Feat/data retention backup

backend/bin/compile_requirements.sh

@@ -6,6 +6,8 @@ pip-compile --no-emit-index-url --upgrade --no-strip-extras multi-account/log-ag
 pip-compile --no-emit-index-url --upgrade --no-strip-extras multi-account/log-aggregation/requirements.in
 pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/requirements-dev.in
 pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/requirements.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/cognito-backup/requirements-dev.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/cognito-backup/requirements.in
 pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/compact-configuration/requirements-dev.in
 pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/compact-configuration/requirements.in
 pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/common/requirements-dev.in

backend/bin/run_python_tests.py

@@ -23,17 +23,19 @@
 # Define the test directories to include
 TEST_DIRS = (
     'compact-connect/lambdas/python/common',
+    'compact-connect/lambdas/python/cognito-backup',
     'compact-connect/lambdas/python/compact-configuration',
-    'compact-connect/lambdas/python/provider-data-v1',
-    'compact-connect/lambdas/python/purchases',
-    'compact-connect/lambdas/python/staff-users',
-    'compact-connect/lambdas/python/staff-user-pre-token',
     'compact-connect/lambdas/python/custom-resources',
     'compact-connect/lambdas/python/data-events',
     'compact-connect/lambdas/python/migration',
+    'compact-connect/lambdas/python/provider-data-v1',
+    'compact-connect/lambdas/python/purchases',
+    'compact-connect/lambdas/python/staff-user-pre-token',
+    'compact-connect/lambdas/python/staff-users',
     'compact-connect',  # CDK tests
     'multi-account/control-tower',
     'multi-account/log-aggregation',
+    'multi-account/backups',  # Data retention backup infrastructure
 )
 
 

backend/bin/sync_deps.sh

@@ -10,6 +10,8 @@ pip-sync \
   multi-account/log-aggregation/requirements.txt \
   compact-connect/requirements-dev.txt \
   compact-connect/requirements.txt \
+  compact-connect/lambdas/python/cognito-backup/requirements-dev.txt \
+  compact-connect/lambdas/python/cognito-backup/requirements.txt \
   compact-connect/lambdas/python/compact-configuration/requirements-dev.txt \
   compact-connect/lambdas/python/compact-configuration/requirements.txt \
   compact-connect/lambdas/python/common/requirements-dev.txt \

backend/compact-connect/app.py

@@ -84,6 +84,7 @@ def _setup_sandbox_environment(self):
             app_name=app_name,
             environment_name=environment_name,
             environment_context=environment_context,
+            backup_config=ssm_context['backup_config'],
         )
         # NOTE: for first-time sandbox deployments, ensure you deploy the backend stage successfully first
         # by running `cdk deploy 'Sandbox/*'`, then if you have a domain name configured and want to deploy the UI for

backend/compact-connect/cdk.context.beta-example.json

@@ -26,8 +26,38 @@
               "workspace_id": "T01234567"
             }
           ]
+        },
+        "backup_policies": {
+          "general_data": {
+            "schedule": {
+              "week_day": "5",
+              "year": "*",
+              "month": "*",
+              "hour": "5",
+              "minute": "0"
+            },
+            "delete_after_days": 180,
+            "cold_storage_after_days": 30
+          },
+          "frequent_updates": {
+            "schedule": {
+              "week_day": "5",
+              "year": "*",
+              "month": "*",
+              "hour": "5",
+              "minute": "0"
+            },
+            "delete_after_days": 180,
+            "cold_storage_after_days": 30
+          }
         }
       }
+    },
+    "backup_config": {
+      "backup_account_id": "111122223333",
+      "backup_region": "us-west-2",
+      "general_vault_name": "CompactConnectBackupVault",
+      "ssn_vault_name": "CompactConnectBackupVault-SSN"
     }
   }
 }

backend/compact-connect/cdk.context.prod-example.json

@@ -26,8 +26,38 @@
               "workspace_id": "T01234567"
             }
           ]
+        },
+        "backup_policies": {
+          "general_data": {
+            "schedule": {
+              "year": "*",
+              "month": "*",
+              "day": "*",
+              "hour": "5",
+              "minute": "0"
+            },
+            "delete_after_days": 730,
+            "cold_storage_after_days": 30
+          },
+          "frequent_updates": {
+            "schedule": {
+              "year": "*",
+              "month": "*",
+              "day": "*",
+              "hour": "*",
+              "minute": "0"
+            },
+            "delete_after_days": 730,
+            "cold_storage_after_days": 30
+          }
         }
       }
+    },
+    "backup_config": {
+      "backup_account_id": "111122223333",
+      "backup_region": "us-west-2",
+      "general_vault_name": "CompactConnect-prod-BackupVault",
+      "ssn_vault_name": "CompactConnect-prod-SSNBackupVault"
     }
   }
 }

backend/compact-connect/cdk.context.sandbox-example.json

@@ -19,13 +19,43 @@
         "security_profile": "VULNERABLE",
         "recaptcha_public_key": "123-KFEUsjehfuejILDVUKkRnAF9SSzb8o9uv5lY7Ih",
         "robots_meta": "noindex,nofollow",
-        "notifications": {
+                "notifications": {
           "ses_operations_support_email": "[email protected]",
           "email": [
             "[email protected]"
           ]
+        },
+        "backup_policies": {
+          "general_data": {
+            "schedule": {
+              "week_day": "5",
+              "year": "*",
+              "month": "*",
+              "hour": "5",
+              "minute": "0"
+            },
+            "delete_after_days": 180,
+            "cold_storage_after_days": 30
+          },
+          "frequent_updates": {
+            "schedule": {
+              "week_day": "5",
+              "year": "*",
+              "month": "*",
+              "hour": "5",
+              "minute": "0"
+            },
+            "delete_after_days": 180,
+            "cold_storage_after_days": 30
+          }
         }
       }
+    },
+    "backup_config": {
+      "backup_account_id": "111122223333",
+      "backup_region": "us-west-2",
+      "general_vault_name": "CompactConnectBackupVault",
+      "ssn_vault_name": "CompactConnectBackupVault-SSN"
     }
   }
 }

backend/compact-connect/cdk.context.test-example.json

@@ -27,8 +27,38 @@
               "workspace_id": "T01234567"
             }
           ]
+        },
+        "backup_policies": {
+          "general_data": {
+            "schedule": {
+              "week_day": "5",
+              "year": "*",
+              "month": "*",
+              "hour": "5",
+              "minute": "0"
+            },
+            "delete_after_days": 180,
+            "cold_storage_after_days": 30
+          },
+          "frequent_updates": {
+            "schedule": {
+              "week_day": "5",
+              "year": "*",
+              "month": "*",
+              "hour": "5",
+              "minute": "0"
+            },
+            "delete_after_days": 180,
+            "cold_storage_after_days": 30
+          }
         }
       }
+    },
+    "backup_config": {
+      "backup_account_id": "111122223333",
+      "backup_region": "us-west-2",
+      "general_vault_name": "CompactConnectBackupVault",
+      "ssn_vault_name": "CompactConnectBackupVault-SSN"
     }
   }
 }

backend/compact-connect/common_constructs/backup_plan.py

@@ -0,0 +1,71 @@
+from aws_cdk import Duration
+from aws_cdk.aws_backup import (
+    BackupPlan,
+    BackupPlanCopyActionProps,
+    BackupPlanRule,
+    BackupResource,
+    BackupSelection,
+    BackupVault,
+    IBackupVault,
+)
+from aws_cdk.aws_events import Schedule
+from aws_cdk.aws_iam import IRole
+from constructs import Construct
+
+
+class CCBackupPlan(Construct):
+    """
+    Common construct for creating backup plans for CompactConnect resources with cross-account replication.
+
+    This consolidated backup plan construct can be used for any AWS resource type that supports
+    AWS Backup (DynamoDB tables, S3 buckets, etc.) by accepting a list of backup resources
+    and a name prefix.
+    """
+
+    def __init__(
+        self,
+        scope: Construct,
+        construct_id: str,
+        *,
+        backup_plan_name_prefix: str,
+        backup_resources: list[BackupResource],
+        backup_vault: BackupVault,
+        backup_service_role: IRole,
+        cross_account_backup_vault: IBackupVault,
+        backup_policy: dict,
+        **kwargs,
+    ):
+        super().__init__(scope, construct_id, **kwargs)
+
+        # Create backup plan
+        self.backup_plan = BackupPlan(
+            self,
+            'BackupPlan',
+            backup_plan_name=f'{backup_plan_name_prefix}-BackupPlan',
+            backup_plan_rules=[
+                BackupPlanRule(
+                    rule_name=f'{backup_plan_name_prefix}-Backup',
+                    backup_vault=backup_vault,
+                    schedule_expression=Schedule.cron(**backup_policy['schedule']),
+                    delete_after=Duration.days(backup_policy['delete_after_days']),
+                    move_to_cold_storage_after=Duration.days(backup_policy['cold_storage_after_days']),
+                    copy_actions=[
+                        BackupPlanCopyActionProps(
+                            destination_backup_vault=cross_account_backup_vault,
+                            delete_after=Duration.days(backup_policy['delete_after_days']),
+                            move_to_cold_storage_after=Duration.days(backup_policy['cold_storage_after_days']),
+                        )
+                    ],
+                )
+            ],
+        )
+
+        # Create backup selection to include the resources
+        self.backup_selection = BackupSelection(
+            self,
+            'BackupSelection',
+            backup_plan=self.backup_plan,
+            resources=backup_resources,
+            backup_selection_name=f'{backup_plan_name_prefix}-Selection',
+            role=backup_service_role,
+        )