SupportSages

Managing backups is a critical task for ensuring data integrity and availability in cloud environments. AWS Backup provides a centralized way to automate and manage backups across AWS services. However, keeping track of backup plans, selections, and jobs can become complex as your infrastructure grows.

In this blog, I’ll guide you through creating an AWS Lambda function that automates the process of listing backup plans, selections, and jobs, giving you a clear overview of your backup strategy.

Prerequisites

Before diving into the implementation, make sure you have:

• An AWS account
• Basic knowledge of AWS Lambda and the Backup service
• Appropriate IAM permissions to access AWS Backup resources

Overview

The Lambda function we’ll create will perform the following tasks:

1. List all backup plans in your AWS account.
2. For each backup plan, list the resource selections.
3. Retrieve and display the most recent backup job for each plan.

Let’s dive into the code and understand how it works.

Step 1: Setting Up IAM Roles and Policies

Before creating the Lambda function, ensure you have the necessary IAM permissions. Create an IAM role with a policy that allows access to AWS Backup services:

{
 "Version": "2012-10-17",
 "Statement": [
  {
   "Effect": "Allow",
   "Action": [
    "backup:DescribeBackupVault",
    "backup:ListBackupPlans",
    "backup:ListBackupJobs",
    "backup:GetBackupPlan",
    "backup:ListBackupVaults",
    "backup:GetBackupVaultAccessPolicy",
    "backup:ListBackupSelections",
    "backup:DescribeBackupVault",
    "backup:ListRecoveryPointsByBackupVault",
    "backup:GetBackupSelection"
   ],
   "Resource": "*"
  }
 ]
}

Attach this policy to the role that your Lambda function will use.

Step 2: Create the Lambda Function

Now, let’s create the Lambda function using the following Python script:

import boto3
import json

backup_client = boto3.client('backup')

def lambda_handler(event, context):
    backup_plans = backup_client.list_backup_plans()['BackupPlansList']
    
    results = []
    
    for plan in backup_plans:
        plan_id = plan['BackupPlanId']
        plan_name = plan['BackupPlanName']
        print(f"Backup Plan: {plan_name} (ID: {plan_id})")
        
        plan_details = backup_client.get_backup_plan(BackupPlanId=plan_id)['BackupPlan']
        rules = plan_details['Rules']
        
        for rule in rules:
            rule_name = rule['RuleName']
            policy = rule.get('ScheduleExpression', 'No Schedule Expression')
            
            vault_name = rule.get('TargetBackupVaultName', None)
            
            if vault_name:
                vault_details = describe_backup_vault(vault_name)
                
                if vault_details:
                    recovery_points = list_recovery_points(vault_name)
                    
                    results.append({
                        'plan_name': plan_name,
                        'plan_id': plan_id,
                        'vault_name': vault_name,
                        'rule_name': rule_name,
                        'policy': policy,
                        'recovery_points': recovery_points
                    })
                else:
                    print(f"Failed to describe vault for {vault_name}")
            else:
                print(f"No vault associated with rule {rule_name} in plan {plan_name}")
    
    return {
        'statusCode': 200,
        'body': json.dumps(results, default=str)  # Convert datetime objects to string
    }

def describe_backup_vault(vault_name):
    try:
        response = backup_client.describe_backup_vault(BackupVaultName=vault_name)
        return response
    except Exception as e:
        print(f"Error describing vault {vault_name}: {str(e)}")
        return None

def list_recovery_points(vault_name):
    try:
        recovery_points = []
        next_token = None

        while True:
            # Fetch recovery points with the vault name and next_token if it exists
            if next_token:
                response = backup_client.list_recovery_points_by_backup_vault(BackupVaultName=vault_name, NextToken=next_token)
            else:
                response = backup_client.list_recovery_points_by_backup_vault(BackupVaultName=vault_name)
            
            for point in response.get('RecoveryPoints', []):
                recovery_points.append({
                    'recovery_point_arn': point.get('RecoveryPointArn'),
                    'creation_date': point.get('CreationDate'),
                    'resource_arn': point.get('ResourceArn'),
                    'resource_type': point.get('ResourceType'),
                    'backup_size': point.get('BackupSizeBytes')
                })
            
            next_token = response.get('NextToken')
            if not next_token:
                break
        return recovery_points
    
    except Exception as e:
        print(f"Error listing recovery points for vault {vault_name}: {str(e)}")
        return [];

Explanation

• AWS SDK (Boto3): We use Boto3 to interact with AWS Backup.
• List Backup Plans: Retrieves a list of all backup plans in the account.
• List Backup Selections: For each backup plan, lists the associated resource selections.
• List Backup Jobs: Retrieves the most recent backup job for each plan to provide a status update.
• Lambda Handler: Orchestrates the process and returns the results in JSON format.

Step 3: Deploy the Lambda Function

To deploy the function:

1. Open the AWS Management Console and navigate to the Lambda service.
2. Click “Create function” and choose “Author from scratch.”
3. Enter a name for your function and select the execution role created earlier.
4. Copy and paste the above Python script into the function code editor.
5. Click “Deploy.”

Step 4: Test the Lambda Function

You can test your Lambda function using the AWS Lambda console:

• Click on “Test” and create a new test event with the default template.
• Execute the function and check the results in the execution output.

Sample Output

The function returns a JSON array with details of each backup plan, including resource selections and the last backup job execution time:
sample output:

[
  {
    "plan_name": "sample-backup-plan",
    "plan_id": "sample-plan-id",
    "vault_name": "sample-vault-name",
    "frequency": "cron(0 12 ? * * *)",
    "recovery_points": [
      {
        "recovery_point_arn": "arn:aws:backup:region:account-id:recovery-point:sample-recovery-point-id",
        "creation_date": "2024-01-01 00:00:00+00:00",
        "resource_arn": "arn:aws:rds:region:account-id:cluster:sample-cluster",
        "resource_type": "Aurora",
        "backup_size": null
      }
    ]
  }
]

Conclusion

By following these steps, you have automated the process of monitoring AWS Backup plans, selections, and jobs using an AWS Lambda function. This setup provides a clear view of your backup strategy, helping you ensure that your data is protected and readily available when needed.

Implement this AWS Lambda function to automate monitoring your AWS Backup plans and gain full visibility over your backup strategy! Don’t leave your data security to chance.