AWS Backup support RDS resource in aws_backup_selection

[estevens88]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Please add in the ability to specify rds instances as resources in the aws_backup_selection. I have tried using the arn pattern (arn:aws:rds:us-east-1:${data.aws_caller_identity.current.account_id}:db:) and it does not look like this is supported. However, it is for volume and EFS.

New or Affected Resource(s)

• aws_backup_selection

References

• #7166

[tdmalone]

This is supported :) If it's not working for you can you include your provider version (run terraform -v), your configuration, and the output you receive from Terraform?

Here's an example of a working configuration I'm using:

resource "aws_backup_selection" "db" {
  name         = "db"
  plan_id      = "${aws_backup_plan.db.id}"
  iam_role_arn = "${data.aws_iam_role.aws_backup_role.arn}"
  resources    = ["${aws_db_instance.main.arn}"]
}

The format of an RDS ARN is eg.:
arn:aws:rds:us-east-1:XXXXXXXXXXXX:db:my-db

In the example you've included it looks like your database identifier may be missing from the final portion of that ARN.

[bflad]

Hi @estevens88 👋 Thank you for submitting this. There is some inconsistency in the AWS Backup API across AWS regions for support of wildcard resource patterns, outside the control of the Terraform aws_backup_selection resource.

For example, I was able to use a "wildcard" pattern for EFS in us-east-2, e.g. ending with :file-system/, while in us-west-2 it threw the invalid ARN error. When adding the * at the end to better fit the expected wildcard pattern, it threw an error saying the resource contains *.

Your safest bet here will likely be to only use ARNs for resource selection (as @tdmalone is alluding to above, thanks!) or switch to tag selection. I have submitted #9298 to update the documentation to show only ARN usage with the resources argument for now to hopefully remove any confusion.

If you would like to provide direct feedback to the AWS Backup service team about the lack of clarity in the AWS Backup API Reference, please feel free to click the Feedback button in the bottom right hand corner of that documentation page. 👍

[estevens88]

Thanks @bflad for the quick response. The inconsistency was what I was noticing too. I can use specific rds instances but was not able to use the wildcard pattern with RDS. I have a case raised with AWS and hopefully that will help move this forward.

[bflad]

Great to hear! Hopefully we can gain some better insight into the expected behavior.

[nywilken]

The documentation enhancement has been merged and will be released with version 2.19.0 of the Terraform AWS provider.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!