Skip to content

NRL-2180 Make backup lifecycle duration fit into vault lock retention period range #1209

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
anjalitrace2-nhs merged 4 commits into from
Apr 28, 2026
Merged

NRL-2180 Make backup lifecycle duration fit into vault lock retention period range #1209

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f20ab1e
NRL-2180 Make backup lifecycle duration fit into vault lock retention…
anjalitrace2-nhs Apr 23, 2026
3c73167
NRL-2180 Make defaults sensible and define retention period per env
anjalitrace2-nhs Apr 27, 2026
35efd5c
NRL-2180 remove retention defaults
anjalitrace2-nhs Apr 27, 2026
eae2b38
NRL-2180 remove redundant count line
anjalitrace2-nhs Apr 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions terraform/backup-infrastructure/modules/aws-backup-destination/backup_vault_lock.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
resource "aws_backup_vault_lock_configuration" "vault_lock" {
count = var.enable_vault_protection ? 1 : 0
backup_vault_name = aws_backup_vault.vault.name
changeable_for_days = var.vault_lock_type == "compliance" ? var.changeable_for_days : null
changeable_for_days = var.vault_lock_type == "compliance" ? var.changeable_for_days : null # providing changeable_for_days === enabling compliance mode
max_retention_days = var.vault_lock_max_retention_days
min_retention_days = var.vault_lock_min_retention_days
}
4 changes: 1 addition & 3 deletions terraform/backup-infrastructure/modules/aws-backup-destination/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,17 +51,15 @@ variable "vault_lock_type" {
variable "vault_lock_min_retention_days" {
description = "The minimum retention period that the vault retains its recovery points"
type = number
default = 365
}

variable "vault_lock_max_retention_days" {
description = "The maximum retention period that the vault retains its recovery points"
type = number
default = 365
}

variable "changeable_for_days" {
description = "How long you want the vault lock to be changeable for, only applies to compliance mode. This value is expressed in days no less than 3 and no greater than 36,500; otherwise, an error will return."
type = number
default = 14
default = 30
}
14 changes: 8 additions & 6 deletions terraform/backup-infrastructure/prod/aws-backup.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,12 +24,14 @@ resource "aws_kms_key" "destination_backup_key" {
module "destination" {
source = "../modules/aws-backup-destination"

source_account_name = "prod" # please note that the assigned value would be the prefix in aws_backup_vault.vault.name
account_id = local.destination_account_id
source_account_id = local.source_account_id
kms_key = aws_kms_key.destination_backup_key.arn
enable_vault_protection = true
vault_lock_type = "compliance"
source_account_name = "prod" # please note that the assigned value would be the prefix in aws_backup_vault.vault.name
account_id = local.destination_account_id
source_account_id = local.source_account_id
kms_key = aws_kms_key.destination_backup_key.arn
enable_vault_protection = true
vault_lock_type = "compliance"
vault_lock_min_retention_days = 28
vault_lock_max_retention_days = 400
}

###
Expand Down
13 changes: 8 additions & 5 deletions terraform/backup-infrastructure/test/aws-backup.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,11 +24,14 @@ resource "aws_kms_key" "destination_backup_key" {
module "destination" {
source = "../modules/aws-backup-destination"

source_account_name = "test" # please note that the assigned value would be the prefix in aws_backup_vault.vault.name
account_id = local.destination_account_id
source_account_id = local.source_account_id
kms_key = aws_kms_key.destination_backup_key.arn
enable_vault_protection = false
source_account_name = "test" # please note that the assigned value would be the prefix in aws_backup_vault.vault.name
account_id = local.destination_account_id
source_account_id = local.source_account_id
kms_key = aws_kms_key.destination_backup_key.arn
enable_vault_protection = false
vault_lock_type = "governance"
vault_lock_min_retention_days = 4
vault_lock_max_retention_days = 105
}

###
Expand Down
Loading