|
1 | 1 | --- |
2 | | -- name: Create a role and attach policies |
3 | | - amazon.aws.iam_role: |
4 | | - name: LambdaBackupRestoreRole |
5 | | - assume_role_policy_document: "{{ lookup('file', 'trusted_entitites.j2') }}" |
6 | | - managed_policies: |
7 | | - - arn:aws:iam::aws:policy/AmazonEC2FullAccess |
8 | | - - arn:aws:iam::aws:policy/AWSBackupFullAccess |
9 | | - - arn:aws:iam::aws:policy/AmazonRDSFullAccess |
10 | | - - arn:aws:iam::aws:policy/CloudWatchLogsFullAccess |
11 | | - - arn:aws:iam::aws:policy/AmazonSESFullAccess |
12 | | - - arn:aws:iam::aws:policy/AmazonSSMFullAccess |
13 | | - register: _created_iam_lambda_role |
14 | | - |
15 | | -- name: Create an IAM Managed Policy for passing roles |
16 | | - amazon.aws.iam_managed_policy: |
17 | | - policy_name: "PassRole" |
18 | | - policy: |
19 | | - Version: "2012-10-17" |
20 | | - Statement: |
21 | | - - Effect: "Allow" |
22 | | - Action: "iam:PassRole" |
23 | | - Resource: "*" |
24 | | - state: present |
25 | | - register: _pass_role |
26 | | - |
27 | | -- name: Update AWSBackupDefaultServiceRole |
28 | | - amazon.aws.iam_role: |
29 | | - name: AWSBackupDefaultServiceRole |
30 | | - assume_role_policy_document: "{{ lookup('file', 'pass_role_backup.j2') }}" |
31 | | - managed_policies: |
32 | | - - arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup |
33 | | - - arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores |
34 | | - - "{{ _pass_role.policy.arn }}" |
| 2 | +- name: Create a role and attach policies for Lambda backup validation. |
| 3 | + ansible.builtin.include_role: |
| 4 | + name: aws/aws_iam_role |
| 5 | + vars: |
| 6 | + aws_iam_role: |
| 7 | + name: LambdaBackupRestoreRole |
| 8 | + aws_profile: "{{ _aws_profile }}" |
| 9 | + managed_policies: |
| 10 | + - arn:aws:iam::aws:policy/AmazonEC2FullAccess |
| 11 | + - arn:aws:iam::aws:policy/AWSBackupFullAccess |
| 12 | + - arn:aws:iam::aws:policy/AmazonRDSFullAccess |
| 13 | + - arn:aws:iam::aws:policy/CloudWatchLogsFullAccess |
| 14 | + - arn:aws:iam::aws:policy/AmazonSSMFullAccess |
| 15 | + policy_document: "{{ lookup('file', 'trusted_entitites.j2') }}" |
| 16 | + |
| 17 | +- name: Create backup validation Lambda functions. |
| 18 | + ansible.builtin.include_role: |
| 19 | + name: aws/aws_lambda |
| 20 | + vars: |
| 21 | + aws_lambda: |
| 22 | + name: "{{ aws_backup_validation.name }}_{{ item }}" |
| 23 | + description: "{{ aws_backup_validation.description }}" |
| 24 | + timeout: "{{ aws_backup_validation.timeout }}" |
| 25 | + role: "{{ aws_iam_role._result['LambdaBackupRestoreRole'] }}" |
| 26 | + runtime: "{{ aws_backup_validation.runtime }}" |
| 27 | + function_file: "{{ lookup('template', item + '_validation.py.j2') }}" |
| 28 | + s3_bucket: "ce-{{ _aws_profile }}-lambda-functions" |
| 29 | + tags: |
| 30 | + Name: "{{ item }}_backup_validation" |
| 31 | + loop: "{{ aws_backup_validation.resources }}" |
35 | 32 |
|
36 | | -- name: Sleep for 10 seconds for IAM before Lambda creation |
37 | | - ansible.builtin.wait_for: |
38 | | - timeout: 10 |
| 33 | +#- name: Remove variables containing "-". |
| 34 | +# ansible.builtin.set_fact: |
| 35 | +# aws_lambda: "{{ aws_lambda | ansible.utils.remove_keys(target=['response_metadata', 'function_file']) }}" |
| 36 | + |
| 37 | +- name: Create an IAM Managed Policy for passing roles and setup IAM role. |
| 38 | + ansible.builtin.include_role: |
| 39 | + name: aws/aws_iam_role |
| 40 | + vars: |
| 41 | + aws_iam_role: |
| 42 | + name: AWSBackupDefaultServiceRole |
| 43 | + aws_profile: "{{ _aws_profile }}" |
| 44 | + inline_policies: |
| 45 | + name: "PassRole" |
| 46 | + resource: "*" |
| 47 | + action: "iam:PassRole" |
| 48 | + policy_document: "{{ lookup('file', 'pass_role_backup.j2') }}" |
| 49 | + managed_policies: |
| 50 | + - arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup |
| 51 | + - arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores |
39 | 52 |
|
40 | 53 | # TODO: Not all clients have verified identity |
41 | 54 | #- name: Get verified domain. |
42 | 55 | # ansible.builtin.include_tasks: get_valid_email.yml |
43 | 56 |
|
44 | | -- name: Clean and set python functions |
45 | | - block: |
46 | | - - name: Create S3 bucket for lambda functions |
47 | | - amazon.aws.s3_bucket: |
48 | | - name: "{{ aws_backup_validation.s3_bucket }}" |
49 | | - region: "{{ _aws_region }}" |
50 | | - state: present |
51 | | - |
52 | | - - name: Check and clean any previous backup validation files |
53 | | - ansible.builtin.file: |
54 | | - path: "{{ _ce_provision_build_dir }}/{{ item }}_validation.py" |
55 | | - state: absent |
56 | | - loop: "{{ aws_backup_validation.resources }}" |
57 | | - |
58 | | - - name: Check and clean any previous validation report files |
59 | | - ansible.builtin.file: |
60 | | - path: "{{ _ce_provision_build_dir }}/validation_report.py" |
61 | | - state: absent |
62 | | - |
63 | | - - name: Write Lambda functions |
64 | | - ansible.builtin.template: |
65 | | - src: "{{ item }}_validation.py.j2" |
66 | | - dest: "{{ _ce_provision_build_dir }}/{{ item }}_validation.py" |
67 | | - loop: "{{ aws_backup_validation.resources }}" |
68 | | - |
69 | | - - name: Get info about newly created restore testing plan. |
70 | | - ansible.builtin.command: > |
71 | | - aws backup list-restore-testing-plans --region {{ _aws_region }} |
72 | | - register: _testing_plans |
73 | | - |
74 | | - - name: Print return information from the previous task |
75 | | - ansible.builtin.debug: |
76 | | - var: _testing_plans |
77 | | - |
78 | | - - name: Write validation report functions |
79 | | - ansible.builtin.template: |
80 | | - src: "validation_report.j2" |
81 | | - dest: "{{ _ce_provision_build_dir }}/validation_report.py" |
82 | | - |
83 | | - - name: Create a zip archive of Lambda functions |
84 | | - community.general.archive: |
85 | | - path: "{{ _ce_provision_build_dir }}/{{ item }}_validation.py" |
86 | | - dest: "{{ _ce_provision_build_dir }}/{{ item }}_validation.zip" |
87 | | - format: zip |
88 | | - loop: "{{ aws_backup_validation.resources }}" |
89 | | - |
90 | | - - name: Create a zip archive of validation report |
91 | | - community.general.archive: |
92 | | - path: "{{ _ce_provision_build_dir }}/validation_report.py" |
93 | | - dest: "{{ _ce_provision_build_dir }}/validation_report.zip" |
94 | | - format: zip |
95 | | - |
96 | | - - name: Place backup validation functions in S3 bucket |
97 | | - amazon.aws.s3_object: |
98 | | - bucket: "{{ aws_backup_validation.s3_bucket }}" |
99 | | - object: "lambda-functions/{{ item }}_validation.zip" |
100 | | - src: "{{ _ce_provision_build_dir }}/{{ item }}_validation.zip" |
101 | | - mode: put |
102 | | - loop: "{{ aws_backup_validation.resources }}" |
103 | | - |
104 | | - - name: Place report function in S3 bucket |
105 | | - amazon.aws.s3_object: |
106 | | - bucket: "{{ aws_backup_validation.s3_bucket }}" |
107 | | - object: "lambda-functions/validation_report.zip" |
108 | | - src: "{{ _ce_provision_build_dir }}/validation_report.zip" |
109 | | - mode: put |
110 | | - loop: "{{ aws_backup_validation.resources }}" |
111 | | - |
112 | | -- name: Create Lambda functions |
113 | | - amazon.aws.lambda: |
114 | | - name: "{{ aws_backup_validation.name }}_{{ item }}" |
115 | | - description: "{{ aws_backup_validation.description }}" |
116 | | - region: "{{ _aws_region }}" |
117 | | - timeout: "{{ aws_backup_validation.timeout }}" |
118 | | - s3_bucket: "{{ aws_backup_validation.s3_bucket }}" |
119 | | - s3_key: "lambda-functions/{{ item }}_validation.zip" |
120 | | - state: present |
121 | | - runtime: "{{ aws_backup_validation.runtime }}" |
122 | | - role: "{{ _created_iam_lambda_role.iam_role.arn }}" |
123 | | - handler: "{{ item }}_validation.{{ aws_backup_validation.handler }}" |
124 | | - tags: |
125 | | - Name: "{{ item }}_backup_validation" |
126 | | - register: _lambda_functions |
127 | | - loop: "{{ aws_backup_validation.resources }}" |
128 | | - |
129 | | -- name: Create validation report functions |
130 | | - amazon.aws.lambda: |
131 | | - name: "validation_report" |
132 | | - description: "{{ aws_backup_validation.description }}" |
133 | | - region: "{{ _aws_region }}" |
134 | | - timeout: 30 |
135 | | - s3_bucket: "{{ aws_backup_validation.s3_bucket }}" |
136 | | - s3_key: "lambda-functions/validation_report.zip" |
137 | | - state: present |
138 | | - runtime: "{{ aws_backup_validation.runtime }}" |
139 | | - role: "{{ _created_iam_lambda_role.iam_role.arn }}" |
140 | | - handler: "validation_report.{{ aws_backup_validation.handler }}" |
141 | | - register: _validation_report |
142 | | - |
143 | | -- name: Remove non UTF-8 item |
| 57 | +- name: Get info about newly created restore testing plan. |
| 58 | + ansible.builtin.command: > |
| 59 | + aws backup list-restore-testing-plans --region {{ _aws_region }} |
| 60 | + register: _testing_plans |
| 61 | + |
| 62 | +- name: Create validation report function. |
| 63 | + ansible.builtin.include_role: |
| 64 | + name: aws/aws_lambda |
| 65 | + vars: |
| 66 | + aws_lambda: |
| 67 | + name: "validation_report" |
| 68 | + description: "{{ aws_backup_validation.description }}" |
| 69 | + timeout: "30" |
| 70 | + role: "{{ aws_iam_role._result['LambdaBackupRestoreRole'] }}" |
| 71 | + runtime: "{{ aws_backup_validation.runtime }}" |
| 72 | + function_file: "{{ lookup('template', 'validation_report.py.j2') }}" |
| 73 | + s3_bucket: "ce-{{ _aws_profile }}-lambda-functions" |
| 74 | + tags: |
| 75 | + Name: "validation_report" |
| 76 | + |
| 77 | +- name: Get account ID for ARN. |
| 78 | + ansible.builtin.command: >- |
| 79 | + aws sts get-caller-identity |
| 80 | + --query Account |
| 81 | + --output text |
| 82 | + register: _acc_id |
| 83 | + |
| 84 | +- name: Setting previous command output into variable. |
144 | 85 | ansible.builtin.set_fact: |
145 | | - _lambda_functions: "{{ _lambda_functions | ansible.utils.remove_keys(target=['ZipFile', 'location', 'item.invocation']) }}" |
146 | | - _validation_report: "{{ _validation_report | ansible.utils.remove_keys(target=['ZipFile', 'location', 'item.invocation']) }}" |
| 86 | + _acc_id: "{{ _acc_id.stdout | from_json }}" |
147 | 87 |
|
148 | | -- name: Create EventBridge for validations |
| 88 | +- name: Create EventBridge for validation functions. |
149 | 89 | amazon.aws.cloudwatchevent_rule: |
150 | | - name: "{{ item.configuration.function_name }}" |
151 | | - description: "{{ item.configuration.description }}" |
| 90 | + name: "RestoreValidation_{{ item }}" |
| 91 | + description: "{{ aws_backup_validation.description }}" |
152 | 92 | state: present |
153 | 93 | region: "{{ _aws_region }}" |
154 | | - event_pattern: '{ "source": ["aws.backup"], "detail-type": ["Restore Job State Change"], "detail": { "resourceType": ["{{ item.item }}"], "status": ["COMPLETED"] } }' |
| 94 | + event_pattern: '{ "source": ["aws.backup"], "detail-type": ["Restore Job State Change"], "detail": { "resourceType": ["{{ item }}"], "status": ["COMPLETED"] } }' |
155 | 95 | targets: |
156 | | - - id: "{{ item.configuration.function_name }}" |
157 | | - arn: "{{ (item.configuration.function_arn.split(':') | map('trim'))[:-1] | join(':') }}" # Remove the version number from ARN |
| 96 | + - id: "RestoreValidation_{{ item }}" |
| 97 | + arn: "arn:aws:lambda:{{ _aws_region }}:{{ _acc_id }}:function:RestoreValidation_{{ item }}" |
| 98 | + loop: "{{ aws_backup_validation.resources }}" |
158 | 99 | register: _event_bridges |
159 | | - loop: "{{ _lambda_functions.results }}" |
160 | 100 |
|
161 | 101 | - name: Create schedule for validation reports |
162 | 102 | amazon.aws.cloudwatchevent_rule: |
|
166 | 106 | region: "{{ _aws_region }}" |
167 | 107 | targets: |
168 | 108 | - id: validation_report |
169 | | - arn: "{{ (_validation_report.configuration.function_arn.split(':') | map('trim'))[:-1] | join(':') }}" # Remove the version number from ARN |
| 109 | + arn: "{{ (aws_lambda._result['validation_report'].configuration.function_arn.split(':') | map('trim'))[:-1] | join(':') }}" # Remove the version number from ARN |
170 | 110 | register: _validation_event |
171 | 111 |
|
172 | 112 | - name: Generate unique string |
|
176 | 116 | - name: Update Lambda policy |
177 | 117 | amazon.aws.lambda_policy: |
178 | 118 | state: present |
179 | | - function_name: "{{ item.item.configuration.function_name }}" |
180 | | - statement_id: "{{ item.item.configuration.function_name }}_{{ _rand_str }}" |
| 119 | + function_name: "{{ item.rule.name }}" |
| 120 | + statement_id: "{{ item.rule.name }}_{{ _rand_str }}" |
181 | 121 | action: lambda:InvokeFunction |
182 | 122 | principal: events.amazonaws.com |
183 | 123 | source_arn: "{{ item.rule.arn }}" |
|
188 | 128 | amazon.aws.lambda_policy: |
189 | 129 | state: present |
190 | 130 | function_name: "validation_report" |
191 | | - statement_id: "{{ _validation_report.configuration.function_name }}_{{ _rand_str }}" |
| 131 | + statement_id: "validation_report_{{ _rand_str }}" |
192 | 132 | action: lambda:InvokeFunction |
193 | 133 | principal: events.amazonaws.com |
194 | 134 | source_arn: "{{ _validation_event.rule.arn }}" |
|
0 commit comments