Terraform and AWS recovery plan (Codecommit and S3)

160 Views Asked by At

As far as I understood, Terraform is used to provide Infrastructure as code. However, let's imagine I have my infrastructure all coded in Terraform, a simple example: I have a CodeCommit repository that stores all my AWS Lambda functions and a few S3 Buckets with lots of data.

Now let's imagine a scenario where I've been "hacked" and all my data is lost, how am I supposed to recover from this disaster? In this scenario I have the Terraform code to get my infrastructure back and running in AWS, however all my data is lost. What are solutions to the case of S3 and CodeCommit? How could I restore my CodeCommit repository with all my Lambda functions declared there? What precautions measures should I have taken?

1

There are 1 best solutions below

0
Nico On

What kind of hacking are you talking about? S3 bucket deletion? If so, you can start applying versioning on all the buckets so data cannot be deleted but marked as "deleted" only (take a look Using versioning in S3 buckets)

Considering Versioning can let your bucket dramatically grow, you can configure Lifecycle management rule to purge data older then for example: 60 days (take a look at Managing your storage lifecycle)

If you would like to apply a further security level, you can replicate the buckets to another region and/or to a different account with cross account replication (take a look at Replicating objects)

You can replicate your Codecommit repositories via Fargate as well (take a look at Replicate AWS CodeCommit Repositories between Regions using AWS Fargate)

You can schedule buckets backup as well (take a look at Creating Amazon S3 backups)

All depends by your environment design and what kind of security level/resilience you would like to set.