AWS Backup Restore Testing for Aurora provisioned: Zero Lambda, Full Automation

# AWS Backup - Restore Testing for Aurora
# Plan
resource "aws_backup_restore_testing_plan" "aurora" {
  name                         = "aurora_restore_test"
  schedule_expression          = "cron(30 18 ? * * *)"
  schedule_expression_timezone = "Europe/Madrid"
  start_window_hours           = 1

  recovery_point_selection {
    algorithm             = "LATEST_WITHIN_WINDOW"
    include_vaults        = ["*"] # Consider scoping this down to specific vaults if you have multiple vaults in the account
    recovery_point_types  = ["SNAPSHOT"]
    selection_window_days = 1
  }

  tags = var.tags
}

# Selection for Aurora resources to restore, with metadata overrides to ensure the restored instance can be created in the same VPC and subnets as the original, and use the same KMS key for encryption
resource "aws_backup_restore_testing_selection" "aurora" {
  name                      = "aurora_selection"
  restore_testing_plan_name = aws_backup_restore_testing_plan.aurora.name
  protected_resource_type   = "Aurora"
  iam_role_arn              = aws_iam_role.backup_restore_testing_aurora.arn

  protected_resource_arns = [
    module.cluster.cluster_arn
  ]

  restore_metadata_overrides = {
    dbSubnetGroupName           = module.cluster.db_subnet_group_name
    dbClusterParameterGroupName = module.cluster.db_cluster_parameter_group_id
    vpcSecurityGroupIds         = jsonencode([module.sg_aurora.security_group_id])
    kmsKeyId                    = module.kms_aurora.key_arn
    port                        = module.cluster.cluster_port
    engineVersion               = module.cluster.cluster_engine_version_actual
  }

  validation_window_hours = 1
}

# Role for Backup to assume when performing the restore
data "aws_iam_policy_document" "backup_restore_testing_assume_role" {
  statement {
    effect = "Allow"
    principals {
      type        = "Service"
      identifiers = ["backup.amazonaws.com"]
    }
    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "backup_restore_testing_aurora" {
  name               = "aws-backup-role"
  assume_role_policy = data.aws_iam_policy_document.backup_restore_testing_assume_role.json
  tags               = var.tags
}

resource "aws_iam_role_policy_attachment" "backup_restore_testing_backup_policy" {
  role       = aws_iam_role.backup_restore_testing_aurora.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
}

resource "aws_iam_role_policy_attachment" "backup_restore_testing_restore_policy" {
  role       = aws_iam_role.backup_restore_testing_aurora.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores"
}


# Step Functions state machine for backup restore validation
locals {
  restore_validation_db_instance_class = "db.r6g.large"
  restore_validation_engine            = "aurora-postgresql"
  restore_validation_database          = "PETS"
  restore_validation_schema            = "testing"
  restore_validation_table             = "pets"
  restore_validation_secret_arn        = module.cluster.cluster_master_user_secret[0].secret_arn
}

module "backup_restore_validation_sfn" {
  source = "terraform-aws-modules/step-functions/aws"

  name = "sfn-backup-restore-validation"
  type = "STANDARD"

  definition = templatefile("${path.module}/backup_restore_validation_asl.json", {
    db_instance_class = local.restore_validation_db_instance_class
    engine            = local.restore_validation_engine
    database          = local.restore_validation_database
    schema            = local.restore_validation_schema
    table             = local.restore_validation_table
    secret_arn        = local.restore_validation_secret_arn
  })

  attach_policy_json = true
  policy_json        = data.aws_iam_policy_document.backup_restore_validation_sfn.json

  logging_configuration = {
    include_execution_data = true
    level                  = "ALL"
  }

  cloudwatch_log_group_name              = "/aws/vendedlogs/states/sfn-backup-restore-validation"
  cloudwatch_log_group_retention_in_days = 14

  tags = var.tags
}

# Policy for Step Functions to allow it to call Backup and RDS APIs, and read the secret value for validation
data "aws_iam_policy_document" "backup_restore_validation_sfn" {
  statement {
    sid = "BackupRestoreValidation"
    actions = [
      "backup:DescribeRestoreJob",
      "backup:PutRestoreValidationResult"
    ]
    resources = ["*"]
  }

  statement {
    sid = "RdsInstanceLifecycle"
    actions = [
      "rds:CreateDBInstance",
      "rds:DescribeDBInstances",
      "rds:DeleteDBInstance",
      "rds:EnableHttpEndpoint"
    ]
    resources = ["*"]
  }

  statement {
    sid = "RdsDataApi"
    actions = [
      "rds-data:ExecuteStatement"
    ]
    resources = [
      "arn:aws:rds:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:cluster:*"
    ]
  }

  statement {
    sid = "ReadValidationSecret"
    actions = [
      "secretsmanager:GetSecretValue"
    ]
    resources = [
      local.restore_validation_secret_arn
    ]
  }
}


# EventBridge rules for backup restore testing
module "eventbridge_default_rules" {
  source = "terraform-aws-modules/eventbridge/aws"

  create = true

  # Use default bus configuration
  create_bus          = false
  bus_name            = "default"
  append_rule_postfix = false

  create_log_delivery_source = false

  # Rules configuration
  create_rules = true
  rules = {
    "backup_restore_completed" = {
      name        = "backup_restore_completed"
      description = "Trigger Aurora restore validation on backup restore completion"
      event_pattern = jsonencode({
        source      = ["aws.backup"]
        detail-type = ["Restore Job State Change"]
        detail = {
          status       = ["COMPLETED"]
          resourceType = ["Aurora"]
          restoreTestingPlanArn = [{
            prefix = aws_backup_restore_testing_plan.aurora.arn
          }]
        }
      })
      enabled = true
    }
  }

  # Targets configuration
  create_targets = true
  targets = {
    "backup_restore_completed" = [
      {
        name            = "StartRestoreValidationStateMachine"
        arn             = module.backup_restore_validation_sfn.state_machine_arn
        attach_role_arn = true
      }
    ]
  }

  sfn_target_arns   = [module.backup_restore_validation_sfn.state_machine_arn]
  attach_sfn_policy = true
}


"DBClusterIdentifier.$": "States.ArrayGetItem(States.StringSplit($.Restore.CreatedResourceArn, ':'), 6)",
"DBInstanceIdentifier.$": "States.Format('rt-{}', $.Restore.RestoreJobId)",
"Sql.$": "States.Format('SELECT 1 FROM \"{}\".\"{}\" LIMIT 1;', $.Context.Schema, $.Context.Table)"

"EnableDataApi": {
    "Type": "Task",
    "Resource": "arn:aws:states:::aws-sdk:rds:enableHttpEndpoint",
    "Parameters": {
        "ResourceArn.$": "$.Context.CreatedResourceArn"
    }
}

"RunValidationSql": {
    "Type": "Task",
    "Resource": "arn:aws:states:::aws-sdk:rdsdata:executeStatement",
    "Parameters": {
        "ResourceArn.$": "$.Context.CreatedResourceArn",
        "SecretArn.$": "$.Context.SecretArn",
        "Database.$": "$.Context.Database",
        "Sql.$": "$.Context.Sql"
    }
}