Skip to content

ENG-1290: Allow creating resources for multiple environments in the same account. #120

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
TurboNHS wants to merge 15 commits into
base: main
Choose a base branch
from
Open

ENG-1290: Allow creating resources for multiple environments in the same account. #120

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
299956b
Allow to include environment name in resource names.
TurboNHS Apr 22, 2026
af74023
Allow creating resources for multiple environments in the same account.
TurboNHS Apr 23, 2026
f71f2b4
Improve the selection process by utilising the `selection_tags` varia…
TurboNHS Apr 23, 2026
c1626bd
Allow to include environment name in resource names.
TurboNHS Apr 24, 2026
655393b
Run code through `terraform fmt`.
TurboNHS Apr 27, 2026
b89d827
Run code through `terraform fmt`.
TurboNHS Apr 27, 2026
87eff4a
ENG-1290 Pinned action
terado Jul 17, 2026
b3c6cda
ENG-1290 Run version check on all branches and bump to v1.5.0
terado Jul 17, 2026
ac32323
Merge branch 'main' into turbo-resources-in-same-account2
terado Jul 17, 2026
2333101
Unify remote access variable.
TurboNHS Jul 16, 2026
2910ac7
Fix unnecessary duplication.
TurboNHS Jul 20, 2026
9675b17
Merge branch 'main' into turbo-resources-in-same-account2
TurboNHS Jul 23, 2026
7c1d737
Revert all changes to the Destination module.
TurboNHS Jul 23, 2026
e0dfa3b
Review fixes - remove the `resources_in_same_account`.
TurboNHS Jul 23, 2026
9632c91
Review fix - remove comment about `create_framework`.
TurboNHS Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 35 additions & 4 deletions modules/aws-backup-source/backup_framework.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,12 @@
# There can be only one [framework with x controls in one account]!

data "aws_backup_framework" "main" {
count = var.backup_plan_config.enable && var.backup_plan_config.create_framework ? 1 : 0
name = replace("${local.resource_name_prefix}-framework", "-", "_")
}
Comment on lines +3 to +6

@susana-zhou1 susana-zhou1 Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This data block is attempting to read existing information in the account, this means there will be resource reusing across the sub-environments which we agreed we wouldn't support.
Environments where the framework isn't being created, just won't have a framework attached to the plan

@TurboNHS TurboNHS Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's fine, it's actually only used in the locals, which you commented on above.

resource "aws_backup_framework" "main" {
count = var.backup_plan_config.enable && var.backup_plan_config.create_framework ? 1 : 0

# must be underscores instead of dashes
name = replace("${local.resource_name_prefix}-framework", "-", "_")
description = "${var.project_name} Backup Framework"
Expand Down Expand Up @@ -131,8 +139,12 @@ resource "aws_backup_framework" "main" {
}
}

data "aws_backup_framework" "dynamodb" {
count = var.backup_plan_config_dynamodb.enable && var.backup_plan_config_dynamodb.create_framework ? 1 : 0
name = replace("${local.resource_name_prefix}-dynamodb-framework", "-", "_")
}
resource "aws_backup_framework" "dynamodb" {
count = var.backup_plan_config_dynamodb.enable ? 1 : 0
count = var.backup_plan_config_dynamodb.enable && var.backup_plan_config_dynamodb.create_framework ? 1 : 0
# must be underscores instead of dashes
name = replace("${local.resource_name_prefix}-dynamodb-framework", "-", "_")
description = "${var.project_name} DynamoDB Backup Framework"
Expand Down Expand Up @@ -172,8 +184,12 @@ resource "aws_backup_framework" "dynamodb" {
}
}

data "aws_backup_framework" "ebsvol" {
count = var.backup_plan_config_ebsvol.enable && var.backup_plan_config_ebsvol.create_framework ? 1 : 0
name = replace("${local.resource_name_prefix}-ebsvol-framework", "-", "_")
}
resource "aws_backup_framework" "ebsvol" {
count = var.backup_plan_config_ebsvol.enable ? 1 : 0
count = var.backup_plan_config_ebsvol.enable && var.backup_plan_config_ebsvol.create_framework ? 1 : 0
# must be underscores instead of dashes
name = replace("${local.resource_name_prefix}-ebsvol-framework", "-", "_")
description = "${var.project_name} EBS Backup Framework"
Expand Down Expand Up @@ -213,8 +229,12 @@ resource "aws_backup_framework" "ebsvol" {
}
}

data "aws_backup_framework" "aurora" {
count = var.backup_plan_config_aurora.enable && var.backup_plan_config_aurora.create_framework ? 1 : 0
name = replace("${local.resource_name_prefix}-aurora-framework", "-", "_")
}
resource "aws_backup_framework" "aurora" {
count = var.backup_plan_config_aurora.enable ? 1 : 0
count = var.backup_plan_config_aurora.enable && var.backup_plan_config_aurora.create_framework ? 1 : 0
# must be underscores instead of dashes
name = replace("${local.resource_name_prefix}-aurora-framework", "-", "_")
description = "${var.project_name} Aurora Backup Framework"
Expand Down Expand Up @@ -253,8 +273,12 @@ resource "aws_backup_framework" "aurora" {
}
}

data "aws_backup_framework" "parameter_store" {
count = var.backup_plan_config_parameter_store.enable && var.backup_plan_config_parameter_store.create_framework ? 1 : 0
name = replace("${local.resource_name_prefix}-parameter-store-framework", "-", "_")
}
resource "aws_backup_framework" "parameter_store" {
count = var.backup_plan_config_parameter_store.enable ? 1 : 0
count = var.backup_plan_config_parameter_store.enable && var.backup_plan_config_parameter_store.create_framework ? 1 : 0
# must be underscores instead of dashes
name = replace("${local.resource_name_prefix}-parameter-store-framework", "-", "_")
description = "${var.project_name} Parameter Store Backup Framework"
Expand Down Expand Up @@ -292,3 +316,10 @@ resource "aws_backup_framework" "parameter_store" {
}
}
}

# -----

moved {
from = aws_backup_framework.main
to = aws_backup_framework.main[0]
}
44 changes: 39 additions & 5 deletions modules/aws-backup-source/backup_plan.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,12 @@ resource "aws_backup_selection" "default" {
}
condition {
dynamic "string_equals" {
for_each = local.selection_tags_null_checked
for_each = concat(local.selection_tags_null_checked, [
{
"key" : var.backup_plan_config.selection_tag,
"value" : var.backup_plan_config.selection_tag_value != null ? var.backup_plan_config.selection_tag_value : "True"
}
])
content {
key = (try(string_equals.value.key, null) == null) ? null : "aws:ResourceTag/${string_equals.value.key}"
value = try(string_equals.value.value, null)
Expand All @@ -190,7 +195,12 @@ resource "aws_backup_selection" "dynamodb" {
}
condition {
dynamic "string_equals" {
for_each = local.selection_tags_dynamodb_null_checked
for_each = concat(local.selection_tags_dynamodb_null_checked, [
{
"key" : var.backup_plan_config_dynamodb.selection_tag,
"value" : var.backup_plan_config_dynamodb.selection_tag_value != null ? var.backup_plan_config_dynamodb.selection_tag_value : "True"
}
])
content {
key = (try(string_equals.value.key, null) == null) ? null : "aws:ResourceTag/${string_equals.value.key}"
value = try(string_equals.value.value, null)
Expand All @@ -212,7 +222,12 @@ resource "aws_backup_selection" "ebsvol" {
}
condition {
dynamic "string_equals" {
for_each = local.selection_tags_ebsvol_null_checked
for_each = concat(local.selection_tags_ebsvol_null_checked, [
{
"key" : var.backup_plan_config_ebsvol.selection_tag,
"value" : var.backup_plan_config_ebsvol.selection_tag_value != null ? var.backup_plan_config_ebsvol.selection_tag_value : "True"
}
])
content {
key = (try(string_equals.value.key, null) == null) ? null : "aws:ResourceTag/${string_equals.value.key}"
value = try(string_equals.value.value, null)
Expand All @@ -230,7 +245,21 @@ resource "aws_backup_selection" "aurora" {
selection_tag {
key = var.backup_plan_config_aurora.selection_tag
type = "STRINGEQUALS"
value = "True"
value = var.backup_plan_config_aurora.selection_tag_value == null ? "True" : var.backup_plan_config_aurora.selection_tag_value
}
condition {
dynamic "string_equals" {
for_each = concat(local.selection_tags_aurora_null_checked, [
{
"key" : var.backup_plan_config_aurora.selection_tag,
"value" : var.backup_plan_config_aurora.selection_tag_value != null ? var.backup_plan_config_aurora.selection_tag_value : "True"
}
])
content {
key = try(string_equals.value.key, null) == null ? null : "aws:ResourceTag/${string_equals.value.key}"
value = try(string_equals.value.value, null)
}
}
}
}

Expand All @@ -247,7 +276,12 @@ resource "aws_backup_selection" "parameter_store" {
}
condition {
dynamic "string_equals" {
for_each = local.selection_tags_parameter_store_null_checked
for_each = concat(local.selection_tags_parameter_store_null_checked, [
{
"key" : var.backup_plan_config_parameter_store.selection_tag,
"value" : var.backup_plan_config_parameter_store.selection_tag_value != null ? var.backup_plan_config_parameter_store.selection_tag_value : "True"
}
])
content {
key = (try(string_equals.value.key, null) == null) ? null : "aws:ResourceTag/${string_equals.value.key}"
value = try(string_equals.value.value, null)
Expand Down
8 changes: 4 additions & 4 deletions modules/aws-backup-source/backup_report_plan.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Create the reports
resource "aws_backup_report_plan" "backup_jobs" {
name = var.name_prefix != null ? "${replace(var.name_prefix, "-", "_")}_backup_jobs" : "backup_jobs"
name = var.name_prefix != null ? "${replace(local.resource_name_prefix, "-", "_")}_backup_jobs" : "backup_jobs"
description = "Report for showing whether backups ran successfully in the last 24 hours"

report_delivery_channel {
Expand All @@ -18,7 +18,7 @@ resource "aws_backup_report_plan" "backup_jobs" {

# Create the restore testing completion reports
resource "aws_backup_report_plan" "backup_restore_testing_jobs" {
name = var.name_prefix != null ? "${replace(var.name_prefix, "-", "_")}_backup_restore_testing_jobs" : "backup_restore_testing_jobs"
name = var.name_prefix != null ? "${replace(local.resource_name_prefix, "-", "_")}_backup_restore_testing_jobs" : "backup_restore_testing_jobs"
description = "Report for showing whether backup restore test ran successfully in the last 24 hours"

report_delivery_channel {
Expand All @@ -35,7 +35,7 @@ resource "aws_backup_report_plan" "backup_restore_testing_jobs" {
}

resource "aws_backup_report_plan" "resource_compliance" {
name = var.name_prefix != null ? "${replace(var.name_prefix, "-", "_")}_resource_compliance" : "resource_compliance"
name = var.name_prefix != null ? "${replace(local.resource_name_prefix, "-", "_")}_resource_compliance" : "resource_compliance"
description = "Report for showing whether resources are compliant with the framework"

report_delivery_channel {
Expand All @@ -55,7 +55,7 @@ resource "aws_backup_report_plan" "resource_compliance" {

resource "aws_backup_report_plan" "copy_jobs" {
count = var.backup_copy_vault_arn != "" && var.backup_copy_vault_account_id != "" ? 1 : 0
name = var.name_prefix != null ? "${replace(var.name_prefix, "-", "_")}_copy_jobs" : "copy_jobs"
name = var.name_prefix != null ? "${replace(local.resource_name_prefix, "-", "_")}_copy_jobs" : "copy_jobs"
description = "Report for showing whether copies ran successfully in the last 24 hours"

report_delivery_channel {
Expand Down
47 changes: 34 additions & 13 deletions modules/aws-backup-source/backup_restore_testing.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
resource "awscc_backup_restore_testing_plan" "backup_restore_testing_plan" {
restore_testing_plan_name = var.name_prefix != null ? "${var.name_prefix}_backup_restore_testing_plan" : "backup_restore_testing_plan"
restore_testing_plan_name = var.name_prefix != null ? "${replace(local.resource_name_prefix, "-", "_")}_backup_restore_testing_plan" : "backup_restore_testing_plan"
schedule_expression = var.restore_testing_plan_scheduled_expression
start_window_hours = var.restore_testing_plan_start_window
recovery_point_selection = {
Expand All @@ -18,10 +18,17 @@ resource "awscc_backup_restore_testing_selection" "backup_restore_testing_select
restore_testing_selection_name = "backup_restore_testing_selection_dynamodb"
protected_resource_arns = ["*"]
protected_resource_conditions = {
string_equals = [{
key = "aws:ResourceTag/${var.backup_plan_config_dynamodb.selection_tag}"
value = "True"
}]
string_equals = concat([
{
key = "aws:ResourceTag/${var.backup_plan_config_dynamodb.selection_tag}"
value = "True"
}
], [
for tag in local.selection_tags_dynamodb_null_checked: {
key = "aws:ResourceTag/${tag.key}",
value = tag.value
}
])
}
}

Expand All @@ -34,10 +41,17 @@ resource "awscc_backup_restore_testing_selection" "backup_restore_testing_select
restore_testing_selection_name = "backup_restore_testing_selection_ebsvol"
protected_resource_arns = ["*"]
protected_resource_conditions = {
string_equals = [{
key = "aws:ResourceTag/${var.backup_plan_config_ebsvol.selection_tag}"
value = "True"
}]
string_equals = concat([
{
key = "aws:ResourceTag/${var.backup_plan_config_ebsvol.selection_tag}"
value = "True"
}
], [
for tag in local.selection_tags_ebsvol_null_checked: {
key = "aws:ResourceTag/${tag.key}",
value = tag.value
}
])
}
}

Expand All @@ -49,10 +63,17 @@ resource "awscc_backup_restore_testing_selection" "backup_restore_testing_select
restore_testing_selection_name = "backup_restore_testing_selection_aurora"
protected_resource_arns = ["*"]
protected_resource_conditions = {
string_equals = [{
key = "aws:ResourceTag/${var.backup_plan_config_aurora.selection_tag}"
value = "True"
}]
string_equals = concat([
{
key = "aws:ResourceTag/${var.backup_plan_config_aurora.selection_tag}"
value = "True"
}
], [
for tag in local.selection_tags_aurora_null_checked: {
key = "aws:ResourceTag/${tag.key}",
value = tag.value
}
])
}
restore_metadata_overrides = local.aurora_overrides
}
2 changes: 1 addition & 1 deletion modules/aws-backup-source/iam.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ data "aws_iam_policy_document" "assume_role" {
}

resource "aws_iam_role" "backup" {
name = "${var.project_name}BackupRole"
name = "${var.include_environment_in_resource_names ? "${var.project_name}-${var.environment_name}" : var.project_name}BackupRole"
assume_role_policy = data.aws_iam_policy_document.assume_role.json
permissions_boundary = length(var.iam_role_permissions_boundary) > 0 ? var.iam_role_permissions_boundary : null
}
Expand Down
2 changes: 1 addition & 1 deletion modules/aws-backup-source/kms.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ resource "aws_kms_key" "aws_backup_key" {
}

resource "aws_kms_alias" "backup_key" {
name = var.name_prefix != null ? "alias/${var.name_prefix}/backup-key" : "alias/${var.environment_name}/backup-key"
name = var.name_prefix != null ? "alias/${var.include_environment_in_resource_names ? "${local.resource_name_prefix}" : var.name_prefix}/backup-key" : "alias/${var.environment_name}/backup-key"
target_key_id = aws_kms_key.aws_backup_key.key_id
}

Expand Down
30 changes: 18 additions & 12 deletions modules/aws-backup-source/locals.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,21 +1,27 @@
locals {
resource_name_prefix = var.name_prefix != null ? var.name_prefix : "${data.aws_region.current.id}-${data.aws_caller_identity.current.account_id}-backup"
resource_name_prefix = var.name_prefix != null ? (var.include_environment_in_resource_names ? "${var.name_prefix}-${var.environment_name}" : var.name_prefix) : (var.include_environment_in_resource_names ? "${data.aws_region.current.id}-${data.aws_caller_identity.current.account_id}-${var.environment_name}-backup" : "${data.aws_region.current.id}-${data.aws_caller_identity.current.account_id}-backup")

selection_tag_value_null_checked = (var.backup_plan_config.selection_tag_value == null) ? "True" : var.backup_plan_config.selection_tag_value
selection_tag_value_aurora_null_checked = (var.backup_plan_config_aurora.selection_tag_value == null) ? "True" : var.backup_plan_config_aurora.selection_tag_value
selection_tag_value_dynamodb_null_checked = (var.backup_plan_config_dynamodb.selection_tag_value == null) ? "True" : var.backup_plan_config_dynamodb.selection_tag_value
selection_tags_null_checked = (var.backup_plan_config.selection_tags == null) ? [{ "key" : var.backup_plan_config.selection_tag, "value" : local.selection_tag_value_null_checked }] : var.backup_plan_config.selection_tags
selection_tags_dynamodb_null_checked = (var.backup_plan_config_dynamodb.selection_tags == null) ? [{ "key" : var.backup_plan_config_dynamodb.selection_tag, "value" : local.selection_tag_value_dynamodb_null_checked }] : var.backup_plan_config_dynamodb.selection_tags
selection_tag_value_ebsvol_null_checked = (var.backup_plan_config_ebsvol.selection_tag_value == null) ? "True" : var.backup_plan_config_ebsvol.selection_tag_value
selection_tags_ebsvol_null_checked = (var.backup_plan_config_ebsvol.selection_tags == null) ? [{ "key" : var.backup_plan_config_ebsvol.selection_tag, "value" : local.selection_tag_value_ebsvol_null_checked }] : var.backup_plan_config_ebsvol.selection_tags
selection_tag_value_parameter_store_null_checked = (var.backup_plan_config_parameter_store.selection_tag_value == null) ? "True" : var.backup_plan_config_parameter_store.selection_tag_value
selection_tags_parameter_store_null_checked = (var.backup_plan_config_parameter_store.selection_tags == null) ? [{ "key" : var.backup_plan_config_parameter_store.selection_tag, "value" : local.selection_tag_value_parameter_store_null_checked }] : var.backup_plan_config_parameter_store.selection_tags
framework_arn_list = flatten(concat(
[aws_backup_framework.main.arn],
var.backup_plan_config_ebsvol.enable ? [aws_backup_framework.ebsvol[0].arn] : [],
var.backup_plan_config_dynamodb.enable ? [aws_backup_framework.dynamodb[0].arn] : [],
var.backup_plan_config_aurora.enable ? [aws_backup_framework.aurora[0].arn] : [],
var.backup_plan_config_parameter_store.enable ? [aws_backup_framework.parameter_store[0].arn] : []

selection_tags_null_checked = (var.backup_plan_config.selection_tags == null) ? [{ "key" : var.backup_plan_config.selection_tag, "value" : local.selection_tag_value_null_checked }] : var.backup_plan_config.selection_tags
selection_tags_aurora_null_checked = (var.backup_plan_config_aurora.selection_tags == null) ? [{ "key" : var.backup_plan_config_aurora.selection_tag, "value" : local.selection_tag_value_aurora_null_checked }] : var.backup_plan_config_aurora.selection_tags
selection_tags_dynamodb_null_checked = (var.backup_plan_config_dynamodb.selection_tags == null) ? [{ "key" : var.backup_plan_config_dynamodb.selection_tag, "value" : local.selection_tag_value_dynamodb_null_checked }] : var.backup_plan_config_dynamodb.selection_tags
selection_tags_ebsvol_null_checked = (var.backup_plan_config_ebsvol.selection_tags == null) ? [{ "key" : var.backup_plan_config_ebsvol.selection_tag, "value" : local.selection_tag_value_ebsvol_null_checked }] : var.backup_plan_config_ebsvol.selection_tags
selection_tags_parameter_store_null_checked = (var.backup_plan_config_parameter_store.selection_tags == null) ? [{ "key" : var.backup_plan_config_parameter_store.selection_tag, "value" : local.selection_tag_value_parameter_store_null_checked }] : var.backup_plan_config_parameter_store.selection_tags

framework_arn_list = flatten(concat(
var.backup_plan_config.enable ? aws_backup_framework.main[0].arn : [],
var.backup_plan_config_ebsvol.enable ? data.aws_backup_framework.ebsvol[0].arn : [],
var.backup_plan_config_dynamodb.enable ? data.aws_backup_framework.dynamodb[0].arn : [],
var.backup_plan_config_aurora.enable ? data.aws_backup_framework.aurora[0].arn : [],
Comment on lines +18 to +20

@susana-zhou1 susana-zhou1 Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this should be the created framework, otherwise when the enable is set to true and create_framework too it will not be using the created framework.

@TurboNHS TurboNHS Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, so something like

var.backup_plan_config_XXX.enable && var.backup_plan_config_XXX.create_framework ? aws_backup_framework.XXX[0].arn : []

Like the original code, but just add the .create_framework?

  framework_arn_list = flatten(concat(
    [aws_backup_framework.main.arn],
    var.backup_plan_config_ebsvol.enable ? [aws_backup_framework.ebsvol[0].arn] : [],
    var.backup_plan_config_dynamodb.enable ? [aws_backup_framework.dynamodb[0].arn] : [],
    var.backup_plan_config_aurora.enable ? [aws_backup_framework.aurora[0].arn] : [],
    var.backup_plan_config_parameter_store.enable ? [aws_backup_framework.parameter_store[0].arn] : []

  ))

@susana-zhou1 susana-zhou1 Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, exactly. and the main framework will also have it toggles based on the general backup_plan_config

var.backup_plan_config_parameter_store.enable ? data.aws_backup_framework.parameter_store[0].arn : []
))
aurora_overrides = var.backup_plan_config_aurora.restore_testing_overrides == null ? null : jsondecode(var.backup_plan_config_aurora.restore_testing_overrides)

aurora_overrides = var.backup_plan_config_aurora.restore_testing_overrides == null ? null : jsondecode(var.backup_plan_config_aurora.restore_testing_overrides)

terraform_role_arns = length(var.terraform_role_arns) > 0 ? var.terraform_role_arns : [var.terraform_role_arn]
}
Loading
Loading