account_b_region_b.yml

# *
# * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# * SPDX-License-Identifier: MIT-0
# *
# * Permission is hereby granted, free of charge, to any person obtaining a copy of this
# * software and associated documentation files (the "Software"), to deal in the Software
# * without restriction, including without limitation the rights to use, copy, modify,
# * merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
# * permit persons to whom the Software is furnished to do so.
# *
# * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
# * INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
# * PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
# * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
# * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
# * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
# *
AWSTemplateFormatVersion: 2010-09-09
Description: Automating cross-account backup of Amazon RDS Oracle databases with AWS Backup - Account B, Region B
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "AWS Backup Configuration"
        Parameters:
          - pBackupVaultName
          - pAWSOrganizationID
          - pKeyAdminIdentity
    ParameterLabels:
      pBackupVaultName:
        default: AWS Backup Vault Name
      pAWSOrganizationID:
        default: AWS Organization ID
      pKeyAdminIdentity:
        default: IAM user, IAM role or account root that gets permissions to manage the AWS KMS key

Parameters:
  pBackupVaultName:
    Type: String
    Description: The name of a logical container where backups are stored. Backup vaults are identified by names that are unique to the account used to create them and the AWS Region where they are created.
  pAWSOrganizationID:
    Type: String
    Description: AWS Organizations ID
  pKeyAdminIdentity:
    Type: String
    Description: 'The principal element of the KMS key administrator. For example, "root", "user/ExampleAdminUser" or "role/ExampleAdminRole"'
  pBackupVaultMinRetention:
    Type: Number
    Description: 'TODO'
    Default: 0
  pBackupVaultMaxRetention:
    Type: Number
    Description: 'TODO'
    Default: 0
  pBackupVaultGracePeriod:
    Type: Number
    Description: 'TODO'
    Default: 0

Conditions:
  cEnableVaultLock: !Or
    - !Not
      - !Equals ['0', !Ref pBackupVaultMinRetention]
    - !Not
      - !Equals ['0', !Ref pBackupVaultMaxRetention]
    - !Not
      - !Equals ['0', !Ref pBackupVaultGracePeriod]
  cEnableVaultLockCompliance: !Not
      - !Equals ['0', !Ref pBackupVaultGracePeriod]

Resources:
# KMS Customer Managed Key (CMK) and AWS Backup Vault
# Note: Second policy statement is not supported through the web console, only through CloudFormation or API call.
  rKMSCMK:
    Type: AWS::KMS::Key
    Properties:
      EnableKeyRotation: true
      Description: KMS key for AWS Backup Vault
      KeyPolicy: !Sub |
          {
              "Version": "2012-10-17",
              "Id": "backup-vault-policy-${pBackupVaultName}",
              "Statement": [
                  {
                      "Sid": "Enable IAM User Permissions",
                      "Effect": "Allow",
                      "Principal": {
                          "AWS": "arn:aws:iam::${AWS::AccountId}:${pKeyAdminIdentity}"
                      },
                      "Action": [
                        "kms:PutKeyPolicy",
                        "kms:ScheduleKeyDeletion",
                        "kms:EnableKeyRotation",
                        "kms:DescribeKey",
                        "kms:CreateAlias",
                        "kms:DeleteAlias",
                        "kms:CreateGrant",
                        "kms:GetKeyPolicy"
                      ],
                      "Resource": "*"
                  },
                  {
                      "Sid": "Allow access from AWS Organizations accounts to copy backups",
                      "Effect": "Allow",
                      "Principal": {
                          "AWS": "*"
                      },
                      "Action": [
                          "kms:CreateGrant",
                          "kms:Decrypt",
                          "kms:GenerateDataKey*",
                          "kms:DescribeKey"
                      ],
                      "Resource": "*",
                      "Condition": {
                          "StringEquals": {
                              "aws:PrincipalOrgID": "${pAWSOrganizationID}"
                          }
                      }
                  }
              ]
          }     

  rKMSCMKAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub "alias/cmk-${pBackupVaultName}"
      TargetKeyId: !Ref rKMSCMK

  rBackupVault:
    Type: AWS::Backup::BackupVault
    Properties:
      AccessPolicy: !Sub |
          {
              "Version": "2012-10-17",
              "Statement": [
                  {
                      "Sid": "Enable backup vault access",
                      "Effect": "Allow",
                      "Principal": "*",
                      "Action": "backup:CopyIntoBackupVault",
                      "Resource": "arn:aws:backup:${AWS::Region}:${AWS::AccountId}:backup-vault:${pBackupVaultName}",
                      "Condition": {
                          "StringEquals": {
                              "aws:PrincipalOrgID": "${pAWSOrganizationID}"
                          }
                      }
                  }
              ]
          }
      BackupVaultName: !Ref pBackupVaultName
      EncryptionKeyArn: !GetAtt rKMSCMK.Arn
      LockConfiguration:
        !If
        - cEnableVaultLock
        - ChangeableForDays: !Ref pBackupVaultGracePeriod
          MinRetentionDays: !Ref pBackupVaultMinRetention
          MaxRetentionDays: !If
          - cEnableVaultLockCompliance
          - !Ref pBackupVaultMaxRetention
          - AWS::NoValue
        - Ref: AWS::NoValue