AWS BackupでFSx for OpenZFSのバックアップ失敗をSNSでメール通知してみた

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as fsx from 'aws-cdk-lib/aws-fsx';
import * as backup from 'aws-cdk-lib/aws-backup';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as sns from 'aws-cdk-lib/aws-sns';
import * as events from 'aws-cdk-lib/aws-events';

export class DemoFsxBackupFailedSnsStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // VPC
    const vpc = new ec2.Vpc(this, 'FsxVpc', {
      ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/24'),
      maxAzs: 1,
      natGateways: 0,
      restrictDefaultSecurityGroup: false,
      subnetConfiguration: [
        {
          cidrMask: 26,
          name: 'Private',
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        },
      ],
    });

    // FSx用セキュリティグループ
    const fsxSg = new ec2.SecurityGroup(this, 'FsxSg', {
      vpc,
      securityGroupName: 'fsx-sg',
      description: 'Security group for FSx OpenZFS',
      allowAllOutbound: false,
    });

    // AWS BackupからFSxへのNFSアクセスに必要なインバウンドルール
    fsxSg.addIngressRule(ec2.Peer.ipv4(vpc.vpcCidrBlock), ec2.Port.tcp(111), 'NFS RPC');
    fsxSg.addIngressRule(ec2.Peer.ipv4(vpc.vpcCidrBlock), ec2.Port.tcp(2049), 'NFS');
    fsxSg.addIngressRule(ec2.Peer.ipv4(vpc.vpcCidrBlock), ec2.Port.tcpRange(20001, 20003), 'NFS lock/mount/status');

    // FSx for OpenZFS（Single AZ）
    new fsx.CfnFileSystem(this, 'FsxOpenzfs', {
      fileSystemType: 'OPENZFS',
      storageCapacity: 64,
      subnetIds: [vpc.isolatedSubnets[0].subnetId],
      securityGroupIds: [fsxSg.securityGroupId],
      openZfsConfiguration: {
        deploymentType: 'SINGLE_AZ_2',
        throughputCapacity: 160,
        // メンテナンスウィンドウ: 毎週木曜 0:00 JST（水曜 15:00 UTC）。FSx形式は d:HH:MM（月=1）
        weeklyMaintenanceStartTime: '3:15:00',
        rootVolumeConfiguration: {
          dataCompressionType: 'LZ4',
        },
        automaticBackupRetentionDays: 0,
      },
      tags: [
        { key: 'Name', value: 'fsx-openzfs' },
        { key: 'BackupTarget', value: 'true' }, // タグでバックアップリソースを判定
      ],
    });

    // SNSトピック
    const alertTopic = new sns.Topic(this, 'FsxAlertTopic', {
      topicName: 'fsx-alert-topic',
      displayName: 'FSx Backup Alert',
    });

    // Backup Vault
    const backupVault = new backup.BackupVault(this, 'FsxBackupVault', {
      backupVaultName: 'fsx-backup-vault',
      notificationTopic: alertTopic, // 指定のSNSトピックにイベントを通知
      notificationEvents: [backup.BackupVaultEvents.BACKUP_JOB_FAILED], // バックアップの失敗を指定してイベントを送信
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    });

    // Backup IAM Role
    const backupRole = new iam.Role(this, 'FsxBackupRole', {
      roleName: 'fsx-backup-role',
      assumedBy: new iam.ServicePrincipal('backup.amazonaws.com'),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSBackupServiceRolePolicyForBackup'),
        iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSBackupServiceRolePolicyForRestores'),
      ],
    });

    // Backup Plan
    const backupPlan = new backup.BackupPlan(this, 'FsxBackupPlan', {
      backupPlanName: 'fsx-backup-plan',
      backupVault,
      backupPlanRules: [
        new backup.BackupPlanRule({
          ruleName: 'daily-23-jst',
          // 毎日 23:00 JST（14:00 UTC）。メンテナンスウィンドウ開始（水曜 15:00 UTC）の1時間前に開始
          scheduleExpression: events.Schedule.expression('cron(0 14 * * ? *)'),
          // 開始ウィンドウ1時間以内に開始しなければ失敗
          startWindow: cdk.Duration.hours(1),
          deleteAfter: cdk.Duration.days(7),
        }),
      ],
    });

    // Backup Selection（FSxをバックアップ対象に指定）
    new backup.BackupSelection(this, 'FsxBackupSelection', {
      backupPlan,
      role: backupRole,
      resources: [
        backup.BackupResource.fromTag('BackupTarget', 'true'),
      ],
    });
  }
}

// Backup Vault
const backupVault = new backup.BackupVault(this, 'FsxBackupVault', {
    backupVaultName: 'fsx-backup-vault',
    notificationTopic: alertTopic, // 指定のSNSトピックにイベントを通知
    notificationEvents: [backup.BackupVaultEvents.BACKUP_JOB_FAILED], // バックアップの失敗を指定してイベントを送信
    removalPolicy: cdk.RemovalPolicy.DESTROY,
});