Merge pull request #67 from dmitrijn/master

chore: iam role name, pretty iam policy document, precommit updates

.pre-commit-config.yaml

@@ -1,16 +1,16 @@
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks
 repos:
--   repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.1.0
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.3.0
     hooks:
-    -   id: trailing-whitespace
-    -   id: end-of-file-fixer
-    -   id: check-added-large-files
-    -   id: detect-aws-credentials
-- repo: https://github.com/antonbabenko/pre-commit-terraform
-  rev: v1.62.3 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases
-  hooks:
-    - id: terraform_fmt
-    - id: terraform_validate
-    - id: terraform_docs
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-added-large-files
+      - id: detect-aws-credentials
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
+    rev: v1.75.0 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases
+    hooks:
+      - id: terraform_fmt
+      - id: terraform_validate
+      - id: terraform_docs

README.md

@@ -155,7 +155,7 @@ module "aws_backup_example" {
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 3.75.1 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.31.0 |
 
 ## Modules
 
@@ -177,6 +177,8 @@ No modules.
 | [aws_iam_role_policy_attachment.ab_restores_s3_policy_attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
 | [aws_iam_role_policy_attachment.ab_tag_policy_attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
 | [aws_sns_topic_policy.backup_events](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_policy) | resource |
+| [aws_iam_policy_document.ab_role_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.ab_tag_policy_document](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.backup_events](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 
@@ -186,6 +188,7 @@ No modules.
 |------|-------------|------|---------|:--------:|
 | <a name="input_enabled"></a> [enabled](#input\_enabled) | Change to false to avoid deploying any AWS Backup resources | `bool` | `true` | no |
 | <a name="input_iam_role_arn"></a> [iam\_role\_arn](#input\_iam\_role\_arn) | If configured, the module will attach this role to selections, instead of creating IAM resources by itself | `string` | `null` | no |
+| <a name="input_iam_role_name"></a> [iam\_role\_name](#input\_iam\_role\_name) | Allow to set IAM role name, otherwise use predefined default | `string` | `""` | no |
 | <a name="input_notifications"></a> [notifications](#input\_notifications) | Notification block which defines backup vault events and the SNS Topic ARN to send AWS Backup notifications to. Leave it empty to disable notifications | `any` | `{}` | no |
 | <a name="input_plan_name"></a> [plan\_name](#input\_plan\_name) | The display name of a backup plan | `string` | n/a | yes |
 | <a name="input_rule_completion_window"></a> [rule\_completion\_window](#input\_rule\_completion\_window) | The amount of time AWS Backup attempts a backup before canceling the job and returning an error | `number` | `null` | no |

iam.tf

@@ -1,22 +1,21 @@
 data "aws_partition" "current" {}
 
-resource "aws_iam_role" "ab_role" {
-  count              = var.enabled && var.iam_role_arn == null ? 1 : 0
-  name               = "aws-backup-plan-${var.plan_name}-role"
-  assume_role_policy = <<POLICY
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": ["sts:AssumeRole"],
-      "Effect": "allow",
-      "Principal": {
-        "Service": ["backup.amazonaws.com"]
-      }
+data "aws_iam_policy_document" "ab_role_assume_role_policy" {
+  count = var.enabled && var.iam_role_arn == null ? 1 : 0
+  statement {
+    actions = ["sts:AssumeRole"]
+    effect  = "Allow"
+    principals {
+      type        = "Service"
+      identifiers = ["backup.amazonaws.com"]
     }
-  ]
+  }
 }
-POLICY
+
+resource "aws_iam_role" "ab_role" {
+  count              = var.enabled && var.iam_role_arn == null ? 1 : 0
+  name               = var.iam_role_name == "" ? "aws-backup-plan-${var.plan_name}-role" : var.iam_role_name
+  assume_role_policy = data.aws_iam_policy_document.ab_role_assume_role_policy[0].json
 
   tags = var.tags
 }
@@ -34,38 +33,32 @@ resource "aws_iam_role_policy_attachment" "ab_backup_s3_policy_attach" {
 }
 
 # Tag policy
-resource "aws_iam_policy" "ab_tag_policy" {
+data "aws_iam_policy_document" "ab_tag_policy_document" {
+  count = var.enabled && var.iam_role_arn == null ? 1 : 0
+  statement {
+    effect    = "Allow"
+    resources = ["*"]
+    actions = [
+      "backup:TagResource",
+      "backup:ListTags",
+      "backup:UntagResource",
+      "tag:GetResources"
+    ]
+  }
+}
 
+resource "aws_iam_policy" "ab_tag_policy" {
   count       = var.enabled && var.iam_role_arn == null ? 1 : 0
   description = "AWS Backup Tag policy"
-
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-        "Effect": "Allow",
-        "Action": [
-            "backup:TagResource",
-            "backup:ListTags",
-            "backup:UntagResource",
-            "tag:GetResources"
-        ],
-        "Resource": "*"
-    }
-  ]
+  policy      = data.aws_iam_policy_document.ab_tag_policy_document[0].json
 }
-EOF
-}
-
 
 resource "aws_iam_role_policy_attachment" "ab_tag_policy_attach" {
   count      = var.enabled && var.iam_role_arn == null ? 1 : 0
   policy_arn = aws_iam_policy.ab_tag_policy[0].arn
   role       = aws_iam_role.ab_role[0].name
 }
 
-
 # Restores policy
 resource "aws_iam_role_policy_attachment" "ab_restores_policy_attach" {
   count      = var.enabled && var.iam_role_arn == null ? 1 : 0

selection.tf

@@ -1,5 +1,4 @@
 resource "aws_backup_selection" "ab_selection" {
-
   count = var.enabled ? length(local.selections) : 0
 
   iam_role_arn = var.iam_role_arn != null ? var.iam_role_arn : aws_iam_role.ab_role[0].arn
@@ -68,6 +67,4 @@ locals {
 
   # Make sure the role can get tag resources
   depends_on = [aws_iam_role_policy_attachment.ab_tag_policy_attach]
-
-
 }

variables.tf

@@ -166,3 +166,9 @@ variable "iam_role_arn" {
   type        = string
   default     = null
 }
+
+variable "iam_role_name" {
+  description = "Allow to set IAM role name, otherwise use predefined default"
+  type        = string
+  default     = ""
+}