ENG-1368 add lambda_insights option

modules/aws-backup-source/README.md

@@ -84,6 +84,7 @@ No modules.
 | <a name="input_parameter_store_backup_config"></a> [parameter_store_backup_config](#input_parameter_store_backup_config) | Configuration for the scheduled Lambda function to backup tagged Parameter Store parameters to S3. | <pre>object({ enable = bool selection_tag = string selection_tag_value = optional(string) selection_tags = optional(list(object({ key = optional(string) value = optional(string) }))) lambda_backup_cron = optional(string) lambda_timeout_seconds = optional(number) air_gapped_kms_key_arn = optional(string) s3_bucket_name = optional(string) rules = optional(list(object({ name = string schedule = string completion_window = optional(number) enable_continuous_backup = optional(bool) lifecycle = object({ delete_after = number cold_storage_after = optional(number) }) copy_action = optional(object({ delete_after = optional(number) })) }))) })</pre> | <pre>{ "air_gapped_kms_key_arn": "", "enable": true, "lambda_backup_cron": "cron(0 6 * * ? *)", "lambda_timeout_seconds": 300, "rules": [ { "copy_action": { "delete_after": 365 }, "lifecycle": { "delete_after": 35 }, "name": "daily_kept_5_weeks", "schedule": "cron(0 0 * * ? *)" }, { "copy_action": { "delete_after": 365 }, "lifecycle": { "delete_after": 90 }, "name": "weekly_kept_3_months", "schedule": "cron(0 1 ? * SUN *)" }, { "copy_action": { "delete_after": 365 }, "lifecycle": { "cold_storage_after": 30, "delete_after": 2555 }, "name": "monthly_kept_7_years", "schedule": "cron(0 2 1 * ? *)" }, { "copy_action": { "delete_after": 365 }, "enable_continuous_backup": true, "lifecycle": { "delete_after": 35 }, "name": "point_in_time_recovery", "schedule": "cron(0 5 * * ? *)" } ], "s3_bucket_name": "", "selection_tag": "BackupParameterStore", "selection_tag_value": "True", "selection_tags": [] }</pre> | no |
 | <a name="input_bootstrap_kms_key_arn"></a> [bootstrap\_kms\_key\_arn](#input\_bootstrap\_kms\_key\_arn) | The ARN of the bootstrap KMS key used for encryption at rest of the SNS topic. | `string` | n/a | yes |
 | <a name="input_environment_name"></a> [environment\_name](#input\_environment\_name) | The name of the environment where AWS Backup is configured. | `string` | n/a | yes |
+| <a name="input_lambda_insights_enable"></a> [lambda\_insights\_enable](#input\_lambda\_insights\_enable) | Enable the Lambda functions to generate lambda-insights. | `bool` | `false` | no |
 | <a name="input_name_prefix"></a> [name\_prefix](#input\_name\_prefix) | Optional name prefix for vault resources | `string` | `null` | no |
 | <a name="input_notifications_target_email_address"></a> [notifications\_target\_email\_address](#input\_notifications\_target\_email\_address) | The email address to which backup notifications will be sent via SNS. | `string` | `""` | no |
 | <a name="input_project_name"></a> [project\_name](#input\_project\_name) | The name of the project this relates to. | `string` | n/a | yes |

modules/aws-backup-source/lambda_copy_recovery_point.tf

@@ -59,6 +59,12 @@ resource "aws_iam_role_policy_attachment" "lambda_copy_recovery_point_policy_att
   policy_arn = aws_iam_policy.iam_policy_for_lambda_copy_recovery_point[0].arn
 }
 
+resource "aws_iam_role_policy_attachment" "lambda_copy_recovery_point_cloudwatch_insights" {
+  count      = var.lambda_copy_recovery_point_enable && var.lambda_insights_enable ? 1 : 0
+  policy_arn = "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy"
+  role       = aws_iam_role.iam_for_lambda_copy_recovery_point[0].name
+}
+
 resource "aws_lambda_function" "lambda_copy_recovery_point" {
   count            = var.lambda_copy_recovery_point_enable ? 1 : 0
   function_name    = "${local.resource_name_prefix}_lambda-copy-recovery-point"
@@ -69,6 +75,8 @@ resource "aws_lambda_function" "lambda_copy_recovery_point" {
   source_code_hash = data.archive_file.lambda_copy_recovery_point_zip[0].output_base64sha256
   timeout          = var.lambda_copy_recovery_point_max_wait_minutes * 60
 
+  layers = var.lambda_insights_enable ? [local.lambda_insights_layer_arn] : []
+
   environment {
     variables = {
       POLL_INTERVAL_SECONDS = var.lambda_copy_recovery_point_poll_interval_seconds

modules/aws-backup-source/lambda_parameter_store_backup.tf

@@ -126,6 +126,9 @@ resource "aws_lambda_function" "lambda_parameter_store_backup" {
   handler          = "parameter_store_backup.lambda_handler"
   runtime          = "python3.12"
   timeout          = var.backup_plan_config_parameter_store.lambda_timeout_seconds
+
+  layers = var.lambda_insights_enable ? [local.lambda_insights_layer_arn] : []
+
   environment {
     variables = {
       KMS_KEY_ARN                 = var.destination_parameter_store_kms_key_arn

modules/aws-backup-source/lambda_post_build_version.tf

@@ -53,6 +53,12 @@ resource "aws_iam_role_policy" "lambda_post_build_version_iam_permissions" {
   policy = data.aws_iam_policy_document.lambda_post_build_version_permissions.json
 }
 
+resource "aws_iam_role_policy_attachment" "lambda_post_build_version_cloudwatch_insights" {
+  count      = var.lambda_insights_enable ? 1 : 0
+  policy_arn = "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy"
+  role       = aws_iam_role.iam_for_lambda_post_build_version.name
+}
+
 data "archive_file" "lambda_post_build_version_zip" {
   type        = "zip"
   source_dir  = "${path.module}/resources/post_build_version/"
@@ -66,6 +72,9 @@ resource "aws_lambda_function" "lambda_post_build_version" {
   role             = aws_iam_role.iam_for_lambda_post_build_version.arn
   handler          = "post_build_version.lambda_handler"
   runtime          = "python3.12"
+
+  layers = var.lambda_insights_enable ? [local.lambda_insights_layer_arn] : []
+
   environment {
     variables = {
       AWS_ACCOUNT_ID      = data.aws_caller_identity.current.account_id

modules/aws-backup-source/lambda_restore_to_s3.tf

@@ -67,6 +67,12 @@ resource "aws_iam_role_policy_attachment" "lambda_restore_to_s3_policy_attach" {
   policy_arn = aws_iam_policy.iam_policy_for_lambda_restore_to_s3[0].arn
 }
 
+resource "aws_iam_role_policy_attachment" "lambda_restore_to_s3_cloudwatch_insights" {
+  count      = var.lambda_restore_to_s3_enable && var.lambda_insights_enable ? 1 : 0
+  policy_arn = "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy"
+  role       = aws_iam_role.iam_for_lambda_restore_to_s3[0].name
+}
+
 
 resource "aws_lambda_function" "lambda_restore_to_s3" {
   count         = var.lambda_restore_to_s3_enable ? 1 : 0
@@ -79,6 +85,8 @@ resource "aws_lambda_function" "lambda_restore_to_s3" {
   source_code_hash = data.archive_file.lambda_restore_to_s3_zip[0].output_base64sha256
   timeout          = var.lambda_restore_to_s3_max_wait_minutes * 60
 
+  layers = var.lambda_insights_enable ? [local.lambda_insights_layer_arn] : []
+
   environment {
     variables = {
       POLL_INTERVAL_SECONDS = var.lambda_restore_to_s3_poll_interval_seconds

modules/aws-backup-source/locals.tf

@@ -21,4 +21,6 @@ locals {
   ))
   aurora_overrides    = var.backup_plan_config_aurora.restore_testing_overrides == null ? null : jsondecode(var.backup_plan_config_aurora.restore_testing_overrides)
   terraform_role_arns = length(var.terraform_role_arns) > 0 ? var.terraform_role_arns : [var.terraform_role_arn]
+
+  lambda_insights_layer_arn = "arn:aws:lambda:eu-west-2:580247275435:layer:LambdaInsightsExtension:66"
 }

modules/aws-backup-source/variables.tf

@@ -538,3 +538,9 @@ variable "lambda_restore_to_s3_max_wait_minutes" {
   type        = number
   default     = 5
 }
+
+variable "lambda_insights_enable" {
+  description = "Enable the Lambda functions to generate insights from backup data."
+  type        = bool
+  default     = false
+}