Cloud Formation conditional resource property AWS Backup Resource

Question

Working with Cloud Formation template for AWS Backup and trying to make my backup plan flexible

BackupPlanProd:
Type: "AWS::Backup::BackupPlan"
Properties:
  BackupPlan:
    BackupPlanName: !Sub 'BACKUP-PLAN-PROD-${AWS::StackName}'
    AdvancedBackupSettings:
    - ResourceType: EC2
      BackupOptions: 
        WindowsVSS: !Ref VSSConsistent
    BackupPlanRule:
      - RuleName: !Sub Daily-${DailyBackupsRetentionProd}d-retention
        TargetBackupVault: !Ref BackupVaultProd
        ScheduleExpression: "cron(0 4 ? * 2,3,4,6,1,5 *)"
        StartWindowMinutes: 60
        Lifecycle: 
          DeleteAfterDays: !Ref DailyBackupsRetentionProd
        CopyActions:
          - DestinationBackupVaultArn: !If 
            - HasDisasterRecoveryDailyProd
            - !If
              - HasDisasterRecoveryCrossAccount
              - !Sub 'arn:aws:backup:${DisasterRecoveryRegion}:${DisasterRecoveryAccountId}:backup-vault:Default'
              - !Sub 'arn:aws:backup:${DisasterRecoveryRegion}:${AWS::AccountId}:backup-vault:Default'
            - !Ref "AWS::NoValue"
            Lifecycle:
              DeleteAfterDays: !If [HasDisasterRecoveryDailyProd, !Ref DisasterRecoveryDailyBackupsRetentionProd, !Ref "AWS::NoValue"]

Here is a problem with Property "CopyActions" where "DestinationBackupVaultArn" is a Required property according to documentation and using AWS::NoValue is not acceptable in this case will result in error:

Properties validation failed for resource BackupPlanProd with message: #/BackupPlan/BackupPlanRule/0/CopyActions/0: required key [DestinationBackupVaultArn] not found

Is there any workaround to make a property "CopyActions" conditional in this case without duplicating the whole resource in the template? e.g. If I don`t want to enable backups replication depends to my conditions.

Thanks :)

Marcin Marcin · Accepted Answer · 2021-02-27T22:14:41

Put your If one level higher, so that entire CopyActions gets removed if your condition is not satisfied.

Properties:
  BackupPlan:
    BackupPlanName: !Sub 'BACKUP-PLAN-PROD-${AWS::StackName}'
    AdvancedBackupSettings:
    - ResourceType: EC2
      BackupOptions: 
        WindowsVSS: !Ref VSSConsistent
    BackupPlanRule:
      - RuleName: !Sub Daily-${DailyBackupsRetentionProd}d-retention
        TargetBackupVault: !Ref BackupVaultProd
        ScheduleExpression: "cron(0 4 ? * 2,3,4,6,1,5 *)"
        StartWindowMinutes: 60
        Lifecycle: 
          DeleteAfterDays: !Ref DailyBackupsRetentionProd
        CopyActions: !If
          - HasDisasterRecoveryDailyProd
          - - DestinationBackupVaultArn
              # 
              # other properties    
              # 
              Lifecycle:
                DeleteAfterDays: !If [HasDisasterRecoveryDailyProd, !Ref DisasterRecoveryDailyBackupsRetentionProd, !Ref "AWS::NoValue"]
          - !Ref "AWS::NoValue"

Cloud Formation conditional resource property AWS Backup Resource

1 Answers