region
                - '", '
                - '"tag_name": "MakeSnapshot", "tag_value": "True" }'