Task: An AWS service that provisions an EC2 instance and backs it up every day at midnight. Accomplish this using AWS Backup.

Specification:
have one "aws_ami" data resource
have one "aws_instance" resource
  with "ami" argument linking to the aws_ami data resource
  with "instance_type" argument
have one "aws_backup_plan" resource
  with "name" argument
  with "rule" argument block
    with "rule_name" argument
    with "target_vault_name" argument linking to backup_vault
    with "schedule" argument with value "cron(0 0 * * ? *)"
  with "advanced_backup_setting" argument block
    with "backup_options" argument block
      with "WindowsVSS" argument
    with "resource_type" argument with value "EC2"
have one "aws_backup_vault" resource
  with "name" argument
have one "aws_backup_selection" resource
  with "iam_role_arn" argument
  with "name" argument
  with "plan_id" argument linking to aws_backup_plan resource
  with "resources" argument including the aws_instance resource

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

data "aws_ami" "amzn2" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["*ubuntu-noble-24.04-amd64-server-*"]
  }
}

resource "aws_instance" "cloud_desktop" {
  instance_type = "t2.micro"
  ami = data.aws_ami.amzn2.id
}

resource "aws_backup_plan" "cloud_desktop_backup" {
  name = "cloud_desktop_backup_plan"
  rule {
    rule_name         = "cloud_desktop_backup_rule" # required, not specified
    target_vault_name = aws_backup_vault.valut.name # required, not specified
    schedule          = "cron(0 0 * * ? *)"
  }

  advanced_backup_setting {
    backup_options = {
      WindowsVSS = "enabled"
    }
    resource_type = "EC2"
  }
}

resource "aws_backup_vault" "valut" {
  name = "cloud_desktop_backup_valut"
}

resource "aws_backup_selection" "backup_ec2" {
  iam_role_arn = aws_iam_role.backup.arn

  name    = "backup_ec2"
  plan_id = aws_backup_plan.cloud_desktop_backup.id

  resources = [
    aws_instance.cloud_desktop.arn,
  ]
}

data "aws_iam_policy_document" "backup_assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["backup.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "backup" {
  name               = "backup"
  assume_role_policy = data.aws_iam_policy_document.backup_assume_role.json
}

resource "aws_iam_role_policy_attachment" "backup" {
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
  role       = aws_iam_role.backup.name
}

Validation policy (checks.rego):
package cloud_desktop_high

import rego.v1

default valid := false

instance_valid(instance, ami) if {
	instance.expressions.instance_type
	ami.address in instance.expressions.ami.references
}

backup_plan_valid(backup_plan, backup_vault) if {
	# advanced_backup_setting
	some backup_setting in backup_plan.expressions.advanced_backup_setting
	backup_setting.backup_options

	backup_setting.resource_type.constant_value == "EC2"

	# rule
	some rule in backup_plan.expressions.rule
	backup_vault.address in rule.target_vault_name.references
	rule.schedule.constant_value == "cron(0 0 * * ? *)"
}

backup_selection_valid(backup_selection, backup_plan, instance) if {
	backup_plan.address in backup_selection.expressions.plan_id.references
	instance.address in backup_selection.expressions.resources.references
}

valid if {
	resources := input.configuration.root_module.resources
	some backup_plan in resources
	backup_plan.type == "aws_backup_plan"
	some backup_vault in resources
	backup_vault.type == "aws_backup_vault"
	some backup_selection in resources
	backup_selection.type == "aws_backup_selection"
	some instance in resources
	instance.type == "aws_instance"
	some ami in resources
	ami.type == "aws_ami"

	instance_valid(instance, ami)
	backup_plan_valid(backup_plan, backup_vault)
	backup_selection_valid(backup_selection, backup_plan, instance)
}