### Copy Example Configuration

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/cross_region_backup/README.md

Copy the example terraform.tfvars.example file to terraform.tfvars to begin configuration.

```bash
cp terraform.tfvars.example terraform.tfvars
```

--------------------------------

### Terraform Example Initialization and Plan

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/CONTRIBUTING.md

Steps to initialize and plan a Terraform configuration within an example directory. This is used to test the functionality of the module with specific configurations.

```bash
cd examples/simple_plan
terraform init
terraform plan
```

--------------------------------

### Install and Run Pre-commit Hooks

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/CLAUDE.md

Install the pre-commit framework and run it manually to check all files for formatting, syntax, and documentation compliance.

```bash
# Install pre-commit
pip install pre-commit
pre-commit install

# Run manually
pre-commit run --all-files
```

--------------------------------

### Install and Configure Development Tools

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/CONTRIBUTING.md

Installs pre-commit, tflint with AWS ruleset, and checkov. Ensure Terraform is installed and meets version requirements.

```bash
# Install pre-commit
pip install pre-commit

# Install hooks
pre-commit install

# Install tflint
curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash

# Install tflint AWS ruleset
tflint --init

# Install checkov
pip install checkov
```

--------------------------------

### Deploy AWS Backup Restore Testing Example with Terraform

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/restore_testing_plan/README.md

Initialize, plan, and apply the Terraform configuration for the AWS Backup restore testing example. Ensure prerequisites like AWS CLI and Terraform are met.

```bash
cd examples/restore_testing_plan

terraform init

terraform plan

terraform apply
```

--------------------------------

### Example 1: Validating New Backup Plan Feature - Step 3

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/CLAUDE.md

This snippet shows the comprehensive validation step for a new backup plan feature, covering syntax, resource types, IAM permissions, security, examples, and documentation.

```bash
# Step 3: Comprehensive validation
Task Agent (general-purpose): "Validate continuous backup implementation:
1. Check aws_backup_plan syntax for enable_continuous_backup argument
2. Verify compatible resource types (EFS, RDS, etc.)
3. Validate IAM permissions for continuous backup
4. Review security implications
5. Check example configurations
6. Verify documentation accuracy"
```

--------------------------------

### Terraform Output Example

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/region_settings/README.md

Example output from 'terraform output' command, showing enabled services and service counts after deployment.

```bash
terraform output
```

```json
enabled_services = [
  "Aurora",
  "DynamoDB",
  "EBS",
  "EC2",
  "EFS",
  "RDS",
  "S3",
]

service_count = {
  "disabled" = 9
  "enabled" = 7
  "managed" = 2
  "total_configured" = 16
}
```

--------------------------------

### Initialize and Apply Terraform Configuration

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/backup_selection_data_source/README.md

Initialize and apply the Terraform configuration to create the backup vault, plan, and selections. This is the first step in setting up the example.

```bash
terraform init
terraform apply
```

--------------------------------

### Extending with Additional Plans

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/migration_guide/README.md

Example of how to add a new weekly backup plan alongside the default plan after migration.

```hcl
plans = {
  default = {
    # Your existing daily backup plan
    name = "daily-backup-plan"
    rules = [/* existing rules */]
    selections = {/* existing selections */}
  }

  # Add a new weekly backup plan
  weekly = {
    name = "weekly-backup-plan"
    rules = [
      {
        name     = "weekly-rule"
        schedule = "cron(0 0 ? * 1 *)"  # Every Sunday
        lifecycle = {
          delete_after = 90
        }
      }
    ]
    selections = {
      critical-systems = {
        resources = [
          "arn:aws:rds:us-east-1:123456789012:db:critical-db"
        ]
      }
    }
  }
}
```

--------------------------------

### Gradual Rollout: Phase 1

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/region_settings/README.md

Example HCL configuration for the first phase of a gradual rollout, enabling only critical databases like Aurora and RDS.

```hcl
# Phase 1: Critical databases only
resource_type_opt_in_preference = {
  "Aurora" = true
  "RDS"    = true
  # Other services = false
}
```

--------------------------------

### Install Security Scanning Tools

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/README.md

Install the necessary tools, checkov and tfsec, for automated security scanning of your Terraform configurations.

```bash
# Install tools
pip install checkov
curl -L https://github.com/aquasecurity/tfsec/releases/latest/download/tfsec-linux-amd64 -o tfsec
chmod +x tfsec && sudo mv tfsec /usr/local/bin/
```

--------------------------------

### Example 1: Validating New Backup Plan Feature - Step 1 & 2

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/CLAUDE.md

This snippet demonstrates the initial steps for validating a new backup plan feature, focusing on exploring existing patterns and reviewing the implementation strategy.

```bash
# Step 1: Explore existing patterns
Task Agent (Explore - medium): "Analyze all aws_backup_plan resources and their rule configurations across examples"
```

```bash
# Step 2: Validate implementation approach
Task Agent (Plan - thorough): "Review implementation strategy for adding continuous backup support to backup plans"
```

--------------------------------

### Get Terraform Version

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/TROUBLESHOOTING.md

Run this command to retrieve your installed Terraform version, which is often required when seeking help or reporting issues.

```bash
terraform version
```

--------------------------------

### Configure EFS Backup Rule for Many Small Files

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/PERFORMANCE.md

Allocate a longer start window for EFS backups with a high number of small files to accommodate the increased processing time. This rule starts backups at 8 PM and allows 48 hours for completion.

```hcl
rules = [
  {
    name              = "efs_many_files_backup"
    schedule          = "cron(0 20 * * ? *)"   # Start at 8 PM
    start_window      = 360                     # 6 hours to start
    completion_window = 2880                    # 48 hours to complete
    lifecycle = {
      delete_after = 90
    }
  }
]
```

--------------------------------

### Cross-Region Backup Timing and Windows

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/PERFORMANCE.md

Configure cross-region backup rules to start late and utilize extended start and completion windows to optimize timing and avoid peak hours.

```hcl
# Optimize cross-region backup timing
rules = [
  {
    name = "cross_region_backup"
    schedule = "cron(0 23 * * ? *)"  # Start late to avoid peak hours
    start_window = 120                # Extended start window
    completion_window = 720           # Extended completion window

    copy_actions = [
      {
        destination_vault_arn = "arn:aws:backup:us-west-2:123456789012:backup-vault:dr-vault"
        lifecycle = {
          delete_after = 30
        }
      }
    ]
  }
]
```

--------------------------------

### Set up Multi-Region Backup Strategy

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/BEST_PRACTICES.md

Configure primary and secondary AWS Backup modules for cross-region backup and disaster recovery, including vault and KMS key setup.

```hcl
# Primary region backup
module "backup_primary" {
  source = "lgallard/backup/aws"

  providers = {
    aws = aws.primary
  }

  vault_name = "primary-backup-vault"

  rules = [
    {
      name = "cross_region_backup"
      schedule = "cron(0 2 * * ? *)"

      # Copy to secondary region
      copy_actions = [
        {
          destination_vault_arn = "arn:aws:backup:us-west-2:${data.aws_caller_identity.current.account_id}:backup-vault:disaster-recovery-vault"
          lifecycle = {
            delete_after = 90
          }
        }
      ]

      lifecycle = {
        delete_after = 30
      }
    }
  ]
}

# Secondary region backup vault
module "backup_secondary" {
  source = "lgallard/backup/aws"

  providers = {
    aws = aws.secondary
  }

  vault_name = "disaster-recovery-vault"
  vault_kms_key_arn = aws_kms_key.backup_dr.arn
}
```

--------------------------------

### Start an AWS Backup Job

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/MIGRATION.md

Initiate a manual backup job using the AWS CLI. Ensure you provide the correct backup vault name, resource ARN, and IAM role ARN.

```bash
aws backup start-backup-job --backup-vault-name vault-name --resource-arn resource-arn --iam-role-arn role-arn
```

--------------------------------

### Cost Optimization: Enable Used Services

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/region_settings/README.md

Example HCL configuration for cost optimization, enabling only actively used services like DynamoDB and EBS, and disabling Neptune and FSx.

```hcl
resource_type_opt_in_preference = {
  "DynamoDB" = true  # In use
  "EBS"      = true  # In use
  "Neptune"  = false # Not deployed
  "FSx"      = false # Not deployed
}
```

--------------------------------

### Verify AWS Backup Restore Testing Setup with AWS CLI

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/restore_testing_plan/README.md

Use AWS CLI commands to list and describe restore testing plans and selections, and check recent backup jobs. Replace `<plan-name>` and `<instance-arn>` with actual values.

```bash
aws backup list-restore-testing-plans

aws backup describe-restore-testing-plan --restore-testing-plan-name <plan-name>

aws backup list-restore-testing-selections --restore-testing-plan-name <plan-name>

aws backup list-backup-jobs --by-resource-arn <instance-arn>
```

--------------------------------

### Save and Execute Helper Script for Selections

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/backup_selection_data_source/README.md

Save the helper script output to a file, make it executable, and then run it to retrieve backup selection information. This provides a reusable way to get selection details.

```bash
terraform output -raw helper_script > get_selections.sh
chmod +x get_selections.sh
./get_selections.sh
```

--------------------------------

### Large, Infrequent Backups Configuration

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/PERFORMANCE.md

Sets up infrequent, large backups with extended windows (240-minute start, 1440-minute completion), moving to cold storage after 30 days and retaining for 365 days.

```hcl
large_infrequent = {
  schedule          = "cron(0 2 ? * SUN *)"
  start_window      = 240
  completion_window = 1440
  lifecycle = {
    cold_storage_after = 30
    delete_after       = 365
  }
}
```

--------------------------------

### Configure EU West 1 Region Settings

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/region_settings/README.md

This example demonstrates how to configure region-specific settings for AWS Backup in the eu-west-1 region, enabling opt-in for EBS, EC2, EFS, and Redshift.

```hcl
module "region_settings_eu_west" {
  source = "lgallard/backup/aws"

  providers = {
    aws = aws.eu_west_1
  }

  enable_region_settings = true
  region_settings = {
    resource_type_opt_in_preference = {
      "EBS"    = true
      "EC2"    = true
      "EFS"    = true
      "Redshift" = true  # Data warehouse in EU region
    }
  }
}
```

--------------------------------

### Terraform MCP Server Commands for AWS Backup Resources

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/CLAUDE.md

This section lists example commands for the Terraform MCP server to look up documentation and validate configurations for various AWS Backup resources. Use these commands to quickly access relevant information during development.

```bash
# Resource Documentation
"Look up aws_backup_vault resource"
"Get aws_backup_plan lifecycle documentation"
"Find aws_backup_selection resource arguments"
"Check aws_backup_vault_lock_configuration"
"Validate aws_backup_framework controls"
```

--------------------------------

### Coordinate RDS Backup with Automated Backups

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/PERFORMANCE.md

Sets up an RDS backup rule to run after automated backups, with a 60-minute start window and a 240-minute completion window, to avoid conflicts.

```hcl
# Coordinate with RDS automated backups
rules = [
  {
    name     = "rds_coordinated"
    schedule = "cron(0 4 * * ? *)"  # After automated backups
    start_window = 60
    completion_window = 240
    lifecycle = {
      delete_after = 7
    }
  }
]
```

--------------------------------

### Terraform MCP Server Commands for Advanced AWS Backup Features

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/CLAUDE.md

This section lists example commands for the Terraform MCP server concerning advanced AWS Backup features such as report plans, organization policies, and continuous backup. Use these to explore and configure more complex backup functionalities.

```bash
# Advanced Features
"aws_backup_report_plan configuration"
"aws_organizations_policy BACKUP_POLICY type"
"aws_backup continuous backup support"
```

--------------------------------

### Query Backup Selection in Management Account

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/backup_selection_data_source/README.md

This example demonstrates how to query an AWS Backup selection in a management account using a specific provider alias. It's useful for cross-account backup validation by verifying member accounts are included in the selection.

```hcl
# Query backup selection in management account
provider "aws" {
  alias = "management"
  # Management account credentials
}

data "aws_backup_selection" "central" {
  provider = aws.management

  plan_id      = var.central_plan_id
  selection_id = var.central_selection_id
}

# Verify member accounts are included
locals {
  backed_up_accounts = [
    for resource in data.aws_backup_selection.central.resources :
    regex("arn:aws:.*:.*:(\d+):.*", resource)[0]
  ]

  missing_accounts = setsubtract(
    var.required_accounts,
    local.backed_up_accounts
  )
}
```

--------------------------------

### AWS Backup Plan Configuration with Variables

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/simple_plan_using_variables/README.md

Configure an AWS Backup plan, vault, rule, and resource selection by directly passing values to module variables. This setup includes a vault with lock configuration, a daily backup rule with specific lifecycle settings, and resource selection based on ARNs and tags.

```hcl
# AWS SNS Topic
resource "aws_sns_topic" "backup_vault_notifications" {
  name = "backup-vault-events"
}

# AWS Backup
module "aws_backup_example" {
  source = "../.."

  # Vault
  vault_name = "vault-1"

  # Vault lock configuration
  min_retention_days = 7
  max_retention_days = 120

  # Plan
  plan_name = "simple-plan"

  # Rule
  rule_name                         = "rule-1"
  rule_schedule                     = "cron(0 12 * * ? *)"
  rule_start_window                 = 120
  rule_completion_window            = 360
  rule_lifecycle_cold_storage_after = 30
  rule_lifecycle_delete_after       = 120
  rule_recovery_point_tags = {
    Environment = "prod"
  }

  # Selection
  selection_name = "selection-1"
  selection_resources = [
    "arn:aws:dynamodb:us-east-1:123456789101:table/mydynamodb-table1",
    "arn:aws:dynamodb:us-east-1:123456789101:table/mydynamodb-table2"
  ]
  selection_tags = [
    {
      type  = "STRINGEQUALS"
      key   = "Environment"
      value = "prod"
    }
  ]

  # Tags
  tags = {
    Owner       = "backup team"
    Environment = "prod"
    Terraform   = true
  }
}

```

--------------------------------

### High Performance Backup Configuration

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/PERFORMANCE.md

Defines backup rules for a high-performance configuration, prioritizing quick start windows (30 minutes) and shorter completion times (4 hours), with frequent backups and shorter retention periods.

```hcl
# High performance, higher cost
rules = [
  {
    name              = "high_performance"
    schedule          = "cron(0 */6 * * ? *)"  # Every 6 hours
    start_window      = 30                      # Quick start
    completion_window = 240                     # 4 hours max
    lifecycle = {
      delete_after = 30  # Frequent backups, shorter retention
    }
  }
]
```

--------------------------------

### Terraform MCP Server Commands for IAM and Security in AWS Backup

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/CLAUDE.md

This section provides example commands for the Terraform MCP server related to IAM roles, KMS encryption, and vault policies within AWS Backup. These commands help in understanding and configuring security aspects of your backup strategy.

```bash
# IAM and Security
"Find aws_iam_role for backup service"
"Get aws_kms_key encryption for backups"
"Check aws_backup_vault_policy syntax"
```

--------------------------------

### EC2 Volume Backup Optimization Configuration

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/PERFORMANCE.md

Configure AWS Backup rules for EC2 volumes, specifying schedule, start window, completion window, and lifecycle policies. This example sets a daily backup at 2 AM.

```hcl
# EC2 volume backup optimization
rules = [
  {
    name              = "ec2_volume_backup"
    schedule          = "cron(0 2 * * ? *)"
    start_window      = 120  # 2 hours
    completion_window = 480  # 8 hours
    lifecycle = {
      delete_after = 30
    }
  }
]
```

--------------------------------

### Optimize Backup Window by Resource Size

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/BEST_PRACTICES.md

Configure backup `start_window` and `completion_window` based on resource size to optimize performance. Larger resources require longer windows.

```hcl
# Small resources (< 1GB)
rules = [
  {
    name              = "small_resources"
    schedule          = "cron(0 2 * * ? *)"
    start_window      = 60    # 1 hour
    completion_window = 120   # 2 hours
  }
]

# Medium resources (1-100GB)
rules = [
  {
    name              = "medium_resources"
    schedule          = "cron(0 2 * * ? *)"
    start_window      = 120   # 2 hours
    completion_window = 480   # 8 hours
  }
]

# Large resources (> 100GB)
rules = [
  {
    name              = "large_resources"
    schedule          = "cron(0 2 * * ? *)"
    start_window      = 240   # 4 hours
    completion_window = 1440  # 24 hours
  }
]
```

--------------------------------

### Get Backup Selection IAM Permissions

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/backup_selection_data_source/README.md

This JSON object defines the IAM permissions required to get and list AWS Backup selections. Ensure these permissions are granted to the entity executing the Terraform code.

```json
{
  "Effect": "Allow",
  "Action": [
    "backup:GetBackupSelection",
    "backup:ListBackupSelections"
  ],
  "Resource": "*"
}
```

--------------------------------

### Initialize, Plan, and Apply Terraform Configuration

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/backup_global_settings/README.md

Standard Terraform commands to initialize the project, review the plan, and apply the configuration to create resources.

```bash
terraform init
terraform plan
terraform apply
```

--------------------------------

### Initialize, Plan, and Apply Terraform Configuration

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/secure_backup_configuration/README.md

Standard Terraform commands to initialize the project, review the execution plan, and apply the backup configuration.

```bash
terraform init

terraform plan

terraform apply
```

--------------------------------

### Terraform Validation Error Message

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/simple_plan_windows_vss_backup/README.md

Example error message indicating a configuration issue where Windows VSS backup is enabled but no EC2 instances are selected.

```plaintext
Error: Resource precondition failed

  on .terraform/modules/backup/main.tf line XX, in resource "aws_backup_plan" "ab_plan":
  XX:     condition     = !var.windows_vss_backup || (length(local.selection_resources) > 0 && can(regex("(?i).*ec2.*", join(",", local.selection_resources))))
     ├────────────────
     │ local.selection_resources doesn't contain EC2 instances
     │ var.windows_vss_backup is true

  Windows VSS backup is enabled but no EC2 instances are selected for backup. Either disable windows_vss_backup or include EC2 instances in your backup selection.
```

--------------------------------

### Quick Exploration with Task Agent

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/CLAUDE.md

Use the Task Agent with the 'Explore - quick' setting for basic code searches within the module. This is useful for finding specific configurations or definitions.

```bash
# Quick exploration (basic searches)
Task Agent (Explore - quick): "Find all backup vault configurations"
Task Agent (Explore - quick): "Locate IAM role definitions for backup service"
```

--------------------------------

### Small, Frequent Backups Configuration

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/PERFORMANCE.md

Configures frequent, small backups with a 30-minute start window, 120-minute completion window, and a 7-day retention period.

```hcl
small_frequent = {
  schedule          = "cron(0 */4 * * ? *)"
  start_window      = 30
  completion_window = 120
  lifecycle = {
    delete_after = 7
  }
}
```

--------------------------------

### Security Compliance: Disable S3 Backup

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/region_settings/README.md

Example HCL configuration to disable automated backup for S3 due to security policy constraints, while approving Aurora and RDS.

```hcl
resource_type_opt_in_preference = {
  "Aurora" = true   # Approved
  "RDS"    = true   # Approved
  "S3"     = false  # Not approved for automated backup
}
```

--------------------------------

### List Backup Selections using AWS CLI (Table Format)

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/backup_selection_data_source/README.md

Manually list all backup selections for a given plan ID using the AWS CLI and display them in a table format. This is useful for direct inspection via the command line.

```bash
# Get the plan ID from Terraform output
PLAN_ID=$(terraform output -raw backup_plan_id)

# List all selections for this plan (table format)
aws backup list-backup-selections --backup-plan-id $PLAN_ID \
  --query 'BackupSelectionsList[*].[SelectionId,SelectionName,IamRoleArn]' \
  --output table
```

--------------------------------

### EFS Performance Optimization with Terraform

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/BEST_PRACTICES.md

Configure backup rules for large EFS file systems with extended start and completion windows to accommodate large data volumes.

```hcl
# For large EFS file systems
rules = [
  {
    name              = "efs_backup"
    schedule          = "cron(0 2 * * ? *)"
    start_window      = 240     # 4 hours
    completion_window = 2880    # 48 hours for very large EFS
    lifecycle = {
      cold_storage_after = 30
      delete_after       = 365
    }
  }
]
```

--------------------------------

### Performance Analysis of Selection Logic

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/CLAUDE.md

Analyze backup selection resource patterns and evaluate the performance of selection logic by checking for_each vs count usage, dynamic block complexity, local variable computations, resource filtering efficiency, and potential bottlenecks.

```bash
Task Agent (Explore - thorough): "Analyze backup selection resource patterns"

Task Agent (general-purpose): "Evaluate performance of selection logic:
1. Analyze for_each vs count usage
2. Review dynamic block complexity
3. Check local variable computations
4. Validate resource filtering efficiency
5. Identify potential bottlenecks for large-scale deployments"
```

--------------------------------

### Get Backup Selections as Formatted Table

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/backup_selection_data_source/README.md

Use this command to retrieve backup selections in a human-readable table format. It's recommended for easy viewing of selection details.

```bash
$(terraform output -raw cli_list_selections_table)
```

--------------------------------

### Generate Terraform Plan

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/MIGRATION.md

Execute this command to preview the changes Terraform will make to your infrastructure without actually applying them.

```bash
terraform plan
```

--------------------------------

### AWS CLI List Supported Resource Types

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/region_settings/README.md

Use the AWS CLI to list all resource types supported by AWS Backup.

```bash
aws backup get-supported-resource-types
```

--------------------------------

### Define Resource Tags for AWS Backup

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/KNOWN_ISSUES.md

Use tags to specify which resources AWS Backup should include in backup plans. This example tags resources for backup and production environment.

```hcl
tags = {
  "backup" = "true"
  "environment" = "production"
}
```

--------------------------------

### Coordinate AWS Backup Schedules with RDS

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/KNOWN_ISSUES.md

Schedule AWS Backup to run when RDS automated backups are not active to avoid conflicts. This example sets a cron schedule for 4 AM.

```hcl
rules = [
  {
    name         = "rds_backup"
    schedule     = "cron(0 4 * * ? *)"  # 4 AM when RDS backups typically complete
    start_window = 60
    lifecycle = {
      delete_after = 7
    }
  }
]
```

--------------------------------

### AI Validation Workflow for New Features - Pre-Implementation

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/CLAUDE.md

Before implementing new features, use AI agents to understand requirements and validate the proposed approach. This involves exploring existing patterns and reviewing the implementation strategy.

```bash
# Understand requirements
Task Agent (Explore - medium): "Find similar patterns in existing examples"
```

```bash
# Validate approach
Task Agent (Plan - medium): "Review implementation strategy for [feature]"
```

--------------------------------

### Stagger Backups with Terraform

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/BEST_PRACTICES.md

Define backup plans with different schedules to avoid resource contention during backup operations. This example shows separate plans for critical and standard systems.

```hcl
plans = {
  "critical-systems" = {
    rules = [
      {
        name     = "critical_backup"
        schedule = "cron(0 1 * * ? *)"  # 1 AM
        lifecycle = {
          delete_after = 90
        }
      }
    ]
  }
  "standard-systems" = {
    rules = [
      {
        name     = "standard_backup"
        schedule = "cron(0 3 * * ? *)"  # 3 AM
        lifecycle = {
          delete_after = 30
        }
      }
    ]
  }
}
```

--------------------------------

### IAM Trust Policy for Cross-Account Access

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/TROUBLESHOOTING.md

Example IAM trust policy that allows a specific AWS account to assume a role, enabling cross-account access for AWS Backup.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT-ID:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

--------------------------------

### List All Backup Selections for a Plan via AWS CLI

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/docs/DATA_SOURCES.md

Use the AWS CLI to list all backup selections for a specific backup plan, displaying their IDs and names in a table format. This is helpful for identifying the correct `selection_id` when troubleshooting.

```bash
aws backup list-backup-selections \
  --backup-plan-id <plan-id> \
  --query 'BackupSelectionsList[*].[SelectionId,SelectionName]' \
  --output table
```

--------------------------------

### List AWS Backup Plans

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/TROUBLESHOOTING.md

Use this command to verify if a backup plan exists and to check its ID and region. Replace 'your-region' with the appropriate AWS region.

```bash
aws backup list-backup-plans --region your-region
```

--------------------------------

### IAM Policy for AWS Backup

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/TROUBLESHOOTING.md

Example IAM policy statement granting necessary permissions for AWS Backup operations, including resource management and KMS key access.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "backup:*",
        "iam:CreateRole",
        "iam:AttachRolePolicy",
        "iam:PutRolePolicy",
        "iam:PassRole",
        "kms:CreateGrant",
        "kms:DescribeKey",
        "organizations:DescribeOrganization"
      ],
      "Resource": "*"
    }
  ]
}
```

--------------------------------

### Increase Completion Window for Large Resource Backups

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/TROUBLESHOOTING.md

Extend the `completion_window` to 1440 minutes (24 hours) for backups of large resources that may exceed the default timeout. The `start_window` is set to 120 minutes.

```hcl
rules = [
  {
    name              = "large_resource_backup"
    schedule          = "cron(0 2 * * ? *)"
    start_window      = 120
    completion_window = 1440  # 24 hours
    lifecycle = {
      delete_after = 30
    }
  }
]
```

--------------------------------

### Check AWS Backup Resource State

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/README.md

List existing AWS Backup vaults and plans to verify the current state of your backup configurations. This is helpful for debugging and understanding your setup.

```bash
aws backup list-backup-vaults
aws backup list-backup-plans
```

--------------------------------

### Configure EFS Backup Rule with Extended Windows

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/TROUBLESHOOTING.md

Set a longer completion window for EFS backups, especially for large file systems. The `start_window` is set to 240 minutes (4 hours) and `completion_window` to 2880 minutes (48 hours).

```hcl
# Increase backup windows for large EFS systems
rules = [
  {
    name              = "efs_backup"
    schedule          = "cron(0 2 * * ? *)"
    start_window      = 240      # 4 hours
    completion_window = 2880     # 48 hours for very large EFS
    lifecycle = {
      delete_after = 30
    }
  }
]
```

--------------------------------

### AWS Backup SNS Notification Setup with Terraform

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/BEST_PRACTICES.md

Configure comprehensive backup notifications by specifying backup vault events and the SNS topic ARN in the AWS Backup module.

```hcl
module "backup" {
  source = "lgallard/backup/aws"

  notifications = {
    backup_vault_events = [
      "BACKUP_JOB_STARTED",
      "BACKUP_JOB_COMPLETED",
      "BACKUP_JOB_FAILED",
      "BACKUP_JOB_EXPIRED",
      "RESTORE_JOB_STARTED",
      "RESTORE_JOB_COMPLETED",
      "RESTORE_JOB_FAILED",
      "COPY_JOB_STARTED",
      "COPY_JOB_SUCCESSFUL",
      "COPY_JOB_FAILED",
      "RECOVERY_POINT_MODIFIED"
    ]
    sns_topic_arn = aws_sns_topic.backup_notifications.arn
  }
}
```

--------------------------------

### Configure AWS Provider Aliases for Multi-Region Setup

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/region_settings/README.md

Define provider aliases to manage AWS resources in different regions independently. This is useful for applying distinct region settings.

```hcl
provider "aws" {
  alias  = "us_east_1"
  region = "us-east-1"
}

provider "aws" {
  alias  = "eu_west_1"
  region = "eu-west-1"
}
```

--------------------------------

### List Backup Plans using AWS CLI

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/backup_selection_data_source/README.md

This command lists all available AWS Backup plans. It's useful for verifying that the correct backup plan ID is being used when troubleshooting selection issues.

```bash
aws backup list-backup-plans
```

--------------------------------

### Cross-Region Backup with Extended Windows

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/PERFORMANCE.md

Configures cross-region backups with extended start (120 minutes) and completion (720 minutes) windows, copying backups to a destination vault with a 90-day retention.

```hcl
cross_region = {
  schedule          = "cron(0 23 * * ? *)"
  start_window      = 120
  completion_window = 720
  copy_actions = [
    {
      destination_vault_arn = "arn:aws:backup:us-west-2:123456789012:backup-vault:dr-vault"
      lifecycle = {
        delete_after = 90
      }
    }
  ]
}
```

--------------------------------

### Create Parallel Infrastructure for Gradual Rollback

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/MIGRATION.md

Implement a gradual rollback strategy by deploying new infrastructure in parallel with the old. This allows for a phased migration and testing.

```hcl
# Keep old configuration
module "backup_old" {
  source = "lgallard/backup/aws"
  version = "~> 1.0"
  # ... old configuration
}

# New configuration
module "backup_new" {
  source = "lgallard/backup/aws"
  version = "~> 2.0"
  # ... new configuration
}
```

--------------------------------

### DynamoDB Large Table Backup Configuration

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/PERFORMANCE.md

Define backup rules for large DynamoDB tables, allocating sufficient time for the backup process. This includes adjusting start and completion windows.

```hcl
# Large DynamoDB tables
rules = [
  {
    name              = "dynamodb_large_backup"
    schedule          = "cron(0 2 * * ? *)"
    start_window      = 60
    completion_window = 240
    lifecycle = {
      delete_after = 30
    }
  }
]
```

--------------------------------

### Implement Comprehensive Tagging for Backups

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/BEST_PRACTICES.md

Apply a detailed tagging strategy to backup rules and recovery points for better organization, cost allocation, and compliance.

```hcl
module "backup" {
  source = "lgallard/backup/aws"

  tags = {
    Environment   = "production"
    Project       = "backup-infrastructure"
    Owner         = "platform-team"
    CostCenter    = "infrastructure"
    Compliance    = "required"
    BackupClass   = "critical"
    DataClass     = "confidential"
    RetentionDays = "365"
  }

  # Tag recovery points
  rules = [
    {
      name = "tagged_backup"
      schedule = "cron(0 2 * * ? *)"
      recovery_point_tags = {
        BackupDate    = "auto-generated"
        DataOwner     = "platform-team"
        RestoreReady  = "true"
        ComplianceId  = "COMP-001"
      }
    }
  ]
}
```

--------------------------------

### RDS Large Instance Backup Configuration

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/PERFORMANCE.md

Define backup rules for large RDS instances, considering longer processing times. This includes setting appropriate start and completion windows.

```hcl
rules = [
  {
    name              = "rds_large_backup"
    schedule          = "cron(0 2 * * ? *)"
    start_window      = 120
    completion_window = 480
    lifecycle = {
      delete_after = 30
    }
  }
]
```

--------------------------------

### Medium Exploration with Task Agent

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/CLAUDE.md

Employ the Task Agent with 'Explore - medium' for a more in-depth analysis of code patterns and relationships. This helps in understanding how different parts of the module interact.

```bash
# Medium exploration (moderate depth)
Task Agent (Explore - medium): "Analyze backup selection patterns across the module"
Task Agent (Explore - medium): "Map all cross-region backup configurations"
```

--------------------------------

### RDS Optimized Backup Configuration

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/PERFORMANCE.md

Configure AWS Backup rules for RDS instances to optimize backup performance. Adjust schedule, start window, completion window, and lifecycle policies.

```hcl
rules = [
  {
    name              = "rds_optimized_backup"
    schedule          = "cron(0 3 * * ? *)"   # After automated backups
    start_window      = 60                     # 1 hour
    completion_window = 240                    # 4 hours
    lifecycle = {
      delete_after = 7  # Short retention for frequent backups
    }
  }
]
```

--------------------------------

### Resource Selection by Tags

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/cost_optimized_backup/README.md

Select resources for backup based on specific tags. This allows for granular control over which resources are included in backup policies, enabling cost optimization and targeted protection.

```hcl
selection_tags = [
  {
    type  = "STRINGEQUALS"
    key   = "CostTier"
    value = "Critical"
  },
  {
    type  = "STRINGEQUALS"
    key   = "Environment"
    value = "production"
  }
]
```

--------------------------------

### Coordinate RDS Backups with Maintenance Windows

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/PERFORMANCE.md

Schedule RDS backups to occur after the instance's maintenance window to minimize performance impact. This example sets a Sunday 5 AM UTC schedule.

```hcl
# Coordinate with RDS maintenance windows
locals {
  rds_backup_schedule = {
    # If RDS maintenance window is Sunday 03:00-04:00 UTC
    # Schedule backups after maintenance
    schedule = "cron(0 5 ? * SUN *)"  # Sunday 5 AM UTC
  }
}
```

--------------------------------

### Configure AWS Backup Plan with Multiple Rules and Selections

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/simple_plan/README.md

Use this configuration to set up a basic AWS Backup plan. It includes defining a backup vault, multiple backup rules with different schedules and retention periods, and resource selection criteria based on both ARNs and tags. Ensure the AWS provider is configured.

```hcl
resource "aws_sns_topic" "backup_vault_notifications" {
  name = "backup-vault-events"
}

# AWS Backup
module "aws_backup_example" {
  source = "../.."

  # Vault
  vault_name = "vault-3"

  # Vault lock configuration
  min_retention_days = 7    # Minimum retention of 7 days
  max_retention_days = 90   # Maximum retention of 90 days

  # Plan
  plan_name = "simple-plan"

  # Multiple rules using a list of maps
  rules = [
    {
      name              = "rule-1"
      schedule          = "cron(0 12 * * ? *)"
      start_window      = 120
      completion_window = 360
      lifecycle = {
        cold_storage_after = 0
        delete_after       = 90
      }
      copy_actions        = []
      recovery_point_tags = {
        Environment = "prod"
      }
    },
    {
      name              = "rule-2"
      target_vault_name = "Default"
      schedule          = "cron(0 7 * * ? *)"
      start_window      = 120
      completion_window = 360
      lifecycle = {
        cold_storage_after = 0
        delete_after       = 90
      }
      copy_actions        = []
      recovery_point_tags = {
        Environment = "prod"
      }
    }
  ]

  # Multiple selections
  selections = [
    {
      name = "selection-1"
      resources = [
        "arn:aws:dynamodb:us-east-1:123456789101:table/mydynamodb-table1",
        "arn:aws:dynamodb:us-east-1:123456789101:table/mydynamodb-table2"
      ]
      selection_tags = [
        {
          type  = "STRINGEQUALS"
          key   = "Environment"
          value = "prod"
        }
      ]
    }
  ]

  tags = {
    Owner       = "backup team"
    Environment = "prod"
    Terraform   = true
  }
}

```

--------------------------------

### AWS CLI Describe Region Settings

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/examples/region_settings/README.md

Use the AWS CLI to describe the current AWS Backup region settings.

```bash
aws backup describe-region-settings
```

--------------------------------

### DynamoDB Backup Optimization Configuration

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/PERFORMANCE.md

Configure AWS Backup rules for DynamoDB, enabling continuous backup for PITR-enabled tables. Adjust start and completion windows as DynamoDB backups are typically fast.

```hcl
# DynamoDB backup optimization
rules = [
  {
    name                     = "dynamodb_backup"
    schedule                 = "cron(0 2 * * ? *)"
    start_window             = 30   # DynamoDB backups are fast
    completion_window        = 120  # Usually complete quickly
    enable_continuous_backup = true # For PITR-enabled tables
    lifecycle = {
      delete_after = 35  # Keep point-in-time recovery for 35 days
    }
  }
]
```

--------------------------------

### AI Validation for Continuous Backup

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/README.md

Use this agent to validate the implementation of continuous backup features in AWS Backup plans. It checks syntax, resource types, IAM permissions, security, examples, and documentation.

```bash
# Explore existing patterns
Task Agent (Explore - medium): "Analyze all aws_backup_plan resources and their rule configurations across examples"

# Validate implementation
Task Agent (general-purpose): "Validate continuous backup implementation:
1. Check aws_backup_plan syntax for enable_continuous_backup argument
2. Verify compatible resource types (EFS, RDS, etc.)
3. Validate IAM permissions for continuous backup
4. Review security implications
5. Check example configurations
6. Verify documentation accuracy"
```

--------------------------------

### EC2 High-Performance Volume Backup Configuration

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/PERFORMANCE.md

Define backup rules for EC2 volumes requiring higher performance or longer backup windows. This example schedules backups for 1 AM with extended completion times.

```hcl
# High-performance volumes
rules = [
  {
    name              = "ec2_high_perf_backup"
    schedule          = "cron(0 1 * * ? *)"
    start_window      = 180
    completion_window = 720
    lifecycle = {
      delete_after = 30
    }
  }
]
```

--------------------------------

### Cost Optimized Backup Rule

Source: https://github.com/lgallard/terraform-aws-backup/blob/master/PERFORMANCE.md

Defines a weekly backup rule with extended start and completion windows, moving data to cold storage after 30 days and retaining it for 365 days for cost optimization.

```hcl
rules = [
  {
    name              = "cost_optimized"
    schedule          = "cron(0 2 ? * SUN *)"  # Weekly backups
    start_window      = 120                     # Extended start window
    completion_window = 720                     # Extended completion window
    lifecycle = {
      cold_storage_after = 30   # Move to cold storage
      delete_after       = 365  # Long retention
    }
  }
]
```