Fixing-when-statement

roles/aws/aws_backup_validation/defaults/main.yml

@@ -8,6 +8,46 @@ aws_backup_validation:
   runtime: "python3.12"
   handler: "lambda_handler"
   resources:
-    - EC2
-    - RDS
+    - name: ec2_test_instance
+      git_url: true
+      type: EC2
+      lambda_policy:
+        - "backup:PutRestoreValidationResult"
+        - "ssm:GetCommandInvocation"
+        - "ssm:GetConnectionStatus"
+        - "ssm:SendCommand"
+        - "ec2:DescribeInstances"
+    - name: rds_test_instance
+      git_url: true
+      type:  RDS
+      lambda_policy:
+        - "backup:PutRestoreValidationResult"
+        - "ssm:GetCommandInvocation"
+        - "ssm:SendCommand"
+        - "ec2:DescribeInstances"
+        - "rds:DescribeDBInstances"
+    - name: aurora_create_instance
+      git_url: true
+      type: Aurora
+      lambda_policy:
+        - "lambda:InvokeFunction"
+    - name: aurora_test_instance
+      git_url: true
+      type: Aurora
+      event_pattern: '{ "source": ["aws.rds"], "detail-type": ["RDS DB Instance Event"], "resources": [{ "prefix": "arn:aws:rds:eu-west-1:{{ _acc_id }}:db:restoretest" }], "detail": { "EventID": ["RDS-EVENT-0005"] } }'
+      lambda_policy:
+        - "backup:PutRestoreValidationResult"
+        - "ec2:DescribeInstances"
+        - "rds:DescribeDBInstances"
+        - "rds:DescribeDBClusters"
+        - "rds:DeleteDBInstance"
+    - name: validation_report
+      git_url: true
+      type: Schedule
+      schedule: "cron(0 0 ? * MON *)"
+      lambda_policy:
+        - "backup:ListRestoreJobs"
+        - "ses:SendEmail"
+        - "ec2:DescribeImages"
+        - "rds:DescribeDbSnapshots"
     #- EFS

roles/aws/aws_backup_validation/tasks/main.yml

@@ -1,36 +1,94 @@
 ---
-- name: Create a role and attach policies for Lambda backup validation.
+- name: Get account ID for ARN.
+  ansible.builtin.command: >-
+    aws sts get-caller-identity
+    --query Account
+    --output text
+  register: _acc_id
+
+- name: Setting previous command output into variable.
+  ansible.builtin.set_fact:
+    _acc_id: "{{ _acc_id.stdout | from_json }}"
+
+- name: Create a role and attach policies for events.
+  ansible.builtin.include_role:
+    name: aws/aws_iam_role
+  vars:
+    aws_iam_role:
+      name: "{{ item.name }}_event"
+      source: "{{ item.name}}"
+      aws_profile: "{{ _aws_profile }}"
+      inline_policies:
+        name: "{{ item.name }}_event"
+        resource: "arn:aws:lambda:{{ _aws_region }}:{{ _acc_id }}:function:{{ item.name }}"
+        action:
+          - "lambda:InvokeFunction"
+      policy_document: "{{ lookup('template', 'event_document_policy.json.j2') }}"
+  loop: "{{ aws_backup_validation.resources }}"
+  loop_control:
+    extended: true
+    extended_allitems: false
+
+- name: Create a role and attach policies for Lambda functions.
   ansible.builtin.include_role:
     name: aws/aws_iam_role
   vars:
     aws_iam_role:
-      name: LambdaBackupRestoreRole
+      name: "{{ item.name}}_lambda"
+      source: "{{ item.name}}"
       aws_profile: "{{ _aws_profile }}"
       managed_policies:
-        - arn:aws:iam::aws:policy/AmazonEC2FullAccess
-        - arn:aws:iam::aws:policy/AWSBackupFullAccess
-        - arn:aws:iam::aws:policy/AmazonRDSFullAccess
         - arn:aws:iam::aws:policy/CloudWatchLogsFullAccess
-        - arn:aws:iam::aws:policy/AmazonSSMFullAccess
-        - arn:aws:iam::aws:policy/AmazonSESFullAccess
-      policy_document: "{{ lookup('file', 'trusted_entitites.j2') }}"
+      inline_policies:
+        name: "{{ item.name }}_lambda"
+        resource: "*"
+        action: "{{ item.lambda_policy }}"
+      policy_document: "{{ lookup('template', 'trusted_entitites.json.j2') }}"
+  loop: "{{ aws_backup_validation.resources }}"
+  loop_control:
+    extended: true
+    extended_allitems: false
+
+- name: Get info about newly created restore testing plan.
+  ansible.builtin.command: >
+    aws backup list-restore-testing-plans --region {{ _aws_region }}
+  register: _testing_plans
+
+- name: Create Lambda functions from templates.
+  ansible.builtin.include_role:
+    name: aws/aws_lambda
+  vars:
+    aws_lambda:
+      name: "{{ item.name }}"
+      description: "Lambda functions for {{ item.type }} validation."
+      timeout: "{{ aws_backup_validation.timeout }}"
+      role: "{{ aws_iam_role._result[item.name + '_lambda'] }}"
+      runtime: "{{ aws_backup_validation.runtime }}"
+      function_file: "{{ lookup('template', item.name + '.py.j2') }}"
+      s3_bucket: "{{ aws_backup_validation.s3_bucket }}"
+      s3_bucket_prefix: "lambda-functions"
+      tags:
+        Name: "{{ item.name }}"
+  loop: "{{ aws_backup_validation.resources }}"
+  when: item.git_url is not defined
 
-- name: Create backup validation Lambda functions.
+- name: Create Lambda functions from git url.
   ansible.builtin.include_role:
     name: aws/aws_lambda
   vars:
     aws_lambda:
-      name: "{{ aws_backup_validation.name }}_{{ item }}"
-      description: "{{ aws_backup_validation.description }}"
+      name: "{{ item.name }}"
+      description: "Lambda functions for {{ item.type }} validation."
       timeout: "{{ aws_backup_validation.timeout }}"
-      role: "{{ aws_iam_role._result['LambdaBackupRestoreRole'] }}"
+      role: "{{ aws_iam_role._result[item.name + '_lambda'] }}"
       runtime: "{{ aws_backup_validation.runtime }}"
-      function_file: "{{ lookup('template', item + '_validation.py.j2') }}"
+      function_file: "{{ item.git_url }}"
       s3_bucket: "{{ aws_backup_validation.s3_bucket }}"
       s3_bucket_prefix: "lambda-functions"
       tags:
-        Name: "{{ item }}_backup_validation"
+        Name: "{{ item.name }}"
   loop: "{{ aws_backup_validation.resources }}"
+  when: item.git_url is defined
 
 - name: Create an IAM Managed Policy for passing roles and setup IAM role.
   ansible.builtin.include_role:
@@ -53,79 +111,52 @@
 #- name: Get verified domain.
 #  ansible.builtin.include_tasks: get_valid_email.yml
 
-- name: Get info about newly created restore testing plan.
-  ansible.builtin.command: >
-    aws backup list-restore-testing-plans --region {{ _aws_region }}
-  register: _testing_plans
-
-- name: Create validation report function.
-  ansible.builtin.include_role:
-    name: aws/aws_lambda
-  vars:
-    aws_lambda:
-      name: "validation_report"
-      description: "{{ aws_backup_validation.description }}"
-      timeout: "30"
-      role: "{{ aws_iam_role._result['LambdaBackupRestoreRole'] }}"
-      runtime: "{{ aws_backup_validation.runtime }}"
-      function_file: "{{ lookup('template', 'validation_report.py.j2') }}"
-      s3_bucket: "{{ aws_backup_validation.s3_bucket }}"
-      s3_bucket_prefix: "lambda-functions"
-      tags:
-        Name: "validation_report"
-
-- name: Get account ID for ARN.
-  ansible.builtin.command: >-
-    aws sts get-caller-identity
-    --query Account
-    --output text
-  register: _acc_id
-
-- name: Setting previous command output into variable.
-  ansible.builtin.set_fact:
-    _acc_id: "{{ _acc_id.stdout | from_json }}"
-
-- name: Create EventBridge for validation functions.
+- name: Create EventBridge with lambda functions.
   amazon.aws.cloudwatchevent_rule:
-    name: "RestoreValidation_{{ item }}"
+    name: "{{ item.name }}"
     description: "{{ aws_backup_validation.description }}"
     state: present
     region: "{{ _aws_region }}"
-    event_pattern: '{ "source": ["aws.backup"], "detail-type": ["Restore Job State Change"], "detail": { "resourceType": ["{{ item }}"], "status": ["COMPLETED"] } }'
+    role_arn: "arn:aws:iam::{{ _acc_id }}:role/{{ item.name }}_event"
+    event_pattern: >-
+      {{ item.event_pattern | default(
+        {
+          "source": ["aws.backup"],
+          "detail-type": ["Restore Job State Change"],
+          "detail": {
+            "resourceType": [ item.type ],
+            "status": ["COMPLETED"]
+          }
+        } | to_json
+      ) }}
     targets:
-      - id: "RestoreValidation_{{ item }}"
-        arn: "arn:aws:lambda:{{ _aws_region }}:{{ _acc_id }}:function:RestoreValidation_{{ item }}"
+      - id: "{{ item.name }}"
+        arn: "arn:aws:lambda:{{ _aws_region }}:{{ _acc_id }}:function:{{ item.name }}"
   loop: "{{ aws_backup_validation.resources }}"
+  when: item.type != "Schedule"
   register: _event_bridges
 
 - name: Create schedule for validation reports.
   amazon.aws.cloudwatchevent_rule:
-    name: validation_report
-    schedule_expression: "cron(0 0 ? * MON *)"
-    description: Run validation reporting
+    name: "{{ item.name }}"
+    schedule_expression: "{{ item.schedule }}"
+    description: "Run validation reporting."
     region: "{{ _aws_region }}"
+    role_arn: "arn:aws:iam::{{ _acc_id }}:role/{{ item.name }}_event"
     targets:
       - id: validation_report
-        arn: "{{ (aws_lambda._result['validation_report'].configuration.function_arn.split(':') | map('trim'))[:-1] | join(':') }}" # Remove the version number from ARN
+        arn: "arn:aws:lambda:{{ _aws_region }}:{{ _acc_id }}:function:{{ item.name }}"
+  loop: "{{ aws_backup_validation.resources }}"
+  when: item.type == "Schedule"
   register: _validation_event
 
-- name: Update Lambda policy.
+- name: Update Lambda policies.
   amazon.aws.lambda_policy:
     state: present
-    function_name: "{{ item.rule.name }}"
-    statement_id: "{{ item.rule.name }}"
+    function_name: "{{ item.name }}"
+    statement_id: "{{ item.name }}"
     action: lambda:InvokeFunction
     principal: events.amazonaws.com
-    source_arn: "{{ item.rule.arn }}"
-    region: "{{ _aws_region }}"
-  loop: "{{ _event_bridges.results }}"
-
-- name: Update lambda validation report policy.
-  amazon.aws.lambda_policy:
-    state: present
-    function_name: "validation_report"
-    statement_id: "validation_report"
-    action: lambda:InvokeFunction
-    principal: events.amazonaws.com
-    source_arn: "{{ _validation_event.rule.arn }}"
+    source_arn:  "arn:aws:events:{{ _aws_region }}:{{ _acc_id }}:rule/{{ item.name }}"
     region: "{{ _aws_region }}"
+  loop: "{{ aws_backup_validation.resources }}"

roles/aws/aws_backup_validation/tasks/testing_resources.yml

@@ -68,34 +68,26 @@
       instance: "EC2"
       file-system: "EFS"
       db: "RDS"
-      cluster: "AURORA"
+      cluster: "Aurora"
 
 - name: Set instance type for template.
   ansible.builtin.set_fact:
     _instance_type_restore: "{{ instance_type[backup.resource_type] }}"
-    _template_prefix: "{{ instance_type[backup.resource_type] }}"
   when: backup.resource_type != 'file-system'
 
-- name: Set instance type to Aurora if defined.
-  ansible.builtin.set_fact:
-    _instance_type_restore: "Aurora"
-  when:
-    - backup.resource_type == 'db'
-    - "'aurora' in aws_rds.engine"
-
 - name: Create restore testing query file.
   ansible.builtin.template:
-    src: "{{ _template_prefix }}_restore_testing.j2"
+    src: "{{ _instance_type_restore }}_restore_testing.j2"
     dest: /tmp/restore_testing.json
   register: _restore_testing_query
-  when: _template_prefix is defined
+  when: _instance_type_restore is defined
 
 - name: Check if protected reource exist.
   ansible.builtin.command: >
     aws backup list-protected-resources --query "Results[?ResourceArn=='{{ _resource_arn }}']" --region {{ _aws_region }}
   register: _protected_res
 
-- name: Assign {{ _template_prefix }} resource to AWS restore testing plan.
+- name: Assign {{ _instance_type_restore }} resource to AWS restore testing plan.
   ansible.builtin.command: >
     aws backup create-restore-testing-selection --cli-input-json file:///tmp/restore_testing.json --region {{ _aws_region }}
-  when: _template_prefix is defined and _testing_plan_info.stdout != "null" and _testing_selection_exists.stdout | length == 0 and _protected_res.stdout | length != 0
+  when: _instance_type_restore is defined and _testing_plan_info.stdout != "null" and _testing_selection_exists.stdout | length == 0 and _protected_res.stdout | length != 0