如何从备份中排除附加到 EC2 实例的某些 EBS 卷？

Question

我正在开发一个系统范围的备份解决方案，以使用 AWS Backup 备份环境中运行的所有 EC2 实例。其中一些附加了 EBS 卷，这些卷似乎也与实例一起备份。下面是我的 terraform 代码，它允许每周拍摄快照：

resource "aws_backup_region_settings" "legacy" {
  resource_type_opt_in_preference = {
    "Aurora"          = false
    "DynamoDB"        = false
    "EFS"             = false
    "FSx"             = false
    "RDS"             = false
    "Storage Gateway" = false
    "EBS"             = true
    "EC2"             = true
    "DocumentDB"      = false
    "Neptune"         = false
    "VirtualMachine"  = false
  }
}

resource "aws_backup_vault" "legacy" {
  name        = "Legacy${var.environment_tag}"
  kms_key_arn = aws_kms_key.mgn.arn

  tags = merge(
    local.tags, {
      "Name" = "Legacy${var.environment_tag}"
    }
  )
}

resource "aws_iam_role" "legacy_backup" {
  name                 = "AWSBackupService"
  permissions_boundary = data.aws_iam_policy.role_permissions_boundary.arn
  assume_role_policy   = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": ["sts:AssumeRole"],
      "Effect": "allow",
      "Principal": {
        "Service": ["backup.amazonaws.com"]
      }
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "legacy_backup" {
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
  role       = aws_iam_role.legacy_backup.name
}

###############################################################################
##
## Weekly Backups
##
###############################################################################

resource "aws_backup_plan" "weekly" {
  name = "Legacy${var.environment_tag}Weekly"

  rule {
    enable_continuous_backup = false
    rule_name                = "Legacy${var.environment_tag}Weekly"
    target_vault_name        = aws_backup_vault.legacy.name
    schedule                 = var.backup_plan_weekly_schedule
    start_window             = 60  # minutes
    completion_window        = 180 # minutes

    lifecycle {
      cold_storage_after = 30  # days
      delete_after       = 120 # days
    }

    copy_action {
      destination_vault_arn = aws_backup_vault.legacy.arn

      lifecycle {
        cold_storage_after = 30  # days
        delete_after       = 120 # days
      }
    }

    copy_action {
      destination_vault_arn = aws_backup_vault.secondary.arn

      lifecycle {
        cold_storage_after = 30  # days
        delete_after       = 120 # days
      }
    }
  }

  advanced_backup_setting {
    backup_options = {
      WindowsVSS = "enabled"
    }
    resource_type = "EC2"
  }

  tags = merge(
    local.tags, {
      "Name" = "Legacy${var.environment_tag}Weekly"
    }
  )
}

resource "aws_backup_selection" "weekly" {
  iam_role_arn = aws_iam_role.legacy_backup.arn
  name         = "Legacy${var.environment_tag}Weekly"
  plan_id      = aws_backup_plan.weekly.id

  selection_tag {
    type  = "STRINGEQUALS"
    key   = "AWSBackup"
    value = "weekly"
  }

}

在 EC2 代码中，我将使用“AWSBackup”和“每周”标记实例，这似乎工作正常 - 对于所有实例和附加卷。如果我不想备份其中一个 EBS 卷 - 有没有办法将其排除在备份之外？

Answer 1

It's possible but not yet in Terraform. The PR 已创建，因此不会花费太长时间。

合并 PR 后，您应该能够创建一个 aws_backup_selection 并使用“NotResources”排除您的 EBS 卷。

您还可以标记所有需要备份的资源。然后你可以创建一个没有排除的备份计划。

如何从备份中排除附加到 EC2 实例的某些 EBS 卷？

How do I exclude certain EBS volumes attached to an EC2 instance from being backed up?

snapshot

amazon-ec2

amazon-web-services

terraform

aws-backup