lgallard / terraform-aws-backup

Terraform module to create AWS Backup plans. AWS Backup is a fully managed backup service that makes it easy to centralize and automate the back up of data across AWS services (EBS volumes, RDS databases, DynamoDB tables, EFS file systems, and Storage Gateway volumes).

terraform-aws-backup

Terraform module to create AWS Backup plans. AWS Backup is a fully managed backup service that makes it easy to centralize and automate the back up of data across AWS services (EBS volumes, RDS databases, DynamoDB tables, EFS file systems, and Storage Gateway volumes).

Usage

You can use this module to create a simple plan using the module's rule_* variables. You can also use the rules and selections list of maps variables to build a more complete plan by defining several rules and selections at once.

Check the examples for the simple plan, complete plan, simple plan using variables and the selection by tags plan snippets.

Example (complete plan)

This example creates a plan with two rules and two selections at once. It also defines a vault key which is used by the first rule because no target_vault_name was given (null). Whereas the second rule is using the "Default" vault key.

The first selection has two assignments, the first defined by a resource ARN and the second one defined by a tag condition. The second selection has just one assignment defined by a resource ARN.

module "aws_backup_example" {

  source = "lgallard/backup/aws"

  # Vault
  vault_name = "vault-3"

  # Plan
  plan_name = "complete-plan"

  # Notifications
  notifications = {
    sns_topic_arn       = aws_sns_topic.backup_vault_notifications.arn
    backup_vault_events = ["BACKUP_JOB_STARTED", "BACKUP_JOB_COMPLETED", "BACKUP_JOB_FAILED", "RESTORE_JOB_COMPLETED"]
  }

  # Multiple rules using a list of maps
  rules = [
    {
      name                     = "rule-1"
      schedule                 = "cron(0 12 * * ? *)"
      target_vault_name        = null
      start_window             = 120
      completion_window        = 360
      enable_continuous_backup = true
      lifecycle = {
        cold_storage_after = 0
        delete_after       = 30
      },
      copy_actions = [
        {
          lifecycle = {
            cold_storage_after = 0
            delete_after       = 90
          },
          destination_vault_arn = "arn:aws:backup:us-west-2:123456789101:backup-vault:Default"
        },
      ]
      recovery_point_tags = {
        Environment = "production"
      }
    },
    {
      name                = "rule-2"
      schedule            = "cron(0 7 * * ? *)"
      target_vault_name   = "Default"
      schedule            = null
      start_window        = 120
      completion_window   = 360
      lifecycle           = {}
      copy_action         = {}
      recovery_point_tags = {}
    },
  ]

  # Multiple selections
  #  - Selection-1: By resources and tag
  #  - Selection-2: Only by resources
  #  - Selection-3: By resources and conditions
  selections = [
    {
      name      = "selection-1"
      resources     = ["arn:aws:dynamodb:us-east-1:123456789101:table/mydynamodb-table1"]
      not_resources = []
      selection_tags = [
        {
          type  = "STRINGEQUALS"
          key   = "Environment"
          value = "production"
        },
        {
          type  = "STRINGEQUALS"
          key   = "Owner"
          value = "production"
        }
      ]
    },
    {
      name      = "selection-2"
      resources = ["arn:aws:dynamodb:us-east-1:123456789101:table/mydynamodb-table2"]
    },
    {
      name          = "selection-3"
      resources     = ["arn:aws:dynamodb:us-east-1:123456789101:table/mydynamodb-table3"]
      not_resources = []
      conditions = {
        string_equals = [
          {
            key   = "aws:ResourceTag/Component"
            value = "rds"
          }
          ,
          {
            key   = "aws:ResourceTag/Project"
            value = "Project1"
          }
        ]
        string_like = [
          {
            key   = "aws:ResourceTag/Application"
            value = "app*"
          }
        ]
        string_not_equals = [
          {
            key   = "aws:ResourceTag/Backup"
            value = "false"
          }
        ]
        string_not_like = [
          {
            key   = "aws:ResourceTag/Environment"
            value = "test*"
          }
        ]
      }
    }
  ]

  tags = {
    Owner       = "backup team"
    Environment = "production"
    Terraform   = true
  }
}

Requirements

Name	Version
terraform	>= 0.12.31
aws	>= 4.26

Providers

Name	Version
aws	5.15.0

Modules

No modules.

Resources

Name	Type
aws_backup_plan.ab_plan	resource
aws_backup_report_plan.ab_report	resource
aws_backup_selection.ab_selection	resource
aws_backup_vault.ab_vault	resource
aws_backup_vault_lock_configuration.ab_vault_lock_configuration	resource
aws_backup_vault_notifications.backup_events	resource
aws_iam_policy.ab_tag_policy	resource
aws_iam_role.ab_role	resource
aws_iam_role_policy_attachment.ab_backup_s3_policy_attach	resource
aws_iam_role_policy_attachment.ab_policy_attach	resource
aws_iam_role_policy_attachment.ab_restores_policy_attach	resource
aws_iam_role_policy_attachment.ab_restores_s3_policy_attach	resource
aws_iam_role_policy_attachment.ab_tag_policy_attach	resource
aws_sns_topic_policy.backup_events	resource
aws_iam_policy_document.ab_role_assume_role_policy	data source
aws_iam_policy_document.ab_tag_policy_document	data source
aws_iam_policy_document.backup_events	data source
aws_partition.current	data source

Inputs

Name	Description	Type	Default	Required
changeable_for_days	The number of days before the lock date. If omitted creates a vault lock in governance mode, otherwise it will create a vault lock in compliance mode	number	null	no
enabled	Change to false to avoid deploying any AWS Backup resources	bool	true	no
iam_role_arn	If configured, the module will attach this role to selections, instead of creating IAM resources by itself	string	null	no
iam_role_name	Allow to set IAM role name, otherwise use predefined default	string	""	no
locked	Change to true to add a lock configuration for the backup vault	bool	false	no
max_retention_days	The maximum retention period that the vault retains its recovery points	number	null	no
min_retention_days	The minimum retention period that the vault retains its recovery points	number	null	no
notifications	Notification block which defines backup vault events and the SNS Topic ARN to send AWS Backup notifications to. Leave it empty to disable notifications	any	{}	no
notifications_disable_sns_policy	Disable the creation of the SNS policy. Enable if you need to manage the policy elsewhere.	bool	false	no
plan_name	The display name of a backup plan	string	null	no
reports	The default cache behavior for this distribution.	list(object({ name = string description = optional(string, null) formats = optional(list(string), null) s3_bucket_name = string s3_key_prefix = optional(string, null) report_template = string accounts = optional(list(string), null) organization_units = optional(list(string), null) regions = optional(list(string), null) framework_arns = optional(list(string), []) }))	[]	no
rule_completion_window	The amount of time AWS Backup attempts a backup before canceling the job and returning an error	number	null	no
rule_copy_action_destination_vault_arn	An Amazon Resource Name (ARN) that uniquely identifies the destination backup vault for the copied backup.	string	null	no
rule_copy_action_lifecycle	The lifecycle defines when a protected resource is copied over to a backup vault and when it expires.	map(any)	{}	no
rule_enable_continuous_backup	Enable continuous backups for supported resources.	bool	false	no
rule_lifecycle_cold_storage_after	Specifies the number of days after creation that a recovery point is moved to cold storage	number	null	no
rule_lifecycle_delete_after	Specifies the number of days after creation that a recovery point is deleted. Must be 90 days greater than cold_storage_after	number	null	no
rule_name	An display name for a backup rule	string	null	no
rule_recovery_point_tags	Metadata that you can assign to help organize the resources that you create	map(string)	{}	no
rule_schedule	A CRON expression specifying when AWS Backup initiates a backup job	string	null	no
rule_start_window	The amount of time in minutes before beginning a backup	number	null	no
rules	A list of rule maps	any	[]	no
selection_conditions	A map of conditions that you define to assign resources to your backup plans using tags.	map(any)	{}	no
selection_name	The display name of a resource selection document	string	null	no
selection_not_resources	An array of strings that either contain Amazon Resource Names (ARNs) or match patterns of resources to exclude from a backup plan.	list(any)	[]	no
selection_resources	An array of strings that either contain Amazon Resource Names (ARNs) or match patterns of resources to assign to a backup plan	list(any)	[]	no
selection_tags	List of tags for selection_name var, when using variable definition.	list(any)	[]	no
selections	A list of selction maps	any	[]	no
tags	A mapping of tags to assign to the resource	map(string)	{}	no
vault_force_destroy	A boolean that indicates that all recovery points stored in the vault are deleted so that the vault can be destroyed without error.	bool	false	no
vault_kms_key_arn	The server-side encryption key that is used to protect your backups	string	null	no
vault_name	Name of the backup vault to create. If not given, AWS use default	string	null	no
windows_vss_backup	Enable Windows VSS backup option and create a VSS Windows backup	bool	false	no

Outputs

Name	Description
plan_arn	The ARN of the backup plan
plan_id	The id of the backup plan
plan_role	The service role of the backup plan
plan_version	Unique, randomly generated, Unicode, UTF-8 encoded string that serves as the version ID of the backup plan
vault_arn	The ARN of the vault
vault_id	The name of the vault

Know Issue:

error creating Backup Vault

In case you get an error message similar to this one:

error creating Backup Vault (): AccessDeniedException: status code: 403, request id: 8e7e577e-5b74-4d4d-95d0-bf63e0b2cc2e,

Add the required IAM permissions mentioned in the CreateBackupVault row to the role or user creating the Vault (the one running Terraform CLI). In particular make sure kms and backup-storage permissions are added.

terraform-aws-backup's Issues

It doesn't get completion_window value

There's a space on line 22 and this prevent to get the value for this variable

  completion_window   = lookup(rule.value, "completion_window ", null)

Support for empty list of backup_vault_events in notifications

I am creating an organization specific aws backup module built on this module. I would like to have the user input the events they would like to be notified about, with a default of no events (empty list for var.notification_topics).

# Notifications
 notifications = {
    sns_topic_arn       = var.sns_topic_arn
    backup_vault_events = var.notification_topics
 }

But when the notification topics is an empty list, I get this error:

FatalError{Underlying: error while running command: exit status 1; 
Error: Provider produced inconsistent result after apply
        	            	
When applying changes to
module.aws_backup.module.aws_backup_module.aws_backup_vault_notifications.backup_events[0],
provider "provider[\"registry.terraform.io/hashicorp/aws\"]" produced an
unexpected new value: Root resource was present, but now absent.
        	            	
This is a bug in the provider, which should be reported in the provider's own
issue tracker.}

Invalid lifecycle. MoveToColdStorageAfterDays is unavailable

Hi,
When i'm trying to create a new backup plan i'm getting the following error :

Error: error creating Backup Plan: InvalidParameterValueException: Error in rule Yearly-Backups : Invalid lifecycle. MoveToColdStorageAfterDays is unavailable
{
  RespMetadata: {
    StatusCode: 400,
    RequestID: "********-6b2d-4863-a1d0-76d0f96f624e"
  },
  Code_: "ERROR_3015",
  Context: "[\"Yearly-Backups\",\"Invalid lifecycle. MoveToColdStorageAfterDays is unavailable\"]",
  Message_: "Error in rule Yearly-Backups : Invalid lifecycle. MoveToColdStorageAfterDays is unavailable"
}

Rules object looks like that :

 rules      = [
    {
      name                     = "Yearly-Backups"
      schedule                 = "cron(0 0 31 12 ? *)"
      target_vault_name        = var.vault_name
      enable_continuous_backup = true
      lifecycle = {
        cold_storage_after = 730
        delete_after       = 2555
      }
    }
  ]

Recovery point tags should be optional in rule list

The input rule_recovery_point_tags is optional with a default of {}.

So I would expect the attribute recovery_point_tags of the objects in the rules list to behave the same way.

But if I omit the attribute from my configuration like this:

module "backup" {
  source = "lgallard/backup/aws"
  version = ">= 0.11.4"

  vault_name = "main"

  plan_name = "main_plan"

  rules = [
    {
      name = "main_rule"
      schedule = "cron(0 0 * * ? *)"
      enable_continuous_backup = true
      lifecycle = {
        delete_after = 35
      }
      # recovery_point_tags = {}
    }
  ]

  windows_vss_backup = true

  selections = [
    {
      name = "main_selection"
      resources = [
        aws_instance.bastion.arn,
        aws_instance.server.arn,
        aws_db_instance.db_instance.arn
      ]
    }
  ]
}

My plan fails with an invalid value error.

Error: Invalid function argument

  on .terraform/modules/backup/main.tf line 24, in resource "aws_backup_plan" "ab_plan":
  24:       recovery_point_tags      = length(lookup(rule.value, "recovery_point_tags")) == 0 ? var.tags : lookup(rule.value, "recovery_point_tags")
    |----------------
    | rule.value is object with 4 attributes

Invalid value for "inputMap" parameter: the given object has no attribute
"recovery_point_tags".

This line appears to be the culprit:

terraform-aws-backup/main.tf

Line 24 in c690c3b

recovery_point_tags = length(lookup(rule.value, "recovery_point_tags")) == 0 ? var.tags : lookup(rule.value, "recovery_point_tags")

Because the lookup function doesn't have a default value of {}.

Selection based on tags only

selections = [
    {
      name      = "selection-1"
      selection_tag = {
        type  = "STRINGEQUALS"
        key   = "Backup"
        value = "true"
      }

    }
  ]

While trying to select resources based on tags only, the following error is shown :

Error: Invalid function argument

on .terraform/modules/backup/terraform-aws-backup-0.1.1/selection.tf line 9, in resource "aws_backup_selection" "ab_selection":
9: resources = lookup(element(local.selections, count.index), "resources")
|----------------
| count.index is 0
| local.selections is tuple with 1 element

Invalid value for "inputMap" parameter: the given object has no attribute
"resources".

Thanks Luis for this great module!

Include CreateBackupVault policies to IAM role

As explained here #6 (comment) some permissions are neeeded to crate backup vaults

Are the known issues still relevant?

The module requires at least AWS provider version 2.58.0.

terraform-aws-backup/versions.tf

Line 5 in c690c3b

aws = ">= 2.58.0"

This known issue was fixed in version 2.54.0. Looks like it shouldn't affect this module any more.

hashicorp/terraform-provider-aws#10511

This known issue was fixed in version 3.20.0.

hashicorp/terraform-provider-aws#10414

If it still affects this module, it looks like it can be avoided by upgrading the minimum provider version.

Add policy to AWSBackupDefaultServiceRole

When trying to restore AWS backup to EC2 instance I get the following error:

You are not authorized to perform this operation. Please consult the permissions associated with your AWS Backup role

After some investigation I've found article in knowledge center
https://aws.amazon.com/ru/premiumsupport/knowledge-center/aws-backup-encoded-authorization-failure/

It states that in order to restore backup you need to assign policy to AWSBackupDefaultServiceRole service linked role.

Policy is simple as:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::111122223333:role/*",
            "Effect": "Allow"
        }
    ]
}

My proposal is to add this policy and assign it to role above within this module.

Creating SNS resource simultaneously results in error " Error: creating Backup Vault Notifications (): AccessDeniedException: "

Add a sns.tf with the following content:

resource "aws_sns_topic" "sample_topic" {
  name = "sample name"
  kms_master_key_id = "alias/aws/sns"

  tags = merge(
    var.tags,
    {
      Name = "sample tag name"
    }
  )
}

resource "aws_sns_topic_subscription" "sample_subscription" {
  topic_arn = aws_sns_topic.sample_topic.arn
  protocol  = "email"
  endpoint  = "[email protected]"
}

And configure main.tf notificacions as:

  notifications = {
    sns_topic_arn       = aws_sns_topic.sample_topic.arn
    backup_vault_events = ["BACKUP_JOB_STARTED", "BACKUP_JOB_COMPLETED", "BACKUP_JOB_FAILED", "RESTORE_JOB_COMPLETED", "COPY_JOB_STARTED", "COPY_JOB_SUCCESSFUL", "COPY_JOB_FAILED"]
  }

Results in:

│ Error: creating Backup Vault Notifications (): AccessDeniedException:
│ status code: 403, request id: 6bcd24a3-edce-4d16-8695-3fea790fabf8
│
│ with module.sample_backup.aws_backup_vault_notifications.backup_events[0],
│ on .terraform/modules/sample_backup/notifications.tf line 25, in resource "aws_backup_vault_notifications" "backup_events":
│ 25: resource "aws_backup_vault_notifications" "backup_events" {
│

Adding a depends_on in the notificacions.tf file allows to create SNS topic/subscriptions alongside the afformented backup:

depends_on =[aws_backup_vault.ab_vault]`

Add new resource aws_backup_vault_lock_configuration

Perform the following steps to help protect your backups from inadvertent or malicious actions by storing backups using a Write-Once-Read-Many (WORM) model.

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_vault_lock_configuration

var.tags not passed to policy resource

Please pass var.tags to resource aws_iam_policy.ab_tag_policy for the tags field - similar to how its passed to other resources that support the tags field.

rules.completion_window setting is ignored

When setting the completion_window like this:

module "aws_backup" {
...
  # Multiple rules using a list of maps
  rules = [
    {
      name              = "daily-bkp-rule"
      target_vault_name = null
      schedule          = var.aws_backup_schedule
      start_window      = 120
      completion_window = 360
...
}

The completion_window setting is ignored. It seems to always default to 180 instead of whatever is set above.

Add force-delete flag to backup vault

Please add a force-delete flag to "aws_backup_vault" (available since v4.26)

(Opened PR)

Integration with new AWS PITR.

Hi all,

Just wanna check if the new https://aws.amazon.com/blogs/storage/point-in-time-recovery-and-continuous-backup-for-amazon-rds-with-aws-backup/ is compatible with this backup plan module? If so, how could I add it?

Thanks!

Provider Version requirement

Hi,

I would like to ask if there's a way to release the provider version requirement from

      source  = "hashicorp/aws"
      version = "~> 3.0"

to

    source  = "hashicorp/aws"
     version = "~> 4.0"

It will have dependency conflicts with other module I am using because of different provider version requirement cannot be matched for the same time.

Add an example for notifications only on failed jobs

With reference the premium support article that explains how to do it in the AWS console.

How can I get notifications for AWS Backup jobs that failed?

I don't have time to provide a complete example yet, but I did it something like this:

module "backup" {
  source = "lgallard/backup/aws"

  [...]

  # Only notify on failed jobs.
  # https://aws.amazon.com/es/premiumsupport/knowledge-center/aws-backup-failed-job-notification/
  notifications = {
    sns_topic_arn = aws_sns_topic.backup_vault_notifications.arn,
    backup_vault_events = ["BACKUP_JOB_COMPLETED"]
  }
}

resource "aws_sns_topic" "backup_vault_notifications" {
  name = "backup_notifications"
}

resource "aws_sns_topic_subscription" "devops_subscription" {
  endpoint = var.backup_notification_address
  protocol = "email-json"
  topic_arn = aws_sns_topic.backup_vault_notifications.arn
  filter_policy = jsonencode(
    {
      "State" = [
        {
          "anything-but" = "COMPLETED"
        }
      ]
    }
  )
}

Unsupported argument (not_resources) with aws 3.69.0 provider

Hi,

I am using this module in my terraforming code but after looking at the module documentation, the module code and the official terraforming documentation of the AWS resource it generates, I see some inconsistencies.

In the module documentation it says versions greater than or equal to 3.20.0 provider (aws (hashicorp/aws) >= 3.20.0), I am using 3.69.0 and in the official terraforming documentation of the version I am using, it does not contemplate the not_resources argument (https://registry.terraform.io/providers/hashicorp/aws/3.69.0/docs/resources/backup_selection) so it generates an error, I had to use the 0.12.1 version of the module to avoid this error.

This occurs with module versions higher than 0.12.1..

Regards!

Related to #50

Terraform re-creates backup selection everytime.

Module version 12.0.0

Terraform apply re-creates the ab_section everytime you run apply.

  # module.aws_backup_vault.aws_backup_selection.ab_selection[0] has been changed
! resource "aws_backup_selection" "ab_selection" {
        id            = "264bce4b-xxxxx-xxxxxxx-xxxxx"
        name          = "default"
+       not_resources = []
        # (3 unchanged attributes hidden)

+       condition {
        }
    }
    
   <skipped> 

  # module.aws_backup_vault.aws_backup_selection.ab_selection[0] must be replaced
-/+ resource "aws_backup_selection" "ab_selection" {
!       id            = "264bce4b-xxxxx-xxxxxxx-xxxxx" -> (known after apply)
        name          = "default"
-       not_resources = [] -> null
        # (3 unchanged attributes hidden)

-       condition { # forces replacement
        }
    }

Plan: 1 to add, 4 to change, 5 to destroy.
   

TF module configuration

module "aws_backup_vault" {

  source  = "lgallard/backup/aws"
  version = "0.12.0"

I guess it's because terraform aws_backup_selection backup requires variable not_resources = [] and conditions. At this moment I can provide only the terraform plan but let me know if you need more information.

Support for multiple copy_actions for a single rule

AWS supports multiple copy_actions for a single rule.
example :

But in terraform-aws-backup module, the copy_action is expected as an object. so we can't provide multiple copy_actions to single rule. if we provide multiple copy_actions, it takes the first one

How to add my kms key to the vault?

Hi, As I understood, the module will use kms key that managed by AWS. I would like to use my kms key for Vaulth backup, how can I add to my kms key?

Include dynamic not_resources and conditions for selections

As new not_resources and condition attributes were included in AWS provider version 3.72.0, selections should support these new attributes in a dynamic way,

This issue is related to #48 and #49

Invalid lifecycle. DeleteAfterDays cannot be less than 1 or more than 36500 days

Hi,

I have used module and try to test with below rule. The expectation is delete after 12 weeks = 84 days. However, it is not allowed to create rule even it is in valid range [1, 36500] days

module "aws_backup_example" {

  source = "lgallard/backup/aws"

  # Vault
  vault_name = "vault-3"

  # Plan
  plan_name = "complete-plan"

  # Multiple rules using a list of maps
  rules = [
    {
      name                     = "weekly"
      schedule                 = "cron(0 22 ? * 7 *)"
      target_vault_name        = null
      start_window             = 120
      completion_window        = 360
      enable_continuous_backup = true
      lifecycle = {
        cold_storage_after = 0
        delete_after       = 84
      }
    }
  ]

  # Multiple selections
  #  - Selection-1: By resources and tag
  #  - Selection-2: Only by resources
  #  - Selection-3: By resources and conditions
  selections = [
    {
      name          = "selection-3"
      resources     = ["*"]
      not_resources = []
      conditions = {
        string_equals = [
          {
            key   = "aws:ResourceTag/Component"
            value = "rds"
          }
        ,
          {
            key   = "aws:ResourceTag/Project"
            value = "Project1"
          }
        ]
        string_like = [
          {
            key   = "aws:ResourceTag/Application"
            value = "app*"
          }
        ]
        string_not_equals = [
          {
            key   = "aws:ResourceTag/Backup"
            value = "false"
          }
        ]
        string_not_like = [
          {
            key   = "aws:ResourceTag/Environment"
            value = "test*"
          }
        ]
      }
    }
  ]

  tags = {
    Owner       = "backup team"
    Environment = "production"
    Terraform   = true
  }
}

However there is issue

Error: error updating Backup Plan (5c560302-ed39-45a4-9e26-b35f8bcb1180): InvalidParameterValueException: Error in rule weekly : Invalid lifecycle. DeleteAfterDays cannot be less than 1 or more than 36500 days.
{
  RespMetadata: {
    StatusCode: 400,
    RequestID: "388631ef-c2ff-4f99-ae7c-1b89dbe7cf1a"
  },
  Code_: "ERROR_3015",
  Context: "[\"weekly\",\"Invalid lifecycle. DeleteAfterDays cannot be less than 1 or more than 36500 days.\"]",
  Message_: "Error in rule weekly : Invalid lifecycle. DeleteAfterDays cannot be less than 1 or more than 36500 days."
}

UPDATE: I also download module to local and tried to add direct value then the issue still happen. So I think this may not from module. It could be from terraform aws provider. However any clue in determining the cause of this issue would be very much appreciated.

resource "aws_backup_plan" "ab_plan" {
...
dynamic "lifecycle" {
        for_each = length(lookup(rule.value, "lifecycle", {})) == 0 ? [] : [lookup(rule.value, "lifecycle", {})]
        content {
          # Transition to cold storage
          cold_storage_after = lookup(lifecycle.value, "cold_storage_after", 0)

          # Retention period
          delete_after       = 84
        }
      }
...
}

Thank you!

README.md file typo

In the README.md file, in the # - Selection-1: By resources and tag, it is missing an "s" when calling "selection_tag". The correct should be "selection_tags". This is causing the following tf error:

Error: error creating Backup Selection: MissingParameterValueException: Either Resources or Conditions must not be null
{
RespMetadata: {
StatusCode: 400,
RequestID: "dd3ce5c0-514d-46ee-aa69-efd30bfddf5a"
},
Code_: "ERROR_4301",
Message_: "Either Resources or Conditions must not be null"
}

Cant create multiple selection tags on one selection

Hi,

First of all, thank you for your time and your module :)

I have a question, is possible to create a plan with multiple tags in one selection with your module ?

I am trying with multiple tests, but i cant. I see main.tf and i think you only catch one selection_tag.

Only for clarification, is not the same have one selection with multiple tags than multiple selection with one tag in every selection.

Thank you very much in advance!

Error creating Backup Vault

Hey man, im trying to use your repo, but im always getting an error to create a backup vault, error creating Backup Vault (): AccessDeniedException: status code: 403, request id: 8e7e577e-5b74-4d4d-95d0-bf63e0b2cc2e, do you know why. I only changed the main.tf file from the simple_plan_using_list example with my data. Do you know is that happening?

Thanks.