---
AWSTemplateFormatVersion:                  "2010-09-09"

Description:                               >
  This template creates backup vault(cabvault) required for the "How to secure recovery with cross-account backup and cross-Region copy using AWS Backup" blog.
Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
      - Label:
          default:                         AWS Backup Configuration
        Parameters:
          - cabvault
          - organizationid
          - sourceaccountid
    ParameterLabels:
      cabvault:
        default:                           Backup vault name (Case sensitive. Must contain from 2 to 50 alphanumeric and '-_' characters.)
      organizationid:
        default:                           Enter your AWS organizations ID
      sourceaccountid:
        default:                           Enter the AWS account ID for your source backup account
Parameters:
  organizationid:
    Type:                                  String
  sourceaccountid:
    Type:                                  String
Resources:
  cabKey:
    Type:                                  AWS::KMS::Key
    Properties:
      Description:                         An example symmetric CMK
      KeyPolicy:
        Version:                           '2012-10-17'
        Id:                                cab-kms-key
        Statement:
          - Sid:                           Enable IAM User Permissions
            Effect:                        Allow
            Principal:
              AWS:                         !Sub 'arn:aws:iam::${AWS::AccountId}:root'
            Action:                        kms:*
            Resource:                      '*'
          - Sid:                           Allow use of the key
            Effect:                        Allow
            Principal:
              AWS:                         !Sub
                - 'arn:aws:iam::${yoursourceaccountid}:root'
                - { yoursourceaccountid:   !Ref sourceaccountid }
            Action:
            - kms:DescribeKey
            - kms:Encrypt
            - kms:Decrypt
            - kms:ReEncrypt*
            - kms:GenerateDataKey
            - kms:GenerateDataKeyWithoutPlaintext
            Resource:                      '*'
          - Sid:                           Allow attachment of persistent resources
            Effect:                        Allow
            Principal:
              AWS:                         !Sub
                - 'arn:aws:iam::${yoursourceaccountid}:root'
                - { yoursourceaccountid:   !Ref sourceaccountid }
            Action:
            - kms:CreateGrant
            - kms:ListGrants
            - kms:RevokeGrant
            Resource:                      '*'
            Condition:
              Bool:
                kms:GrantIsForAWSResource: true
  cabvault:
    Type:                                  AWS::Backup::BackupVault
    Properties:
      AccessPolicy:
        Version:                           '2012-10-17'
        Statement:
          - Sid:                           Enable backup vault access
            Effect:                        Allow
            Action:                        backup:CopyIntoBackupVault
            Resource:                      '*'
            Principal:                     '*'
            Condition:
              StringEquals:
                aws:PrincipalOrgID:        !Ref organizationid
      BackupVaultName:                     cabvault
      EncryptionKeyArn:                    !GetAtt cabKey.Arn
Outputs:
  cabvault:
    Value:
      Ref:                                 cabvault
  cabKey:
    Value:
      Ref:                                 cabKey
