Backup

10 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

BackupFramework # CLOUD CONTROL · AWS::Backup::Framework

BackupFramework manages AWS::Backup::Framework through the AWS Cloud Control API.

kubectl get backupframeworks · example on GitHub

Example

# BackupFramework — Backup
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/backup.html#backupframework
apiVersion: aws.konfig.io/v1alpha1
kind: BackupFramework
metadata:
  name: example-backupframework
  namespace: default
spec:
  frameworkControls:
  - controlInputParameters:
    - parameterName: example-backupframework
      parameterValue: example
    controlName: example-backupframework
    controlScope:
      complianceResourceIds:
      - example
      complianceResourceTypes:
      - example
      tags:
      - key: example
        value: example
  frameworkDescription: Managed by konfig-konector
  frameworkName: example-backupframework
  frameworkTags:
  - key: example
    value: example
  providerRef:
    name: example-backupframework
    region: us-east-1

Spec

Field	Type	Required	Description
`frameworkControls`	array<object>	yes	Contains detailed information about all of the controls of a framework.
`frameworkControls[].controlInputParameters`	array<object>	—	A list of ParameterName and ParameterValue pairs.
`frameworkControls[].controlInputParameters[].parameterName`	string	yes
`frameworkControls[].controlInputParameters[].parameterValue`	string	yes
`frameworkControls[].controlName`	string	yes	The name of a control.
`frameworkControls[].controlScope`	object	—	The scope of a control.
`frameworkControls[].controlScope.complianceResourceIds`	array<string>	—	The ID of the only AWS resource that you want your control scope to contain.
`frameworkControls[].controlScope.complianceResourceTypes`	array<string>	—	Describes whether the control scope includes one or more types of resources, such as `EFS` or `RDS`.
`frameworkControls[].controlScope.tags`	array<object>	—	Describes whether the control scope includes resources with one or more tags.
`frameworkControls[].controlScope.tags[].key`	string	yes
`frameworkControls[].controlScope.tags[].value`	string	yes
`frameworkDescription`	string	—	An optional description of the framework with a maximum 1,024 characters.
`frameworkName`	string	—	The unique name of a framework.
`frameworkTags`	array<object>	—	Metadata that you can assign to help organize the frameworks that you create.
`frameworkTags[].key`	string	yes
`frameworkTags[].value`	string	yes
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	The date and time that a framework is created, in ISO 8601 representation.
`deploymentStatus`	string	—	The deployment status of a framework.
`frameworkArn`	string	—	An Amazon Resource Name (ARN) that uniquely identifies Framework as a resource Read-only: reported by AWS after creation.
`frameworkStatus`	string	—	A framework consists of one or more controls.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

BackupLegalHold # CLOUD CONTROL · AWS::Backup::LegalHold

BackupLegalHold manages AWS::Backup::LegalHold through the AWS Cloud Control API.

kubectl get backuplegalholds · example on GitHub

Example

# BackupLegalHold — Backup
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/backup.html#backuplegalhold
apiVersion: aws.konfig.io/v1alpha1
kind: BackupLegalHold
metadata:
  name: example-backuplegalhold
  namespace: default
spec:
  description: Managed by konfig-konector
  providerRef:
    name: example-backuplegalhold
    region: us-east-1
  recoveryPointSelection:
    dateRange:
      fromDate: example
      toDate: example
    resourceIdentifiers:
    - example
    vaultNames:
    - example
  tags:
  - key: example
    value: example
  title: example

Spec

Field	Type	Required	Description
`description`	string	yes	The description of the legal hold.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`recoveryPointSelection`	object	yes	The criteria to assign a set of resources, such as resource types or backup vaults.
`recoveryPointSelection.dateRange`	object	—	A date range for filtering recovery points.
`recoveryPointSelection.dateRange.fromDate`	string	yes	The beginning date, inclusive.
`recoveryPointSelection.dateRange.toDate`	string	yes	The end date, inclusive.
`recoveryPointSelection.resourceIdentifiers`	array<string>	—	The resources included in the resource selection.
`recoveryPointSelection.vaultNames`	array<string>	—	The names of the vaults in which the selected recovery points are contained.
`tags`	array<object>	—	Optional tags to include.
`tags[].key`	string	yes	The key name of the tag.
`tags[].value`	string	yes	The value for the tag.
`title`	string	yes	The title of the legal hold.

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the legal hold.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationDate`	string	—	The time when the legal hold was created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`legalHoldId`	string	—	The ID of the legal hold.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	The status of the legal hold. Allowed: `CREATING, ACTIVE, CANCELING, CANCELED`

BackupLogicallyAirGappedBackupVault # CLOUD CONTROL · AWS::Backup::LogicallyAirGappedBackupVault

BackupLogicallyAirGappedBackupVault manages AWS::Backup::LogicallyAirGappedBackupVault through the AWS Cloud Control API.

kubectl get backuplogicallyairgappedbackupvaults · example on GitHub

Example

# BackupLogicallyAirGappedBackupVault — Backup
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/backup.html#backuplogicallyairgappedbackupvault
apiVersion: aws.konfig.io/v1alpha1
kind: BackupLogicallyAirGappedBackupVault
metadata:
  name: example-backuplogicallyairgappedbackupvault
  namespace: default
spec:
  backupVaultName: example-backuplogicallyairgappedbackupvault
  backupVaultTags:
    environment: dev
    team: platform
  encryptionKeyArn: arn:aws:iam::123456789012:role/example-role
  maxRetentionDays: 7
  minRetentionDays: 7
  mpaApprovalTeamArn: arn:aws:iam::123456789012:role/example-role
  notifications:
    backupVaultEvents:
    - example
    snsTopicArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-backuplogicallyairgappedbackupvault
    region: us-east-1

Spec

Field	Type	Required	Description
`accessPolicy`	object	—
`backupVaultName`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`backupVaultTags`	map<string>	—
`encryptionKeyArn`	string	—	Create-only in AWS: changing it requires replacing the resource.
`maxRetentionDays`	integer	yes	Create-only in AWS: changing it requires replacing the resource.
`minRetentionDays`	integer	yes	Create-only in AWS: changing it requires replacing the resource.
`mpaApprovalTeamArn`	string	—
`notifications`	object	—	BackupLogicallyAirGappedBackupVaultNotificationObjectType is a nested property type of AWS::Backup::LogicallyAirGappedBackupVault.
`notifications.backupVaultEvents`	array<string>	yes
`notifications.snsTopicArn`	string	yes
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`backupVaultArn`	string	—	Read-only: reported by AWS after creation.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`vaultState`	string	—	Read-only: reported by AWS after creation.
`vaultType`	string	—	Read-only: reported by AWS after creation.

BackupPlan # GA

BackupPlan is the Schema for managing AWS Backup plans.

kubectl get backupplans · example on GitHub

Example

# BackupPlan — Backup
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/backup.html#backupplan
apiVersion: aws.konfig.io/v1alpha1
kind: BackupPlan
metadata:
  name: example-backupplan
  namespace: default
spec:
  planName: example-backupplan
  providerRef:
    name: example-backupplan
    region: us-east-1
  rules:
  - completionWindowMinutes: 1
    lifecycle:
      deleteAfterDays: 7
      moveToColdStorageAfterDays: 7
    ruleName: example-backupplan
    scheduleExpression: example
    startWindowMinutes: 1
    targetBackupVaultName: example-backupplan
    targetBackupVaultRef: example
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`planName`	string	yes	PlanName is the display name of the backup plan.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`rules`	array<object>	yes	Rules are the scheduled backup tasks in this plan.
`rules[].completionWindowMinutes`	integer	—	CompletionWindowMinutes is the window after a backup job starts before it must complete or be canceled.
`rules[].lifecycle`	object	—	Lifecycle defines cold storage transition and expiry for recovery points.
`rules[].lifecycle.deleteAfterDays`	integer	—	DeleteAfterDays is the number of days after creation that a recovery point is deleted.
`rules[].lifecycle.moveToColdStorageAfterDays`	integer	—	MoveToColdStorageAfterDays is the number of days after creation that a recovery point is moved to cold storage.
`rules[].ruleName`	string	yes	RuleName is a display name for the rule.
`rules[].scheduleExpression`	string	—	ScheduleExpression is a CRON expression in UTC specifying when Backup initiates a backup job.
`rules[].startWindowMinutes`	integer	—	StartWindowMinutes is the window after a backup is scheduled before a job is canceled if it doesn't start.
`rules[].targetBackupVaultName`	string	—	TargetBackupVaultName is the AWS name of the vault where backups are stored.
`rules[].targetBackupVaultRef`	string	—	TargetBackupVaultRef references a BackupVault CR in the same namespace.
`tags`	map<string>	—	Tags are AWS resource tags to apply to the plan.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`planArn`	string	—	PlanARN is the ARN of the backup plan.
`planId`	string	—	PlanID uniquely identifies the backup plan.
`versionId`	string	—	VersionID is the current version of the backup plan.

BackupReportPlan # CLOUD CONTROL · AWS::Backup::ReportPlan

BackupReportPlan manages AWS::Backup::ReportPlan through the AWS Cloud Control API.

kubectl get backupreportplans · example on GitHub

Example

# BackupReportPlan — Backup
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/backup.html#backupreportplan
apiVersion: aws.konfig.io/v1alpha1
kind: BackupReportPlan
metadata:
  name: example-backupreportplan
  namespace: default
spec:
  providerRef:
    name: example-backupreportplan
    region: us-east-1
  reportDeliveryChannel:
    formats:
    - example
    s3BucketName: example-backupreportplan
    s3KeyPrefix: example
  reportPlanDescription: Managed by konfig-konector
  reportPlanName: example-backupreportplan
  reportPlanTags:
  - key: example
    value: example
  reportSetting:
    accounts:
    - example
    frameworkArns:
    - example
    organizationUnits:
    - example
    regions:
    - example
    reportTemplate: example

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`reportDeliveryChannel`	object	yes	A structure that contains information about where and how to deliver your reports, specifically your Amazon S3 bucket name, S3 key prefix, and the formats of your reports.
`reportDeliveryChannel.formats`	array<string>	—	A list of the format of your reports: CSV, JSON, or both.
`reportDeliveryChannel.s3BucketName`	string	yes	The unique name of the S3 bucket that receives your reports.
`reportDeliveryChannel.s3KeyPrefix`	string	—	The prefix for where AWS Backup Audit Manager delivers your reports to Amazon S3.
`reportPlanDescription`	string	—	An optional description of the report plan with a maximum of 1,024 characters.
`reportPlanName`	string	—	The unique name of the report plan.
`reportPlanTags`	array<object>	—	Metadata that you can assign to help organize the report plans that you create.
`reportPlanTags[].key`	string	yes
`reportPlanTags[].value`	string	yes
`reportSetting`	object	yes	Identifies the report template for the report.
`reportSetting.accounts`	array<string>	—	The list of AWS accounts that a report covers.
`reportSetting.frameworkArns`	array<string>	—	The Amazon Resource Names (ARNs) of the frameworks a report covers.
`reportSetting.organizationUnits`	array<string>	—	The list of AWS organization units that a report covers.
`reportSetting.regions`	array<string>	—	The list of AWS regions that a report covers.
`reportSetting.reportTemplate`	string	yes	Identifies the report template for the report.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`reportPlanArn`	string	—	An Amazon Resource Name (ARN) that uniquely identifies a resource.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

BackupRestoreTestingPlan # CLOUD CONTROL · AWS::Backup::RestoreTestingPlan

BackupRestoreTestingPlan manages AWS::Backup::RestoreTestingPlan through the AWS Cloud Control API.

kubectl get backuprestoretestingplans · example on GitHub

Example

# BackupRestoreTestingPlan — Backup
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/backup.html#backuprestoretestingplan
apiVersion: aws.konfig.io/v1alpha1
kind: BackupRestoreTestingPlan
metadata:
  name: example-backuprestoretestingplan
  namespace: default
spec:
  providerRef:
    name: example-backuprestoretestingplan
    region: us-east-1
  recoveryPointSelection:
    algorithm: LATEST_WITHIN_WINDOW
    excludeVaults:
    - example
    includeVaults:
    - example
    recoveryPointTypes:
    - example
    selectionWindowDays: 7
  restoreTestingPlanName: example-backuprestoretestingplan
  scheduleExpression: example
  scheduleExpressionTimezone: example
  startWindowHours: 1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`recoveryPointSelection`	object	yes	BackupRestoreTestingPlanRestoreTestingRecoveryPointSelection is a nested property type of AWS::Backup::RestoreTestingPlan.
`recoveryPointSelection.algorithm`	enum	yes	Allowed: `LATEST_WITHIN_WINDOW, RANDOM_WITHIN_WINDOW`
`recoveryPointSelection.excludeVaults`	array<string>	—
`recoveryPointSelection.includeVaults`	array<string>	yes
`recoveryPointSelection.recoveryPointTypes`	array<string>	yes
`recoveryPointSelection.selectionWindowDays`	integer	—
`restoreTestingPlanName`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`scheduleExpression`	string	yes
`scheduleExpressionTimezone`	string	—
`startWindowHours`	integer	—
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`restoreTestingPlanArn`	string	—	Read-only: reported by AWS after creation.

BackupRestoreTestingSelection # CLOUD CONTROL · AWS::Backup::RestoreTestingSelection

BackupRestoreTestingSelection manages AWS::Backup::RestoreTestingSelection through the AWS Cloud Control API.

kubectl get backuprestoretestingselections · example on GitHub

Example

# BackupRestoreTestingSelection — Backup
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/backup.html#backuprestoretestingselection
apiVersion: aws.konfig.io/v1alpha1
kind: BackupRestoreTestingSelection
metadata:
  name: example-backuprestoretestingselection
  namespace: default
spec:
  iamRoleArn: arn:aws:iam::123456789012:role/example-role
  protectedResourceArns:
  - example
  protectedResourceConditions:
    stringEquals:
    - key: example
      value: example
    stringNotEquals:
    - key: example
      value: example
  protectedResourceType: example
  providerRef:
    name: example-backuprestoretestingselection
    region: us-east-1
  restoreMetadataOverrides:
    key: value
  restoreTestingPlanName: example-backuprestoretestingselection
  restoreTestingSelectionName: example-backuprestoretestingselection
  validationWindowHours: 1

Spec

Field	Type	Required	Description
`iamRoleArn`	string	yes
`protectedResourceArns`	array<string>	—
`protectedResourceConditions`	object	—	BackupRestoreTestingSelectionProtectedResourceConditions is a nested property type of AWS::Backup::RestoreTestingSelection.
`protectedResourceConditions.stringEquals`	array<object>	—
`protectedResourceConditions.stringEquals[].key`	string	yes
`protectedResourceConditions.stringEquals[].value`	string	yes
`protectedResourceConditions.stringNotEquals`	array<object>	—
`protectedResourceConditions.stringNotEquals[].key`	string	yes
`protectedResourceConditions.stringNotEquals[].value`	string	yes
`protectedResourceType`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`restoreMetadataOverrides`	map<string>	—
`restoreTestingPlanName`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`restoreTestingSelectionName`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`validationWindowHours`	integer	—

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

BackupSelection # GA

BackupSelection is the Schema for managing AWS Backup selections.

kubectl get backupselections · example on GitHub

Example

# BackupSelection — Backup
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/backup.html#backupselection
apiVersion: aws.konfig.io/v1alpha1
kind: BackupSelection
metadata:
  name: example-backupselection
  namespace: default
spec:
  iamRoleArn: arn:aws:iam::123456789012:role/example-role
  iamRoleRef:
    name: example-iamrole
  listOfTags:
  - key: example
    value: example
  planRef: example
  providerRef:
    name: example-backupselection
    region: us-east-1
  resources:
  - example
  selectionName: example-backupselection

Spec

Field	Type	Required	Description
`iamRoleArn`	string	—	IAMRoleARN is the IAM role ARN Backup uses to authenticate when backing up resources.
`iamRoleRef`	object	—	IAMRoleRef references an IAMRole CR whose ARN to use.
`iamRoleRef.arn`	string	—	ARN is a direct AWS IAM role ARN.
`iamRoleRef.name`	string	—	Name of an IAMRole CR in the same namespace.
`iamRoleRef.namespace`	string	—	Namespace of the IAMRole CR.
`listOfTags`	array<object>	—	ListOfTags assigns resources matching any of these StringEquals tag conditions (OR logic).
`listOfTags[].key`	string	yes	Key is the tag key.
`listOfTags[].value`	string	yes	Value is the tag value.
`planRef`	string	yes	PlanRef is the name of a BackupPlan CR in the same namespace.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resources`	array<string>	—	Resources are ARNs of resources to assign to the backup plan.
`selectionName`	string	yes	SelectionName is the display name of the resource selection.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`planId`	string	—	PlanID is the backup plan the selection is attached to.
`selectionId`	string	—	SelectionID uniquely identifies the backup selection.

BackupTieringConfiguration # CLOUD CONTROL · AWS::Backup::TieringConfiguration

BackupTieringConfiguration manages AWS::Backup::TieringConfiguration through the AWS Cloud Control API.

kubectl get backuptieringconfigurations · example on GitHub

Example

# BackupTieringConfiguration — Backup
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/backup.html#backuptieringconfiguration
apiVersion: aws.konfig.io/v1alpha1
kind: BackupTieringConfiguration
metadata:
  name: example-backuptieringconfiguration
  namespace: default
spec:
  backupVaultName: example-backuptieringconfiguration
  providerRef:
    name: example-backuptieringconfiguration
    region: us-east-1
  resourceSelection:
  - resourceType: example
    resources:
    - example
    tieringDownSettingsInDays: 7
  tieringConfigurationName: example-backuptieringconfiguration
  tieringConfigurationTags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`backupVaultName`	string	yes
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourceSelection`	array<object>	yes
`resourceSelection[].resourceType`	string	yes
`resourceSelection[].resources`	array<string>	yes
`resourceSelection[].tieringDownSettingsInDays`	integer	yes
`tieringConfigurationName`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`tieringConfigurationTags`	map<string>	—

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedTime`	string	—	Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`tieringConfigurationArn`	string	—	Read-only: reported by AWS after creation.

BackupVault # GA

BackupVault is the Schema for managing AWS Backup vaults.

kubectl get backupvaults · example on GitHub

Example

# BackupVault — Backup
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/backup.html#backupvault
apiVersion: aws.konfig.io/v1alpha1
kind: BackupVault
metadata:
  name: example-backupvault
  namespace: default
spec:
  kmsKeyArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-backupvault
    region: us-east-1
  tags:
    environment: dev
    team: platform
  vaultName: example-backupvault

Spec

Field	Type	Required	Description
`kmsKeyArn`	string	—	KMSKeyARN is the server-side encryption key used to protect backups.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply to the vault.
`vaultName`	string	yes	VaultName is the name of the backup vault.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`vaultArn`	string	—	VaultARN is the ARN of the backup vault.