backup_vaults

Creates, updates, deletes or gets a backup_vault resource or lists backup_vaults in a region

Overview

Name	backup_vaults
Type	Resource
Description	Resource Type definition for AWS::Backup::BackupVault
Id	awscc.backup.backup_vaults

Fields

get (all properties)

Name	Datatype	Description
access_policy	object
backup_vault_name	string
backup_vault_tags	object
encryption_key_arn	string
▶notifications	object
▶lock_configuration	object
backup_vault_arn	string
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
backup_vault_name	string
region	string	AWS region.

For more information, see AWS::Backup::BackupVault.

Methods

Name	Resource	Accessible by	Required Params
create_resource	backup_vaults	INSERT	BackupVaultName, region
delete_resource	backup_vaults	DELETE	Identifier, region
update_resource	backup_vaults	UPDATE	Identifier, PatchDocument, region
list_resources	backup_vaults_list_only	SELECT	region
get_resource	backup_vaults	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual backup_vault.

SELECT
  region,
  access_policy,
  backup_vault_name,
  backup_vault_tags,
  encryption_key_arn,
  notifications,
  lock_configuration,
  backup_vault_arn
FROM awscc.backup.backup_vaults
WHERE
  region = 'us-east-1' AND
  Identifier = '{{ backup_vault_name }}';

list (identifiers only)

Lists all backup_vaults in a region.

SELECT
  region,
  backup_vault_name
FROM awscc.backup.backup_vaults_list_only
WHERE
  region = 'us-east-1';

INSERT example

Use the following StackQL query and manifest file to create a new backup_vault resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.backup.backup_vaults (
  BackupVaultName,
  region
)
SELECT
  '{{ backup_vault_name }}',
  '{{ region }}';

All Properties

/*+ create */
INSERT INTO awscc.backup.backup_vaults (
  AccessPolicy,
  BackupVaultName,
  BackupVaultTags,
  EncryptionKeyArn,
  Notifications,
  LockConfiguration,
  region
)
SELECT
  '{{ access_policy }}',
  '{{ backup_vault_name }}',
  '{{ backup_vault_tags }}',
  '{{ encryption_key_arn }}',
  '{{ notifications }}',
  '{{ lock_configuration }}',
  '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: backup_vault
    props:
      - name: access_policy
        value: {}
      - name: backup_vault_name
        value: '{{ backup_vault_name }}'
      - name: backup_vault_tags
        value: {}
      - name: encryption_key_arn
        value: '{{ encryption_key_arn }}'
      - name: notifications
        value:
          sns_topic_arn: '{{ sns_topic_arn }}'
          backup_vault_events:
            - '{{ backup_vault_events[0] }}'
      - name: lock_configuration
        value:
          min_retention_days: '{{ min_retention_days }}'
          max_retention_days: '{{ max_retention_days }}'
          changeable_for_days: '{{ changeable_for_days }}'

UPDATE example

Use the following StackQL query and manifest file to update a backup_vault resource, using stack-deploy.

/*+ update */
UPDATE awscc.backup.backup_vaults
SET PatchDocument = string('{{ {
    "AccessPolicy": access_policy,
    "BackupVaultTags": backup_vault_tags,
    "Notifications": notifications,
    "LockConfiguration": lock_configuration
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ backup_vault_name }}';

DELETE example

/*+ delete */
DELETE FROM awscc.backup.backup_vaults
WHERE
  Identifier = '{{ backup_vault_name }}' AND
  region = 'us-east-1';

Permissions

To operate on the backup_vaults resource, the following permissions are required:

Create

backup:TagResource,
backup:CreateBackupVault,
backup:PutBackupVaultAccessPolicy,
backup:PutBackupVaultNotifications,
backup:PutBackupVaultLockConfiguration,
backup-storage:Mount,
backup-storage:MountCapsule,
kms:CreateGrant,
kms:GenerateDataKey,
kms:Decrypt,
kms:RetireGrant,
kms:DescribeKey

Read

backup:DescribeBackupVault,
backup:GetBackupVaultNotifications,
backup:GetBackupVaultAccessPolicy,
backup:ListTags

Update

backup:DescribeBackupVault,
backup:DeleteBackupVaultAccessPolicy,
backup:DeleteBackupVaultNotifications,
backup:DeleteBackupVaultLockConfiguration,
backup:ListTags,
backup:TagResource,
backup:UntagResource,
backup:PutBackupVaultAccessPolicy,
backup:PutBackupVaultNotifications,
backup:PutBackupVaultLockConfiguration

Delete

backup:DeleteBackupVault

List

backup:ListBackupVaults