|
1 | 1 | --- |
2 | | -- name: Create a role and attach policies for Lambda backup validation. |
| 2 | +- name: Get account ID for ARN. |
| 3 | + ansible.builtin.command: >- |
| 4 | + aws sts get-caller-identity |
| 5 | + --query Account |
| 6 | + --output text |
| 7 | + register: _acc_id |
| 8 | + |
| 9 | +- name: Setting previous command output into variable. |
| 10 | + ansible.builtin.set_fact: |
| 11 | + _acc_id: "{{ _acc_id.stdout | from_json }}" |
| 12 | + |
| 13 | +# Passing Api throug the resource ( triger ) |
| 14 | + |
| 15 | +- name: Configure API Gateway if defined. |
| 16 | + ansible.builtin.include_tasks: create_mock.yml |
| 17 | + when: _api_index | length == 0 |
| 18 | + |
| 19 | +- name: Create a role and attach policies for events. |
3 | 20 | ansible.builtin.include_role: |
4 | 21 | name: aws/aws_iam_role |
5 | 22 | vars: |
6 | 23 | aws_iam_role: |
7 | | - name: LambdaBackupRestoreRole |
| 24 | + name: "{{ item.name }}_event" |
| 25 | + source: "{{ item.name}}" |
| 26 | + aws_profile: "{{ _aws_profile }}" |
| 27 | + inline_policies: |
| 28 | + name: "{{ item.name }}_event" |
| 29 | + resource: "arn:aws:lambda:{{ _aws_region }}:{{ _acc_id }}:function:{{ item.name }}" |
| 30 | + action: |
| 31 | + - "lambda:InvokeFunction" |
| 32 | + policy_document: "{{ lookup('template', 'event_document_policy.json.j2') }}" |
| 33 | + loop: "{{ aws_backup_validation.resources }}" |
| 34 | + loop_control: |
| 35 | + extended: true |
| 36 | + extended_allitems: false |
| 37 | + |
| 38 | +- name: Create a role and attach policies for Lambda functions. |
| 39 | + ansible.builtin.include_role: |
| 40 | + name: aws/aws_iam_role |
| 41 | + vars: |
| 42 | + aws_iam_role: |
| 43 | + name: "{{ item.name}}_lambda" |
| 44 | + source: "{{ item.name}}" |
8 | 45 | aws_profile: "{{ _aws_profile }}" |
9 | 46 | managed_policies: |
10 | | - - arn:aws:iam::aws:policy/AmazonEC2FullAccess |
11 | | - - arn:aws:iam::aws:policy/AWSBackupFullAccess |
12 | | - - arn:aws:iam::aws:policy/AmazonRDSFullAccess |
13 | 47 | - arn:aws:iam::aws:policy/CloudWatchLogsFullAccess |
14 | | - - arn:aws:iam::aws:policy/AmazonSSMFullAccess |
15 | | - - arn:aws:iam::aws:policy/AmazonSESFullAccess |
16 | | - policy_document: "{{ lookup('file', 'trusted_entitites.j2') }}" |
| 48 | + inline_policies: |
| 49 | + name: "{{ item.name }}_lambda" |
| 50 | + resource: "*" |
| 51 | + action: "{{ item.lambda_policy }}" |
| 52 | + policy_document: "{{ lookup('template', 'trusted_entitites.json.j2') }}" |
| 53 | + loop: "{{ aws_backup_validation.resources }}" |
| 54 | + loop_control: |
| 55 | + extended: true |
| 56 | + extended_allitems: false |
| 57 | + |
| 58 | +- name: Get info about newly created restore testing plan. |
| 59 | + ansible.builtin.command: > |
| 60 | + aws backup list-restore-testing-plans --region {{ _aws_region }} |
| 61 | + register: _testing_plans |
| 62 | + |
| 63 | +- name: Create Lambda functions from templates. |
| 64 | + ansible.builtin.include_role: |
| 65 | + name: aws/aws_lambda |
| 66 | + vars: |
| 67 | + aws_lambda: |
| 68 | + name: "{{ item.name }}" |
| 69 | + description: "Lambda functions for {{ item.type }} validation." |
| 70 | + timeout: "{{ aws_backup_validation.timeout }}" |
| 71 | + role: "{{ aws_iam_role._result[item.name + '_lambda'] }}" |
| 72 | + runtime: "{{ aws_backup_validation.runtime }}" |
| 73 | + function_file: "{{ lookup('template', item.name + '.py.j2') }}" |
| 74 | + s3_bucket: "{{ aws_backup_validation.s3_bucket }}" |
| 75 | + s3_bucket_prefix: "lambda-functions" |
| 76 | + tags: |
| 77 | + Name: "{{ item.name }}" |
| 78 | + loop: "{{ aws_backup_validation.resources }}" |
| 79 | + when: item.git_url is not defined |
17 | 80 |
|
18 | | -- name: Create backup validation Lambda functions. |
| 81 | +- name: Create Lambda functions from git url. |
19 | 82 | ansible.builtin.include_role: |
20 | 83 | name: aws/aws_lambda |
21 | 84 | vars: |
22 | 85 | aws_lambda: |
23 | | - name: "{{ aws_backup_validation.name }}_{{ item }}" |
24 | | - description: "{{ aws_backup_validation.description }}" |
| 86 | + name: "{{ item.name }}" |
| 87 | + description: "Lambda functions for {{ item.type }} validation." |
25 | 88 | timeout: "{{ aws_backup_validation.timeout }}" |
26 | | - role: "{{ aws_iam_role._result['LambdaBackupRestoreRole'] }}" |
| 89 | + role: "{{ aws_iam_role._result[item.name + '_lambda'] }}" |
27 | 90 | runtime: "{{ aws_backup_validation.runtime }}" |
28 | | - function_file: "{{ lookup('template', item + '_validation.py.j2') }}" |
| 91 | + function_file: "{{ item.git_url }}" |
29 | 92 | s3_bucket: "{{ aws_backup_validation.s3_bucket }}" |
30 | 93 | s3_bucket_prefix: "lambda-functions" |
31 | 94 | tags: |
32 | | - Name: "{{ item }}_backup_validation" |
| 95 | + Name: "{{ item.name }}" |
33 | 96 | loop: "{{ aws_backup_validation.resources }}" |
| 97 | + when: item.git_url is defined |
34 | 98 |
|
35 | 99 | - name: Create an IAM Managed Policy for passing roles and setup IAM role. |
36 | 100 | ansible.builtin.include_role: |
|
53 | 117 | #- name: Get verified domain. |
54 | 118 | # ansible.builtin.include_tasks: get_valid_email.yml |
55 | 119 |
|
56 | | -- name: Get info about newly created restore testing plan. |
57 | | - ansible.builtin.command: > |
58 | | - aws backup list-restore-testing-plans --region {{ _aws_region }} |
59 | | - register: _testing_plans |
60 | | - |
61 | | -- name: Create validation report function. |
62 | | - ansible.builtin.include_role: |
63 | | - name: aws/aws_lambda |
64 | | - vars: |
65 | | - aws_lambda: |
66 | | - name: "validation_report" |
67 | | - description: "{{ aws_backup_validation.description }}" |
68 | | - timeout: "30" |
69 | | - role: "{{ aws_iam_role._result['LambdaBackupRestoreRole'] }}" |
70 | | - runtime: "{{ aws_backup_validation.runtime }}" |
71 | | - function_file: "{{ lookup('template', 'validation_report.py.j2') }}" |
72 | | - s3_bucket: "{{ aws_backup_validation.s3_bucket }}" |
73 | | - s3_bucket_prefix: "lambda-functions" |
74 | | - tags: |
75 | | - Name: "validation_report" |
76 | | - |
77 | | -- name: Get account ID for ARN. |
78 | | - ansible.builtin.command: >- |
79 | | - aws sts get-caller-identity |
80 | | - --query Account |
81 | | - --output text |
82 | | - register: _acc_id |
83 | | - |
84 | | -- name: Setting previous command output into variable. |
85 | | - ansible.builtin.set_fact: |
86 | | - _acc_id: "{{ _acc_id.stdout | from_json }}" |
87 | | - |
88 | | -- name: Create EventBridge for validation functions. |
| 120 | +- name: Create EventBridge with lambda functions. |
89 | 121 | amazon.aws.cloudwatchevent_rule: |
90 | | - name: "RestoreValidation_{{ item }}" |
| 122 | + name: "{{ item.name }}" |
91 | 123 | description: "{{ aws_backup_validation.description }}" |
92 | 124 | state: present |
93 | 125 | region: "{{ _aws_region }}" |
94 | | - event_pattern: '{ "source": ["aws.backup"], "detail-type": ["Restore Job State Change"], "detail": { "resourceType": ["{{ item }}"], "status": ["COMPLETED"] } }' |
| 126 | + role_arn: "arn:aws:iam::{{ _acc_id }}:role/{{ item.name }}_event" |
| 127 | + event_pattern: >- |
| 128 | + {{ item.event_pattern | default( |
| 129 | + { |
| 130 | + "source": ["aws.backup"], |
| 131 | + "detail-type": ["Restore Job State Change"], |
| 132 | + "detail": { |
| 133 | + "resourceType": [ item.type ], |
| 134 | + "status": ["COMPLETED"] |
| 135 | + } |
| 136 | + } | to_json |
| 137 | + ) }} |
95 | 138 | targets: |
96 | | - - id: "RestoreValidation_{{ item }}" |
97 | | - arn: "arn:aws:lambda:{{ _aws_region }}:{{ _acc_id }}:function:RestoreValidation_{{ item }}" |
| 139 | + - id: "{{ item.name }}" |
| 140 | + arn: "arn:aws:lambda:{{ _aws_region }}:{{ _acc_id }}:function:{{ item.name }}" |
98 | 141 | loop: "{{ aws_backup_validation.resources }}" |
| 142 | + when: item.type != "Schedule" |
99 | 143 | register: _event_bridges |
100 | 144 |
|
101 | 145 | - name: Create schedule for validation reports. |
102 | 146 | amazon.aws.cloudwatchevent_rule: |
103 | | - name: validation_report |
104 | | - schedule_expression: "cron(0 0 ? * MON *)" |
105 | | - description: Run validation reporting |
| 147 | + name: "{{ item.name }}" |
| 148 | + schedule_expression: "{{ item.schedule }}" |
| 149 | + description: "Run validation reporting." |
106 | 150 | region: "{{ _aws_region }}" |
| 151 | + role_arn: "arn:aws:iam::{{ _acc_id }}:role/{{ item.name }}_event" |
107 | 152 | targets: |
108 | 153 | - id: validation_report |
109 | | - arn: "{{ (aws_lambda._result['validation_report'].configuration.function_arn.split(':') | map('trim'))[:-1] | join(':') }}" # Remove the version number from ARN |
| 154 | + arn: "arn:aws:lambda:{{ _aws_region }}:{{ _acc_id }}:function:{{ item.name }}" |
| 155 | + loop: "{{ aws_backup_validation.resources }}" |
| 156 | + when: item.type == "Schedule" |
110 | 157 | register: _validation_event |
111 | 158 |
|
112 | | -- name: Update Lambda policy. |
| 159 | +- name: Update Lambda policies. |
113 | 160 | amazon.aws.lambda_policy: |
114 | 161 | state: present |
115 | | - function_name: "{{ item.rule.name }}" |
116 | | - statement_id: "{{ item.rule.name }}" |
| 162 | + function_name: "{{ item.name }}" |
| 163 | + statement_id: "{{ item.name }}" |
117 | 164 | action: lambda:InvokeFunction |
118 | 165 | principal: events.amazonaws.com |
119 | | - source_arn: "{{ item.rule.arn }}" |
120 | | - region: "{{ _aws_region }}" |
121 | | - loop: "{{ _event_bridges.results }}" |
122 | | - |
123 | | -- name: Update lambda validation report policy. |
124 | | - amazon.aws.lambda_policy: |
125 | | - state: present |
126 | | - function_name: "validation_report" |
127 | | - statement_id: "validation_report" |
128 | | - action: lambda:InvokeFunction |
129 | | - principal: events.amazonaws.com |
130 | | - source_arn: "{{ _validation_event.rule.arn }}" |
| 166 | + source_arn: "arn:aws:events:{{ _aws_region }}:{{ _acc_id }}:rule/{{ item.name }}" |
131 | 167 | region: "{{ _aws_region }}" |
| 168 | + loop: "{{ aws_backup_validation.resources }}" |
0 commit comments