Manage Cloud Backup resources with Terraform

Prerequisites

• An Alibaba Cloud account has full permissions on all resources, which poses a high security risk if its access credentials are leaked. For better security, we recommend creating a RAM user and an access key for that user. For more information, see Create a RAM user and Create an access key.

• Use the following sample policy to grant the AliyunHBRFullAccess permission to the RAM user. This permission is required to manage Cloud Backup resources. For more information, see Grant permissions to a RAM user.

  {
      "Version": "1",
      "Statement": [
          {
              "Action": "hbr:*",
              "Resource": "*",
              "Effect": "Allow"
          },
          {
              "Action": "hdr:*",
              "Resource": "*",
              "Effect": "Allow"
          },
          {
              "Action": [
                  "ecs:DescribeImages",
                  "ecs:DescribeInstances",
                  "ecs:DescribeInstanceAttribute"
              ],
              "Resource": "*",
              "Effect": "Allow"
          },
          {
              "Action": [
                  "vpc:DescribeVSwitches",
                  "vpc:DescribeVpcs",
                  "vpc:DescribeEipAddresses",
                  "vpc:DescribeVpcAttribute",
                  "vpc:DescribeZones",
                  "vcp:DescribeVSwitchAttributes"
              ],
              "Resource": "*",
              "Effect": "Allow"
          },
          {
              "Action": [
                  "ram:CreateServiceLinkedRole",
                  "ram:DeleteServiceLinkedRole"
              ],
              "Resource": "*",
              "Effect": "Allow",
              "Condition": {
                  "StringEquals": {
                      "ram:ServiceName": [
                          "dr.hbr.aliyuncs.com",
                          "ecsbackup.hbr.aliyuncs.com",
                          "ossbackup.hbr.aliyuncs.com",
                          "nasbackup.hbr.aliyuncs.com",
                          "csgbackup.hbr.aliyuncs.com",
                          "vaultencryption.hbr.aliyuncs.com",
                          "otsbackup.hbr.aliyuncs.com",
                          "crossbackup.hbr.aliyuncs.com",
                          "ecsencryption.hbr.aliyuncs.com",
                          "magpiebridge.hbr.aliyuncs.com"
                      ]
                  }
              }
          }
      ]
  }

• Prepare a Terraform runtime environment. You can use Terraform in any of the following ways:

  Use Terraform in Terraform Explorer: Alibaba Cloud provides an online runtime environment for Terraform. You can use Terraform online without installing it. This method is a fast, convenient, and cost-free way to try Terraform.

  Use Terraform to quickly create a resource: Terraform components are pre-installed in Alibaba Cloud Cloud Shell and credentials are automatically configured. You can run Terraform commands directly in Cloud Shell. This method provides a fast, convenient, and low-cost way to use Terraform.

  Install and configure Terraform locally: Use this method if you have a poor network connection or need a custom development environment.

Resources used

alicloud_hbr_vault: Creates a backup vault.

Create a backup vault

This example creates a backup vault for Cloud Backup.

1. Create a working directory and a configuration file within it named main.tf. main.tf is the main Terraform file that defines the resources you will deploy.

   variable "region" {
     default = "cn-hangzhou"
   }
   provider "alicloud" {
     region = var.region
   }
   resource "random_integer" "default" {
     min = 10000
     max = 99999
   }
   # Create a backup vault for Cloud Backup.
   resource "alicloud_hbr_vault" "example" {
     vault_name = "example_value_${random_integer.default.result}"
   }

2. Run the following command to initialize the Terraform runtime environment.

   terraform init

   The following output indicates that Terraform initialized successfully.

   Initializing the backend...
   Initializing provider plugins...
   - Finding latest version of hashicorp/alicloud...
   - Installing hashicorp/alicloud v1.234.0...
   - Installed hashicorp/alicloud v1.234.0 (signed by HashiCorp)
   Terraform has created a lock file .terraform.lock.hcl to record the provider
   selections it made above. Include this file in your version control repository
   so that Terraform can guarantee to make the same selections by default when
   you run "terraform init" in the future.
   Terraform has been successfully initialized!
   You may now begin working with Terraform. Try running "terraform plan" to see
   any changes that are required for your infrastructure. All Terraform commands
   should now work.
   If you ever set or change modules or backend configuration for Terraform,
   rerun this command to reinitialize your working directory. If you forget, other
   commands will detect it and remind you to do so if necessary.

3. Create an execution plan and preview the changes.

   terraform plan

4. Run the following command to create a backup vault for Cloud Backup.

   terraform apply

   When prompted, enter yes and press Enter. Wait for the command to complete. The following output indicates that the backup vault is created successfully.

   Plan: 2 to add, 0 to change, 0 to destroy.
   Do you want to perform these actions?
     Terraform will perform the actions described above.
     Only 'yes' will be accepted to approve.
     Enter a value: yes
   random_integer.default: Creating...
   random_integer.default: Creation complete after 0s [id=58472]
   alicloud_hbr_vault.example: Creating...
   alicloud_hbr_vault.example: Creation complete after 8s [id=v-00023xlq3mjub7****]
   Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

5. Verify the result

   Terraform show command

   Run the following command to view the details of the resources created by Terraform:

   terraform show

   shell@Alicloud:~/ens/hbr$ terraform show
   # alicloud_hbr_vault.example:
   resource "alicloud_hbr_vault" "example" {
       encrypt_type        = "HBR PRIVATE"
       id                  = "v-xxx"
       status              = "CREATED"
       vault_name          = "example_value_58472"
       vault_storage_class = "STANDARD"
       vault_type          = "STANDARD"
   }
   # random_integer.default:
   resource "random_integer" "default" {
       id     = "58472"
       max    = 99999
       min    = 10000
       result = 58472
   }

   Cloud Backup console

   After the backup vault is created, you can view it on the Cloud Backup console, or by using OpenAPI or an SDK.

   On the repository management page, the status of the created backup vault is active.

Clean up resources

When you no longer need the resources, run the following command to destroy them. For more information about terraform destroy, see Common commands.

terraform destroy

Complete example

To explore more complete examples, browse the product-specific folders in more sample templates.

variable "region" {
  default = "cn-hangzhou"
}
provider "alicloud" {
  region = var.region
}
resource "random_integer" "default" {
  min = 10000
  max = 99999
}
# Create a backup vault for Cloud Backup.
resource "alicloud_hbr_vault" "example" {
  vault_name = "example_value_${random_integer.default.result}"
}