
service: 'tcf-test-bkp'

provider:
  name: aws
  runtime: python3.7
  profile: 'tcf-test'
  stackName: 'tcf-test-bkp'
  region: 'af-south-1'
  stage: ${self:provider.profile}
  deploymentBucket:
    name: ${self:custom.ServerlessBucketName}
    serverSideEncryption: AES256
    blockPublicAccess: true

plugins:
  - serverless-deployment-bucket
  - serverless-parameters

custom:
  CustomerName: tcf
  StageName: test
  # Combination of profile and function name used as bucket name:
  ResourceName: serverless-framework # Only lowercase letters and numbers allowed. Used to populate bucket name.
  ServerlessBucketName: '${self:custom.ResourceName}-${self:provider.stage}-${self:provider.region}'

  # CloudFormation parameters templates
  parameters:
    paramCustomerName:
      Description: Enter the Customer Name, used to tag everything
      Type: String
      Default: '${self:custom.CustomerName}'

    ## AWS Backup

    BackupVaultName:
      Type: String
      Default: '${self:custom.CustomerName}-${self:custom.StageName}-BackupVault'
      ConstraintDescription: Backup vault name is case sensitive. Must contain from 2 to 50 alphanumeric or '-_' characters.

    BackupPlanName:
      Type: String
      Description: AWS Backup name for BackupPlan
      Default: '${self:custom.CustomerName}-${self:custom.StageName}-BackupPlan'

    RuleName:
      Type: String
      Description: AWS Backup rule 1
      Default: Rule1OnceDaily

    DeleteAfterDays:
      Type: Number
      Description: Number of days before the backup will be deleted
      Default: 365

resources:

  # CloudFormation resource templates

  #Conditions:

  Resources:

  ## AWS Backup

    # Create role for backup

    BackupRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - backup.amazonaws.com
              Action:
                - sts:AssumeRole
        ManagedPolicyArns:
          - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
        Tags:
          - Key: Name
            Value: !Join
              - '-'
              - - '${self:custom.CustomerName}'
                - '${self:custom.StageName}'
                - 'iam'
                - 'role'
                - 'Backup'

    # Create a BackupVault

    BackupVault:
      Type: AWS::Backup::BackupVault
      Properties:
        BackupVaultName: !Ref BackupVaultName

    BackupPlan:
      DependsOn: BackupVault
      Type: 'AWS::Backup::BackupPlan'
      Properties:
        BackupPlan:
          BackupPlanName: !Ref BackupPlanName
          BackupPlanRule:
            - RuleName: !Ref RuleName
              TargetBackupVault: !Ref BackupVault
              ScheduleExpression: "cron(0 14 * * ? *)"
              StartWindowMinutes: 60
              CompletionWindowMinutes: 120
              Lifecycle:
                DeleteAfterDays: !Ref DeleteAfterDays

    BackupSelection:
      Type: 'AWS::Backup::BackupSelection'
      Properties:
        BackupPlanId: !Ref 'BackupPlan'
        BackupSelection:
          SelectionName: daily-backup-tag
          IamRoleArn: !GetAtt BackupRole.Arn
          ListOfTags:
            - ConditionType: STRINGEQUALS
              ConditionKey: backup
              ConditionValue: daily


  ## Outputs

#-----------------------------------------------------------------------#
