0

我正在使用 AWS Backups 备份多个 EC2 实例。当备份失败时，我的 terraform 似乎可以正确报告，但我也对磁盘何时正确备份感兴趣，但当 Windows VSS 失败时。最终，失败的事件将被发布到 Opsgenie。有没有办法做到这一点？我尝试使用“aws_backup_vault_notifications”资源捕获所有事件，并尝试了此 AWS 博客中描述的过滤器：https ://aws.amazon.com/premiumsupport/knowledge-center/aws-backup-failed-job-通知/

我在下面包含了我的大部分 terraform，减去了 opsgenie 模块；如果我包含这些事件，我可以将成功或完全失败的事件发布到 Opsgenie：

locals {
  backup_vault_events = toset(["BACKUP_JOB_FAILED", "COPY_JOB_FAILED"])
}

resource "aws_backup_region_settings" "legacy" {
  resource_type_opt_in_preference = {
    "Aurora"          = false
    "DynamoDB"        = false
    "EFS"             = false
    "FSx"             = false
    "RDS"             = false
    "Storage Gateway" = false
    "EBS"             = true
    "EC2"             = true
    "DocumentDB"      = false
    "Neptune"         = false
    "VirtualMachine"  = false
  }
}

resource "aws_backup_vault" "legacy" {
  name        = "Legacy${var.environment_tag}"
  kms_key_arn = aws_kms_key.key.arn

}

resource "aws_iam_role" "legacy_backup" {
  name                 = "AWSBackupService"
  permissions_boundary = data.aws_iam_policy.role_permissions_boundary.arn
  assume_role_policy   = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": ["sts:AssumeRole"],
      "Effect": "allow",
      "Principal": {
        "Service": ["backup.amazonaws.com"]
      }
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "legacy_backup" {
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
  role       = aws_iam_role.legacy_backup.name
}

###############################################################################
## Second Region Backup
###############################################################################

resource "aws_backup_vault" "secondary" {
  provider    = aws.secondary
  name        = "Legacy${var.environment_tag}SecondaryRegion"
  kms_key_arn = aws_kms_replica_key.secondary_region.arn

  tags = merge(
    local.tags, {
      name = "Legacy${var.environment_tag}SecondaryRegion"
    }
  )
}

data "aws_iam_policy_document" "backups" {
  policy_id = "__default_policy_ID"

  statement {
    actions = [
      "SNS:Publish",
    ]

    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["backup.amazonaws.com"]
    }

    resources = [
      aws_sns_topic.backup_alerts.arn
    ]

    sid = "__default_statement_ID"
  }
}

###############################################################################
# SNS
###############################################################################
resource "aws_sns_topic_policy" "backup_alerts" {
  arn    = aws_sns_topic.backup_alerts.arn
  policy = data.aws_iam_policy_document.backups.json
}

resource "aws_backup_vault_notifications" "backup_alerts" {
  backup_vault_name   = aws_backup_vault.legacy.id
  sns_topic_arn       = aws_sns_topic.backup_alerts.arn
  backup_vault_events = local.backup_vault_events
}


resource "aws_sns_topic_subscription" "backup_alerts_opsgenie_target" {
  topic_arn                       = aws_sns_topic.backup_alerts.arn
  protocol                        = "https"
  endpoint                        = module.opsgenie_team.sns_integration_sns_endpoint
  confirmation_timeout_in_minutes = 1
  endpoint_auto_confirms          = true
}
4

0 回答 0