chore: adds aws backup configuration to backup eligible resources with the acorn.io/backup=true tag

backup/.gitignore

@@ -0,0 +1,8 @@
+*.js
+!jest.config.js
+*.d.ts
+node_modules
+
+# CDK asset staging directory
+.cdk.staging
+cdk.out

backup/.npmignore

@@ -0,0 +1,6 @@
+*.ts
+!*.d.ts
+
+# CDK asset staging directory
+.cdk.staging
+cdk.out

backup/Acornfile

@@ -0,0 +1,124 @@
+services: backup: {
+	default: true
+	generated: job: "cdk-cfn-render"
+}
+
+jobs: "context-generator": {
+	build: {
+		context:    "../cdk-render"
+		dockerfile: "../cdk-render/Dockerfile"
+	}
+	dirs: "/acorn/aws": "secret://aws-config"
+	permissions: rules: [
+        {
+            apiGroup: "aws.acorn.io"
+            verbs: [
+                "ec2:DescribeAvailabilityZones",
+                "ec2:DescribeVpcs",
+                "ec2:DescribeSubnets",
+                "ec2:DescribeRouteTables",
+            ]
+            resources: ["*"]
+        }
+    ]
+}
+
+jobs: {
+	"cdk-cfn-render": {
+	    sidecars: "cfn-render": {
+	    	init: true
+	    	build: {
+	    		context:    "."
+	    	}
+	    	files: {
+	    		"/app/cdk.context.json": "secret://cdk-context-json/content"
+	    		// "/app/config.json": std.toJSON(localData.config)
+	    	}
+	    	env: {
+	    		CDK_DEFAULT_ACCOUNT: "secret://aws-config/account-id"
+	    		CDK_DEFAULT_REGION:  "secret://aws-config/aws-region"
+	    		ACORN_APP: "@{acorn.name}"
+	    		ACORN_NAMESPACE: "@{acorn.namespace}"
+	    	}
+	    	dirs: "/acorn/data": "volume://cfn-data"
+	    }
+	    build: {
+	    	context:    "../cfn-apply"
+	    	dockerfile: "../cfn-apply/Dockerfile"
+	    }
+	    permissions: rules: [
+            {
+                apiGroup: "aws.acorn.io"
+                verbs: [
+                    "cloudformation:DescribeStacks",
+                    "cloudformation:CreateChangeSet",
+                    "cloudformation:DescribeChangeSet",
+                    "cloudformation:ExecuteChangeSet",
+                    "cloudformation:PreviewStackUpdate",
+                    "cloudformation:UpdateStack",
+                    "cloudformation:GetTemplateSummary",
+                    "cloudformation:DeleteStack",
+                    "ssm:GetParameters",
+                    "secretsmanager:*",
+					"backup:*",
+					"backup-storage:MountCapsule",
+					"kms:CreateKey",
+					"kms:PutKeyPolicy",
+					"kms:CreateGrant",
+					"kms:GenerateKeyData",
+					"kms:Decrypt",
+					"kms:RetireGrant",
+					"kms:DescribeKey",
+					"kms:ScheduleKeyDeletion",
+					"iam:CreateRole",
+					"iam:DeleteRole",
+					"iam:AttachRolePolicy",
+					"iam:DetachRolePolicy",
+					"iam:TagRole",
+					"iam:GetRole",
+					"iam:PassRole",
+                ]
+                resources: ["*"]
+            }
+        ]
+	    env: {
+	    	ACORN_APP: "@{acorn.name}"
+	    	ACORN_NAMESPACE: "@{acorn.namespace}"
+	    }
+        entrypoint: ["/app/scripts/stack_wrapper.sh"]
+	    events: ["create", "update", "delete"]
+	    dependsOn: ["context-generator"]
+	    dirs: {
+	    	"/acorn/data": "volume://cfn-data"
+	    	"/app/scripts": "./scripts"
+	    }
+	}
+}
+
+volumes: "cfn-data": class: "ephemeral"
+
+secrets: {
+    "admin": {
+        type: "generated"
+        params: {
+            job: "cdk-cfn-render"
+            format: "json"
+        }
+    }
+	"aws-config": {
+        external: "context://aws"
+		type: "opaque"
+		data: {
+			"account-id": ""
+			"aws-region": ""
+		}
+	}
+	"cdk-context-json": {
+		type: "generated"
+		params: job: "context-generator"
+	}
+	"acorn-service": {
+		type: "generated"
+		params: job: "cdk-cfn-render"
+	}
+}

backup/Dockerfile

@@ -0,0 +1,7 @@
+FROM node:18-alpine
+
+RUN npm install -g aws-cdk
+ADD . /app/
+WORKDIR /app
+
+CMD [ "/app/scripts/cdk-synth.sh" ]

backup/README.md

@@ -0,0 +1,14 @@
+# Welcome to your CDK TypeScript project
+
+This is a blank project for CDK development with TypeScript.
+
+The `cdk.json` file tells the CDK Toolkit how to execute your app.
+
+## Useful commands
+
+* `npm run build`   compile typescript to js
+* `npm run watch`   watch for changes and compile
+* `npm run test`    perform the jest unit tests
+* `cdk deploy`      deploy this stack to your default AWS account/region
+* `cdk diff`        compare deployed stack with current state
+* `cdk synth`       emits the synthesized CloudFormation template

backup/bin/backup.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import 'source-map-support/register';
+import * as cdk from 'aws-cdk-lib';
+import { BackupStack } from '../lib/backup-stack';
+
+const app = new cdk.App();
+
+const synthesizer = new cdk.DefaultStackSynthesizer({ generateBootstrapVersionRule: false });
+
+new BackupStack(app, 'BackupStack', {
+  env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: process.env.CDK_DEFAULT_REGION },
+  synthesizer: synthesizer
+});

backup/cdk.json

@@ -0,0 +1,56 @@
+{
+  "app": "npx ts-node --prefer-ts-exts bin/backup.ts",
+  "versionReporting": false,
+  "watch": {
+    "include": [
+      "**"
+    ],
+    "exclude": [
+      "README.md",
+      "cdk*.json",
+      "**/*.d.ts",
+      "**/*.js",
+      "tsconfig.json",
+      "package*.json",
+      "yarn.lock",
+      "node_modules",
+      "test"
+    ]
+  },
+  "context": {
+    "@aws-cdk/aws-lambda:recognizeLayerVersion": true,
+    "@aws-cdk/core:checkSecretUsage": true,
+    "@aws-cdk/core:target-partitions": [
+      "aws",
+      "aws-cn"
+    ],
+    "@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver": true,
+    "@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": true,
+    "@aws-cdk/aws-ecs:arnFormatIncludesClusterName": true,
+    "@aws-cdk/aws-iam:minimizePolicies": true,
+    "@aws-cdk/core:validateSnapshotRemovalPolicy": true,
+    "@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName": true,
+    "@aws-cdk/aws-s3:createDefaultLoggingPolicy": true,
+    "@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption": true,
+    "@aws-cdk/aws-apigateway:disableCloudWatchRole": true,
+    "@aws-cdk/core:enablePartitionLiterals": true,
+    "@aws-cdk/aws-events:eventsTargetQueueSameAccount": true,
+    "@aws-cdk/aws-iam:standardizedServicePrincipals": true,
+    "@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker": true,
+    "@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName": true,
+    "@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy": true,
+    "@aws-cdk/aws-route53-patters:useCertificate": true,
+    "@aws-cdk/customresources:installLatestAwsSdkDefault": false,
+    "@aws-cdk/aws-rds:databaseProxyUniqueResourceName": true,
+    "@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup": true,
+    "@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId": true,
+    "@aws-cdk/aws-ec2:launchTemplateDefaultUserData": true,
+    "@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments": true,
+    "@aws-cdk/aws-redshift:columnId": true,
+    "@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2": true,
+    "@aws-cdk/aws-ec2:restrictDefaultSecurityGroup": true,
+    "@aws-cdk/aws-apigateway:requestValidatorUniqueId": true,
+    "@aws-cdk/aws-kms:aliasNameRef": true,
+    "@aws-cdk/core:includePrefixInUniqueNameGeneration": true
+  }
+}

backup/jest.config.js

@@ -0,0 +1,8 @@
+module.exports = {
+  testEnvironment: 'node',
+  roots: ['<rootDir>/test'],
+  testMatch: ['**/*.test.ts'],
+  transform: {
+    '^.+\\.tsx?$': 'ts-jest'
+  }
+};

backup/lib/backup-stack.ts

@@ -0,0 +1,38 @@
+import * as cdk from 'aws-cdk-lib';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as backup from 'aws-cdk-lib/aws-backup';
+import { Construct } from 'constructs';
+import { Key } from 'aws-cdk-lib/aws-kms';
+
+export class BackupStack extends cdk.Stack {
+  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+    super(scope, id, props);
+
+    const uid = cdk.Fn.select(0, cdk.Fn.split('-', cdk.Fn.select(2, cdk.Fn.split('/', this.stackId))))
+
+    const backupRole = new iam.Role(this, 'Role', {
+      assumedBy: new iam.ServicePrincipal('backup.amazonaws.com'),
+      description: 'Role allows AWS Backup service required access to other services',
+      managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSBackupServiceRolePolicyForBackup")]
+    });
+
+    const backupVault = new backup.BackupVault(this, 'BackupVault', {
+      backupVaultName: `acorn_backup_${uid}`,
+      removalPolicy: cdk.RemovalPolicy.DESTROY
+    })
+
+    const plan = backup.BackupPlan.daily35DayRetention(this, 'Plan', backupVault);
+
+    const backupSelection = new backup.BackupSelection(this, 'BackupSelection', {
+      backupPlan: plan,
+      allowRestores: true,
+      backupSelectionName: `acorn_backups_${uid}`,
+      resources: [
+        backup.BackupResource.fromTag("acorn.io/backup", "true", backup.TagOperation.STRING_EQUALS)
+
+      ],
+      role: backupRole,
+    });
+
+  }
+}