EC2インスタンス起動とAWS Backupを利用したバックアップ設定をするCloudFormationテンプレートを作成しました

AWSTemplateFormatVersion: 2010-09-09

Description:  
  This is template of test Server EC2

Parameters:
  ProjectPrefix:
    Type: String
    Default: "test"
    Description: Project Prefix
  Environment:
    Description: Environment
    Type: String
    Default: dev
    AllowedValues:
      - dev
      - stg
      - prd
  VpcId:
    Type: "String"
    Default: "vpc-XXXXXXXXXXXXXXXXX"
  EC2SubnetId: 
    Type: "String"
    Default: "subnet-XXXXXXXXXXXXXXXXX"
  InstanceType:
    Type: String
    Default: "t3.micro"
    Description: InstanceType for EC2
  ImageId:
    Type: String
    Default: "ami-XXXXXXXXXXXXXXXXX"
    Description: AMI-ID for EC2
  RootVolumeSize:
    Type: String
    Default: "30"
    Description: Size of Root Device
  KeyName:
    Type: String
    Default: "test-keypair"
    Description: EC2 Keypair Name
  EC2InstanceName:
    Type: String
    Default: "test-ec2"
    Description: EC2 Instance Name
  SSHIPAddress:
    Type: String
    Default: "192.168.0.0/24"
    Description: Allow SSH IPAddress
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
  BackupCron:
    Type: String
    Default: cron(00 15 * * ? *)
    Description: Exec Backup Time.(UTC)
  BackupGeneration:
    Type: Number
    Default: 7
    Description: Backup File Generation
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: Common Settings
      Parameters:
        - ProjectPrefix
        - Environment
    - Label:
        default: EC2 Settings
      Parameters:
        - VpcId
        - EC2SubnetId
        - InstanceType
        - ImageId
        - RootVolumeSize
        - KeyName
        - EC2InstanceName
        - SSHIPAddress
    - Label:
        default: Backup Settings
      Parameters:
        - BackupCron
        - BackupGeneration

Resources:
# ------------------------------------------------------------#
#  SecurityGroup for EC2 Instance
# ------------------------------------------------------------#
  TestServerEC2SG:
    Type: AWS::EC2::SecurityGroup
    Properties: 
      GroupName: !Sub ${ProjectPrefix}-${Environment}-sg-ec2-TestServer
      GroupDescription: Security Group for Test Server
      Tags:
        - Key: Name
          Value: !Sub ${ProjectPrefix}-${Environment}-sg-ec2-TestServer
      VpcId: 
          !Ref VpcId

  TestServerEC2SGIngressSSHNTD:
     Type: AWS::EC2::SecurityGroupIngress
     Properties:
        GroupId: !Ref TestServerEC2SG
        IpProtocol: tcp
        FromPort: 22
        ToPort: 22
        CidrIp: !Ref SSHIPAddress

# ------------------------------------------------------------#
#  IAM Role for EC2 Instance
# ------------------------------------------------------------#
  TestServerEC2IAMRole:
      Type: AWS::IAM::Role
      Properties: 
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            -
              Effect: "Allow"
              Principal:
                Service:
                  - "ec2.amazonaws.com"
              Action:
                - "sts:AssumeRole"
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
        Path: /
        RoleName: !Sub ${ProjectPrefix}-${Environment}-iam-role-ec2-TestServer
  
  TestServerEC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties: 
      Path: /
      Roles:
        - Ref: TestServerEC2IAMRole
      InstanceProfileName: !Ref TestServerEC2IAMRole

# ------------------------------------------------------------#
#  EC2 Instance
# ------------------------------------------------------------#
  TestServerEC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Sub ${InstanceType}
      ImageId: !Sub ${ImageId}
      KeyName: !Sub ${KeyName}
      IamInstanceProfile: !Ref TestServerEC2InstanceProfile
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeType: gp2
            VolumeSize: !Sub ${RootVolumeSize}
            DeleteOnTermination: true
      NetworkInterfaces:
        - SubnetId: 
            !Ref EC2SubnetId
          AssociatePublicIpAddress: false
          GroupSet:
             - !Ref TestServerEC2SG
          DeviceIndex: 0
          DeleteOnTermination: true
      DisableApiTermination: false
      EbsOptimized: true
      Tags:
        - Key: Name
          Value: !Sub ${EC2InstanceName}
        - Key: Backup
          Value: true

# ------------------------------------------------------------#
#  AWS Backup
# ------------------------------------------------------------#
  EC2BackupIAMRole:
      Type: AWS::IAM::Role
      Properties: 
        AssumeRolePolicyDocument:
          Version: 2012-10-17
          Statement:
            -
              Effect: Allow
              Principal:
                Service:
                  - backup.amazonaws.com
              Action:
                - sts:AssumeRole
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup
          - arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores
        Path: /service-role/
        RoleName: !Sub ${ProjectPrefix}-${Environment}-iam-role-ec2-backup

  TestBackupVaultforEC2:
    Type: AWS::Backup::BackupVault
    Properties:
      BackupVaultName: TestEC2BackupVault

  TestBackupPlan:
    Type: AWS::Backup::BackupPlan
    Properties:
      BackupPlan:
        BackupPlanName: TestBackupPlan
        AdvancedBackupSettings:
          -
            ResourceType: EC2
            BackupOptions:
              WindowsVSS: disabled
        BackupPlanRule:
          -
            RuleName: RuleForDailyBackups
            TargetBackupVault: !Ref TestBackupVaultforEC2
            ScheduleExpression: !Ref BackupCron
            Lifecycle:
              DeleteAfterDays: !Ref BackupGeneration
  TagBasedBackupSelection:
    Type: AWS::Backup::BackupSelection
    Properties:
      BackupSelection:
        SelectionName: TagBasedBackupSelection
        IamRoleArn: !GetAtt EC2BackupIAMRole.Arn
        ListOfTags:
         -
           ConditionType: STRINGEQUALS
           ConditionKey: Backup
           ConditionValue: true
      BackupPlanId: !Ref TestBackupPlan
    DependsOn: TestBackupPlan