efs-backup.yaml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: 'AWS in Action: chapter 9'
Mappings:
  RegionMap:
    'eu-north-1':
      AMI: 'ami-05bc2576a72f22c39'
    'ap-south-1':
      AMI: 'ami-0002bdad91f793433'
    'eu-west-3':
      AMI: 'ami-0c73cd1c5347436f3'
    'eu-west-2':
      AMI: 'ami-029ed17b4ea379178'
    'eu-west-1':
      AMI: 'ami-04632f3cef5083854'
    'ap-northeast-3':
      AMI: 'ami-0ae88850834d2c589'
    'ap-northeast-2':
      AMI: 'ami-0263588f2531a56bd'
    'ap-northeast-1':
      AMI: 'ami-0abaa5b0faf689830'
    'sa-east-1':
      AMI: 'ami-053a035b046dbb704'
    'ca-central-1':
      AMI: 'ami-0173297cea9ba27b0'
    'ap-southeast-1':
      AMI: 'ami-0d1d4b8d5a0cd293f'
    'ap-southeast-2':
      AMI: 'ami-0f4484f62c4fd8767'
    'eu-central-1':
      AMI: 'ami-099ccc441b2ef41ec'
    'us-east-1':
      AMI: 'ami-061ac2e015473fbe2'
    'us-east-2':
      AMI: 'ami-056b1936002ca8ede'
    'us-west-1':
      AMI: 'ami-028f2b5ee08012131'
    'us-west-2':
      AMI: 'ami-0e21d4d9303512b8e'
Resources:
  ##########################################################################
  #                                                                        #
  #                       VPC with two public subnets                      #
  #                                                                        #
  ##########################################################################
  VPC:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: '172.31.0.0/16'
      EnableDnsHostnames: true
  InternetGateway:
    Type: 'AWS::EC2::InternetGateway'
    Properties: {}
  VPCGatewayAttachment:
    Type: 'AWS::EC2::VPCGatewayAttachment'
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
  SubnetA:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Select [0, !GetAZs '']
      CidrBlock: '172.31.38.0/24'
      VpcId: !Ref VPC
  SubnetB:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Select [1, !GetAZs '']
      CidrBlock: '172.31.37.0/24'
      VpcId: !Ref VPC
  RouteTable:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
  SubnetRouteTableAssociationA:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref SubnetA
      RouteTableId: !Ref RouteTable
  SubnetRouteTableAssociationB:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref SubnetB
      RouteTableId: !Ref RouteTable
  RouteToInternet:
    Type: 'AWS::EC2::Route'
    Properties:
      RouteTableId: !Ref RouteTable
      DestinationCidrBlock: '0.0.0.0/0'
      GatewayId: !Ref InternetGateway
    DependsOn: VPCGatewayAttachment
  NetworkAcl:
    Type: AWS::EC2::NetworkAcl
    Properties:
      VpcId: !Ref VPC
  SubnetNetworkAclAssociationA:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref SubnetA
      NetworkAclId: !Ref NetworkAcl
  SubnetNetworkAclAssociationB:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref SubnetB
      NetworkAclId: !Ref NetworkAcl
  NetworkAclEntryIngress:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref NetworkAcl
      RuleNumber: 100
      Protocol: -1
      RuleAction: allow
      Egress: false
      CidrBlock: '0.0.0.0/0'
  NetworkAclEntryEgress:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref NetworkAcl
      RuleNumber: 100
      Protocol: -1
      RuleAction: allow
      Egress: true
      CidrBlock: 0.0.0.0/0
  ##########################################################################
  #                                                                        #
  #                          EFS related resources                         #
  #                                                                        #
  ##########################################################################
  FileSystem:
    Type: 'AWS::EFS::FileSystem'
    Properties:
      Encrypted: true
      ThroughputMode: bursting
      PerformanceMode: generalPurpose
      FileSystemPolicy:
        Version: '2012-10-17'
        Statement:
        - Effect: 'Deny'
          Action: '*'
          Principal:
            AWS: '*'
          Condition:
            Bool:
              'aws:SecureTransport': 'false'
  EFSClientSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: 'EFS Mount target client'
      VpcId: !Ref VPC
  MountTargetSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: 'EFS Mount target'
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 2049
        ToPort: 2049
        SourceSecurityGroupId: !Ref EFSClientSecurityGroup
      VpcId: !Ref VPC
  MountTargetA:
    Type: 'AWS::EFS::MountTarget'
    Properties:
      FileSystemId: !Ref FileSystem
      SecurityGroups:
      - !Ref MountTargetSecurityGroup
      SubnetId: !Ref SubnetA
  MountTargetB:
    Type: 'AWS::EFS::MountTarget'
    Properties:
      FileSystemId: !Ref FileSystem
      SecurityGroups:
      - !Ref MountTargetSecurityGroup
      SubnetId: !Ref SubnetB
  ##########################################################################
  #                                                                        #
  #                        EC2 instances for testing                       #
  #                                                                        #
  ##########################################################################
  IamRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - 'ec2.amazonaws.com'
          Action: 'sts:AssumeRole'
      Policies:
      - PolicyName: efs
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'elasticfilesystem:ClientRootAccess'
            - 'elasticfilesystem:ClientWrite'
            - 'elasticfilesystem:ClientMount'
            - 'elasticfilesystem:DescribeMountTargets'
            Resource: !GetAtt 'FileSystem.Arn'
          - Effect: Allow
            Action:
            - 'ec2:DescribeAvailabilityZones'
            Resource: '*'
      - PolicyName: ssm
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'ssmmessages:*' # SSM Agent by https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html
            - 'ssm:UpdateInstanceInformation' # SSM agent by https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html
            - 'ec2messages:*' # SSM Session Manager by https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html
            Resource: '*'
  IamInstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Roles:
      - !Ref IamRole
  EC2InstanceA:
    Type: 'AWS::EC2::Instance'
    Properties:
      ImageId: !FindInMap [RegionMap, !Ref 'AWS::Region', AMI]
      InstanceType: 't3.micro'
      IamInstanceProfile: !Ref IamInstanceProfile
      NetworkInterfaces:
      - AssociatePublicIpAddress: true
        DeleteOnTermination: true
        DeviceIndex: 0
        GroupSet:
        - !Ref EFSClientSecurityGroup
        SubnetId: !Ref SubnetA
      UserData:
        'Fn::Base64': !Sub |
          #!/bin/bash -ex
          trap '/opt/aws/bin/cfn-signal -e 1 --stack ${AWS::StackName} --resource EC2InstanceA --region ${AWS::Region}' ERR

          # install dependencies
          yum install -y amazon-efs-utils
          pip3 install botocore

          # copy existing /home to /oldhome
          mkdir /oldhome
          cp -a /home/. /oldhome

          # wait for EFS mount target
          while ! (echo > /dev/tcp/${FileSystem}.efs.${AWS::Region}.amazonaws.com/2049) >/dev/null 2>&1; do sleep 5; done

          # mount EFS file system
          echo "${FileSystem}:/ /home efs _netdev,noresvport,tls,iam 0 0" >> /etc/fstab
          mount -a

          # copy /oldhome to new /home
          cp -a /oldhome/. /home

          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource EC2InstanceA --region ${AWS::Region}
      Tags:
      - Key: Name
        Value: 'efs-a'
    CreationPolicy:
      ResourceSignal:
        Timeout: PT10M
    DependsOn:
    - VPCGatewayAttachment
    - MountTargetA
  EC2InstanceB:
    Type: 'AWS::EC2::Instance'
    Properties:
      ImageId: !FindInMap [RegionMap, !Ref 'AWS::Region', AMI]
      InstanceType: 't3.micro'
      IamInstanceProfile: !Ref IamInstanceProfile
      NetworkInterfaces:
      - AssociatePublicIpAddress: true
        DeleteOnTermination: true
        DeviceIndex: 0
        GroupSet:
        - !Ref EFSClientSecurityGroup
        SubnetId: !Ref SubnetB
      UserData:
        'Fn::Base64': !Sub |
          #!/bin/bash -ex
          trap '/opt/aws/bin/cfn-signal -e 1 --stack ${AWS::StackName} --resource EC2InstanceB --region ${AWS::Region}' ERR

          # install dependencies
          yum install -y amazon-efs-utils
          pip3 install botocore

          # wait for EFS mount target
          while ! (echo > /dev/tcp/${FileSystem}.efs.${AWS::Region}.amazonaws.com/2049) >/dev/null 2>&1; do sleep 5; done

          # mount EFS file system
          echo "${FileSystem}:/ /home efs _netdev,noresvport,tls,iam 0 0" >> /etc/fstab
          mount -a

          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource EC2InstanceB --region ${AWS::Region}
      Tags:
      - Key: Name
        Value: 'efs-b'
    CreationPolicy:
      ResourceSignal:
        Timeout: PT10M
    DependsOn:
    - VPCGatewayAttachment
    - MountTargetB
  ##########################################################################
  #                                                                        #
  #                       Backup related resources                         #
  #                                                                        #
  ##########################################################################
  BackupRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'backup.amazonaws.com'
          Action: 'sts:AssumeRole'
      Policies:
      - PolicyName: backup
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'elasticfilesystem:Backup'
            - 'elasticfilesystem:DescribeTags'
            Resource: !Sub 'arn:${AWS::Partition}:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:file-system/${FileSystem}'
  BackupVault:
    Type: 'AWS::Backup::BackupVault'
    Properties:
      BackupVaultName: !Ref 'AWS::StackName'
  BackupPlan:
    Type: 'AWS::Backup::BackupPlan'
    Properties:
      BackupPlan:
        BackupPlanName: 'efs-daily'
        BackupPlanRule:
        - RuleName: 'efs-daily'
          TargetBackupVault: !Ref BackupVault
          Lifecycle:
            DeleteAfterDays: 30
          ScheduleExpression: 'cron(0 5 ? * * *)'
          CompletionWindowMinutes: 1440
  BackupSelection:
    Type: 'AWS::Backup::BackupSelection'
    Properties:
      BackupPlanId: !Ref BackupPlan
      BackupSelection:
        SelectionName: 'efs'
        IamRoleArn: !GetAtt 'BackupRole.Arn'
        Resources:
        - !GetAtt  'FileSystem.Arn'
  ##########################################################################
  #                                                                        #
  #                         Monitoring EFS                                 #
  #                                                                        #
  ##########################################################################
  BurstCreditBalanceTooLowAlarm:
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'Average burst credit balance over last 10 minutes too low, expect a significant performance drop soon.'
      Namespace: 'AWS/EFS'
      MetricName: BurstCreditBalance
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: LessThanThreshold
      Threshold: 192000000000 # 192 GB in Bytes (last ~30 minutes where you can burst at 100 MB/sec)
      Dimensions:
      - Name: FileSystemId
        Value: !Ref FileSystem
  PercentIOLimitTooHighAlarm:
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'I/O limit has been reached, consider using Max I/O performance mode.'
      Namespace: 'AWS/EFS'
      MetricName: PercentIOLimit
      Statistic: Maximum
      Period: 600
      EvaluationPeriods: 3
      ComparisonOperator: GreaterThanThreshold
      Threshold: 95
      Dimensions:
      - Name: FileSystemId
        Value: !Ref FileSystem
  PermittedThroughputAlarm:
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'Reached 80% of the permitted throughput 6 times over last 10 minutes.'
      Metrics:
      - Id: m1
        Label: MeteredIOBytes
        MetricStat:
          Metric:
            Namespace: 'AWS/EFS'
            MetricName: MeteredIOBytes
            Dimensions:
            - Name: FileSystemId
              Value: !Ref FileSystem
          Period: 60
          Stat: Sum
          Unit: Bytes
        ReturnData: false
      - Id: m2
        Label: PermittedThroughput
        MetricStat:
          Metric:
            Namespace: 'AWS/EFS'
            MetricName: PermittedThroughput
            Dimensions:
            - Name: FileSystemId
              Value: !Ref FileSystem
          Period: 60
          Stat: Sum
          Unit: 'Bytes/Second'
        ReturnData: false
      - Expression: '(m1/1048576)/PERIOD(m1)'
        Id: e1
        Label: e1
        ReturnData: false
      - Expression: 'm2/1048576'
        Id: e2
        Label: e2
        ReturnData: false
      - Expression: '((e1)*100)/(e2)'
        Id: e3
        Label: 'Throughput utilization (%)'
        ReturnData: true
      EvaluationPeriods: 10
      DatapointsToAlarm: 6
      ComparisonOperator: GreaterThanThreshold
      Threshold: 80
Outputs:
  EC2InstanceA:
    Value: !Ref EC2InstanceA
    Description: 'Id of EC2 Instance in AZ A (connect via Session Manager)'
  EC2InstanceB:
    Value: !Ref EC2InstanceB
    Description: 'Id of EC2 Instance in AZ B (connect via Session Manager)'