"
+}
diff --git a/modules/terraform-aws-cml-permissions/examples/ex01-minimal-inputs/variables.tf b/modules/terraform-aws-cml-permissions/examples/ex01-minimal-inputs/variables.tf
new file mode 100644
index 0000000..f9868b8
--- /dev/null
+++ b/modules/terraform-aws-cml-permissions/examples/ex01-minimal-inputs/variables.tf
@@ -0,0 +1,31 @@
+# Copyright 2025 Cloudera, Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# ------- Global settings -------
+variable "aws_region" {
+ type = string
+ description = "Region which Cloud resources will be created"
+}
+
+variable "env_prefix" {
+ type = string
+ description = "Shorthand name for the environment. Used in resource descriptions"
+}
+
+variable "tags" {
+ type = map(any)
+ description = "Tags applied to provised resources"
+
+ default = null
+}
diff --git a/modules/terraform-aws-cml-permissions/main.tf b/modules/terraform-aws-cml-permissions/main.tf
new file mode 100644
index 0000000..bd6c519
--- /dev/null
+++ b/modules/terraform-aws-cml-permissions/main.tf
@@ -0,0 +1,44 @@
+# Copyright 2025 Cloudera, Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# ------- Cross Account Policy -------
+resource "aws_iam_policy" "cml_backup_policy" {
+ name = var.cml_backup_policy_name
+ description = "CDP CML Workspace Backup policy"
+
+ tags = merge(var.tags, { Name = var.cml_backup_policy_name })
+
+ policy = local.cml_backup_policy_doc
+}
+
+resource "aws_iam_policy" "cml_restore_policy" {
+ name = var.cml_restore_policy_name
+ description = "CDP CML Workspace Restore policy"
+
+ tags = merge(var.tags, { Name = var.cml_restore_policy_name })
+
+ policy = local.cml_restore_policy_doc
+}
+
+# Attach CML backup policy to the xaccount role
+resource "aws_iam_role_policy_attachment" "cdp_xaccount_role_cml_backup_attach" {
+ role = data.aws_iam_role.xaccount_role.name
+ policy_arn = aws_iam_policy.cml_backup_policy.arn
+}
+
+# Attach CML restore policy to the xaccount role
+resource "aws_iam_role_policy_attachment" "cdp_xaccount_role_cml_restore_attach" {
+ role = data.aws_iam_role.xaccount_role.name
+ policy_arn = aws_iam_policy.cml_restore_policy.arn
+}
\ No newline at end of file
diff --git a/modules/terraform-aws-cml-permissions/outputs.tf b/modules/terraform-aws-cml-permissions/outputs.tf
new file mode 100644
index 0000000..921adb1
--- /dev/null
+++ b/modules/terraform-aws-cml-permissions/outputs.tf
@@ -0,0 +1,25 @@
+# Copyright 2025 Cloudera, Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+output "aws_cml_backup_policy_arn" {
+ value = aws_iam_policy.cml_backup_policy.arn
+
+ description = "CML Backup IAM Policy ARN"
+}
+
+output "aws_cml_restore_policy_arn" {
+ value = aws_iam_policy.cml_restore_policy.arn
+
+ description = "CML Restore IAM Policy ARN"
+}
diff --git a/modules/terraform-aws-cml-permissions/provider.tf b/modules/terraform-aws-cml-permissions/provider.tf
new file mode 100644
index 0000000..bc9290c
--- /dev/null
+++ b/modules/terraform-aws-cml-permissions/provider.tf
@@ -0,0 +1,28 @@
+# Copyright 2023 Cloudera, Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+terraform {
+ required_providers {
+ aws = {
+ source = "hashicorp/aws"
+ version = "~>5.30"
+ }
+ http = {
+ source = "hashicorp/http"
+ version = ">= 3.2.1"
+ }
+ }
+
+ required_version = ">= 1.3.0"
+}
\ No newline at end of file
diff --git a/modules/terraform-aws-cml-permissions/variables.tf b/modules/terraform-aws-cml-permissions/variables.tf
new file mode 100644
index 0000000..51f877b
--- /dev/null
+++ b/modules/terraform-aws-cml-permissions/variables.tf
@@ -0,0 +1,68 @@
+# Copyright 2025 Cloudera, Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# ------- Global settings -------
+variable "tags" {
+ type = map(any)
+ description = "Tags applied to provised resources"
+
+ default = null
+}
+
+# ------- IAM Policy details -------
+variable "cml_backup_policy_name" {
+ type = string
+
+ description = "CDP CML Backup Policy name"
+
+ validation {
+ condition = length(var.cml_backup_policy_name) <= 128
+ error_message = "The length of cml_backup_policy_name must be 128 characters or less."
+ }
+}
+
+variable "cml_restore_policy_name" {
+ type = string
+
+ description = "CDP CML Restore Policy name"
+
+ validation {
+ condition = length(var.cml_restore_policy_name) <= 128
+ error_message = "The length of cml_restore_policy_name must be 128 characters or less."
+ }
+
+}
+
+variable "cml_backup_policy_doc" {
+ type = string
+
+ description = "Contents of CDP CML Backup Policy Document. If not specified document is downloaded from Cloudera Document repository"
+
+ default = null
+}
+
+variable "cml_restore_policy_doc" {
+ type = string
+
+ description = "Contents of CDP CML Restore Policy Document. If not specified document is downloaded from Cloudera Document repository"
+
+ default = null
+}
+
+# ------- Cross Account Roles -------
+variable "xaccount_role_name" {
+ type = string
+ description = "Name of existing cross account Assume role Name."
+
+}
diff --git a/modules/terraform-aws-cred-permissions/README.md b/modules/terraform-aws-cred-permissions/README.md
index 7ab2859..1af18ab 100644
--- a/modules/terraform-aws-cred-permissions/README.md
+++ b/modules/terraform-aws-cred-permissions/README.md
@@ -41,13 +41,16 @@ No modules.
| [aws_iam_role.cdp_xaccount_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
| [aws_iam_role_policy.cdp_xaccount_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
| [time_sleep.iam_propagation](https://registry.terraform.io/providers/hashicorp/time/0.9.1/docs/resources/sleep) | resource |
+| [aws_iam_policy_document.cdp_xaccount_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_iam_policy_document.cdp_xaccount_role_policy_doc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.cml_backup_assume_policy_doc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_iam_role.existing_xaccount_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_role) | data source |
## Inputs
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
+| [create\_cml\_assume\_role\_policy](#input\_create\_cml\_assume\_role\_policy) | Add AWS Backup Service, required for CML Backup and Restore, to Cross Account Trust Relationship. | `bool` | `false` | no |
| [existing\_xaccount\_role\_name](#input\_existing\_xaccount\_role\_name) | Name of existing CDP Cross Account Role. If set then no policy or role resources are created. | `string` | `null` | no |
| [tags](#input\_tags) | Tags applied to provised resources | `map(any)` | `null` | no |
| [xaccount\_account\_id](#input\_xaccount\_account\_id) | Account ID of the cross account. Required if xaccount resources are to be created. | `string` | `null` | no |
diff --git a/modules/terraform-aws-cred-permissions/examples/ex01-minimal-inputs/main.tf b/modules/terraform-aws-cred-permissions/examples/ex01-minimal-inputs/main.tf
index 579baa0..1f7360a 100644
--- a/modules/terraform-aws-cred-permissions/examples/ex01-minimal-inputs/main.tf
+++ b/modules/terraform-aws-cred-permissions/examples/ex01-minimal-inputs/main.tf
@@ -44,6 +44,8 @@ module "ex01_minimal_inputs" {
xaccount_role_name = "${var.env_prefix}-xaccount-role"
+ # Assume role trust relationship required for CML backup and restore
+ create_cml_assume_role_policy = true
}
# Use the CDP Terraform Provider to find the xaccount account and external ids
diff --git a/modules/terraform-aws-cred-permissions/main.tf b/modules/terraform-aws-cred-permissions/main.tf
index 9135751..f90b7f4 100644
--- a/modules/terraform-aws-cred-permissions/main.tf
+++ b/modules/terraform-aws-cred-permissions/main.tf
@@ -37,16 +37,42 @@ data "aws_iam_policy_document" "cdp_xaccount_role_policy_doc" {
}
}
}
+# Optional assume role policy document for the CML Backup and Restore
+data "aws_iam_policy_document" "cml_backup_assume_policy_doc" {
+
+ count = (local.create_xaccount_resources && var.create_cml_assume_role_policy) ? 1 : 0
+
+ version = "2012-10-17"
+
+ statement {
+ actions = ["sts:AssumeRole"]
+ effect = "Allow"
+
+ principals {
+ type = "Service"
+ identifiers = ["backup.amazonaws.com"]
+ }
+ }
+}
+
+data "aws_iam_policy_document" "cdp_xaccount_assume_role_policy" {
+ count = local.create_xaccount_resources ? 1 : 0
+
+ source_policy_documents = [
+ data.aws_iam_policy_document.cdp_xaccount_role_policy_doc[0].json,
+ try(data.aws_iam_policy_document.cml_backup_assume_policy_doc[0].json, "")
+ ]
+}
# Create the IAM role that uses the above assume_role_policy document
resource "aws_iam_role" "cdp_xaccount_role" {
count = local.create_xaccount_resources ? 1 : 0
- name = var.xaccount_role_name
- # description = "CDP Cross Account role for ${var.env_prefix}"
+ name = var.xaccount_role_name
+ description = "CDP Cross Account role"
- assume_role_policy = data.aws_iam_policy_document.cdp_xaccount_role_policy_doc[0].json
+ assume_role_policy = data.aws_iam_policy_document.cdp_xaccount_assume_role_policy[0].json
tags = merge(var.tags, { Name = var.xaccount_role_name })
}
diff --git a/modules/terraform-aws-cred-permissions/variables.tf b/modules/terraform-aws-cred-permissions/variables.tf
index e1bde9f..d733b4d 100644
--- a/modules/terraform-aws-cred-permissions/variables.tf
+++ b/modules/terraform-aws-cred-permissions/variables.tf
@@ -78,3 +78,13 @@ variable "existing_xaccount_role_name" {
default = null
}
+
+# ------- Assume role policy for CML Backup and Restore -------
+variable "create_cml_assume_role_policy" {
+ type = bool
+
+ description = "Add AWS Backup Service, required for CML Backup and Restore, to Cross Account Trust Relationship."
+
+ default = false
+}
+
diff --git a/modules/terraform-cdp-aws-pre-reqs/README.md b/modules/terraform-cdp-aws-pre-reqs/README.md
index 09bb789..b47bf9e 100644
--- a/modules/terraform-cdp-aws-pre-reqs/README.md
+++ b/modules/terraform-cdp-aws-pre-reqs/README.md
@@ -21,16 +21,15 @@ In each directory an example `terraform.tfvars.sample` values file is included t
|------|---------|
| [terraform](#requirement\_terraform) | >= 1.3.0 |
| [aws](#requirement\_aws) | >= 5.30 |
-| [http](#requirement\_http) | 3.2.1 |
-| [random](#requirement\_random) | 3.4.3 |
-| [time](#requirement\_time) | 0.9.1 |
+| [http](#requirement\_http) | ~> 3.2.1 |
+| [random](#requirement\_random) | ~> 3.4.3 |
## Providers
| Name | Version |
|------|---------|
| [aws](#provider\_aws) | >= 5.30 |
-| [random](#provider\_random) | 3.4.3 |
+| [random](#provider\_random) | ~> 3.4.3 |
## Modules
@@ -66,7 +65,7 @@ In each directory an example `terraform.tfvars.sample` values file is included t
| [aws_security_group_rule.cdp_knox_sg_ingress_self](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
| [aws_vpc_endpoint.gateway_endpoints](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
| [aws_vpc_endpoint.interface_endpoints](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
-| [random_id.bucket_suffix](https://registry.terraform.io/providers/hashicorp/random/3.4.3/docs/resources/id) | resource |
+| [random_id.bucket_suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
| [aws_vpc_endpoint_service.gateway_endpoints](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc_endpoint_service) | data source |
| [aws_vpc_endpoint_service.interface_endpoints](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc_endpoint_service) | data source |
@@ -135,6 +134,7 @@ In each directory an example `terraform.tfvars.sample` values file is included t
| [vpc\_public\_inbound\_acl\_rules](#input\_vpc\_public\_inbound\_acl\_rules) | Inbound network ACLs for Public subnets. Exposes default value of VPC module variable to allow for overriding. Only used when create\_vpc is true. | `list(map(string))` | [
{
"cidr_block": "0.0.0.0/0",
"from_port": 0,
"protocol": "-1",
"rule_action": "allow",
"rule_number": 100,
"to_port": 0
}
]
| no |
| [vpc\_public\_outbound\_acl\_rules](#input\_vpc\_public\_outbound\_acl\_rules) | Public subnets outbound network ACLs. Exposes default value of VPC module variable to allow for overriding. Only used when create\_vpc is true. | `list(map(string))` | [
{
"cidr_block": "0.0.0.0/0",
"from_port": 0,
"protocol": "-1",
"rule_action": "allow",
"rule_number": 100,
"to_port": 0
}
]
| no |
| [vpc\_public\_subnets\_map\_public\_ip\_on\_launch](#input\_vpc\_public\_subnets\_map\_public\_ip\_on\_launch) | Auto-assign public IP on launch for instances created in Public Subnets. Exposes default value of VPC module variable to allow for overriding. Only used when create\_vpc is true. | `bool` | `true` | no |
+| [xaccount\_cml\_backup\_assume\_role](#input\_xaccount\_cml\_backup\_assume\_role) | Add AWS Backup Service, required for CML Backup and Restore, to Cross Account Trust Relationship. | `bool` | `false` | no |
| [xaccount\_policy\_name](#input\_xaccount\_policy\_name) | Cross Account Policy name | `string` | `null` | no |
| [xaccount\_role\_name](#input\_xaccount\_role\_name) | Cross account Assume role Name | `string` | `null` | no |
diff --git a/modules/terraform-cdp-aws-pre-reqs/main.tf b/modules/terraform-cdp-aws-pre-reqs/main.tf
index 232afbb..4e841c0 100644
--- a/modules/terraform-cdp-aws-pre-reqs/main.tf
+++ b/modules/terraform-cdp-aws-pre-reqs/main.tf
@@ -343,8 +343,9 @@ module "aws_cdp_cred_permissions" {
xaccount_account_id = var.xaccount_account_id
xaccount_external_id = var.xaccount_external_id
- xaccount_policy_name = local.xaccount_policy_name
- xaccount_account_policy_doc = var.xaccount_account_policy_doc
+ xaccount_policy_name = local.xaccount_policy_name
+ xaccount_account_policy_doc = var.xaccount_account_policy_doc
+ create_cml_assume_role_policy = var.xaccount_cml_backup_assume_role
existing_xaccount_role_name = var.existing_xaccount_role_name
diff --git a/modules/terraform-cdp-aws-pre-reqs/variables.tf b/modules/terraform-cdp-aws-pre-reqs/variables.tf
index d614225..cc92561 100644
--- a/modules/terraform-cdp-aws-pre-reqs/variables.tf
+++ b/modules/terraform-cdp-aws-pre-reqs/variables.tf
@@ -433,6 +433,15 @@ variable "xaccount_account_policy_doc" {
}
+# Add extra assume role policy for CML Backup and Restore
+variable "xaccount_cml_backup_assume_role" {
+ type = bool
+
+ description = "Add AWS Backup Service, required for CML Backup and Restore, to Cross Account Trust Relationship."
+
+ default = false
+}
+
# CDP IDBroker Assume Role policy
variable "idbroker_policy_doc" {
type = string