> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Fsx resources protected by backup plan remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of FSx not having a backup plan for AWS EC2 using the AWS Management Console, follow these steps:

        1. **Sign in to the AWS Management Console**: Go to [https://aws.amazon.com/](https://aws.amazon.com/) and sign in to the AWS Management Console using your credentials.

        2. **Navigate to Amazon FSx service**: Click on the "Services" dropdown menu at the top of the console, then select "FSx" under the "Storage" category.

        3. **Select the FSx file system**: In the FSx console, select the FSx file system that you want to create a backup plan for by clicking on its name.

        4. **Create a Backup Plan**:
           * In the left-hand navigation pane, click on "Backup" and then click on the "Backup plans" tab.
           * Click on the "Create backup plan" button.
           * Enter a name for the backup plan and configure the backup settings according to your requirements. This includes defining the backup frequency, retention period, and any lifecycle policies.
           * Review the backup plan settings and click on the "Create" button to create the backup plan.

        5. **Assign the Backup Plan to the FSx file system**:
           * After creating the backup plan, go back to the FSx file system details page.
           * Click on the "Backup" tab and then click on the "Associate backup plan" button.
           * Select the backup plan that you just created from the dropdown menu and click on the "Associate" button to assign the backup plan to the FSx file system.

        6. **Verify Backup Plan**:
           * Once the backup plan is associated with the FSx file system, verify that the backup plan is active and running as expected.
           * Monitor the backup status and ensure that backups are being taken according to the defined schedule.

        By following these steps, you will successfully remediate the misconfiguration of FSx not having a backup plan for your AWS EC2 instances using the AWS Management Console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of not having a backup plan for FSx on AWS EC2 using AWS CLI, you can follow these steps:

        1. **Install and Configure AWS CLI:**
           If you haven't already installed and configured the AWS CLI, you can do so by following the instructions provided in the AWS documentation: [Installing the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html) and [Configuring the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html).

        2. **Enable Backup for FSx File Systems:**
           You can enable backup for your FSx file systems using the AWS CLI by running the following command:
           ```
           aws fsx update-file-system --file-system-id fs-1234567890abcdef0 --backup-id backup-0abcdef1234567890 --windows-configuration AutomaticBackupRetentionDays=30,ThroughputCapacity=8
           ```
           Replace `fs-1234567890abcdef0` with the ID of your FSx file system and `backup-0abcdef1234567890` with the ID of the backup you want to associate with the file system. You can adjust the `AutomaticBackupRetentionDays` and `ThroughputCapacity` values as needed.

        3. **Verify Backup Configuration:**
           To ensure that backup has been successfully enabled for your FSx file system, you can run the following command:
           ```
           aws fsx describe-file-systems --file-system-ids fs-1234567890abcdef0
           ```
           This command will provide detailed information about your FSx file system, including its backup configuration.

        4. **Automate Backup Scheduling (Optional):**
           If you want to automate the scheduling of backups for your FSx file system, you can create a backup policy using the AWS CLI. Here is an example command to create a backup policy:
           ```
           aws fsx create-backup-policy --file-system-id fs-1234567890abcdef0 --daily-backup-start-time 01:00:00 --automatic-backup-retention-days 30
           ```
           This command will create a backup policy for the specified file system that triggers a daily backup at 01:00:00 UTC and retains the backups for 30 days.

        By following these steps, you can remediate the misconfiguration of not having a backup plan for FSx on AWS EC2 using the AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of not having a backup plan for FSx in AWS, you can create a backup plan using Python Boto3 library. Here are the step-by-step instructions to remediate this issue:

        1. Install Boto3 library:
           ```bash theme={null}
           pip install boto3
           ```

        2. Configure AWS credentials:
           Ensure that you have configured your AWS credentials either by setting environment variables or using AWS CLI `aws configure` command.

        3. Use the following Python script to create a backup plan for FSx in AWS EC2:

        ```python theme={null}
        import boto3

        def remediate_efs_resources_backup_plan(file_system_arns, backup_vault_name):
            # Initialize AWS Backup client
            backup_client = boto3.client('backup')

            # Create a backup plan for the specified EFS file systems
            response = backup_client.create_backup_plan(
                BackupPlan={
                    'BackupPlanName': 'YourBackupPlanName',
                    'BackupPlanRule': {
                        'RuleName': 'DefaultRule',
                        'TargetBackupVaultName': backup_vault_name,
                        'ScheduleExpression': 'cron(0 0 * * ? *)',  # Example: Daily backup at midnight
                        'StartWindowMinutes': 60,
                        'CompletionWindowMinutes': 60,
                    },
                    'AdvancedBackupSettings': [
                        {
                            'BackupOptions': {
                                'WindowsVSS': False,
                                'BackupMode': 'FULL',
                                'FileSystemLifecycle': 'SYSTEM'
                            },
                            'ResourceType': 'EFS'
                        }
                    ]
                }
            )

            print("Backup plan created successfully.")

        def main():
            # Specify the ARNs of the EFS file systems to protect
            file_system_arns = ['your-file-system-arn1', 'your-file-system-arn2']

            # Specify the name of the backup vault
            backup_vault_name = 'your-backup-vault-name'

            # Remediate EFS resources by creating a backup plan
            remediate_efs_resources_backup_plan(file_system_arns, backup_vault_name)

        if __name__ == "__main__":
            main()
        ```

        Replace `'your-file-system-arn1', 'your-file-system-arn2'` with the ARNs of the EFS file systems you want to protect, and `'your-backup-vault-name'` with the name of the backup vault where backups will be stored. This script creates a backup plan for the specified EFS file systems, ensuring they are protected by backups according to the specified schedule and retention policy. Adjust the backup plan settings as needed.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Existing FSx filesystem (example – already managed in your Terraform)
        resource "aws_fsx_lustre_file_system" "FSX_FILESYSTEM" {
          storage_capacity        = 1200
          subnet_ids              = [aws_subnet.FSX_SUBNET.id]
          deployment_type         = "PERSISTENT_1"
          per_unit_storage_throughput = 50
          # ...other required arguments...
        }

        # IAM role that AWS Backup can assume (must have FSx backup permissions)
        resource "aws_iam_role" "BACKUP_SERVICE_ROLE" {
          name = "backup-service-role"

          assume_role_policy = jsonencode({
            Version = "2012-10-17"
            Statement = [
              {
                Effect = "Allow"
                Principal = {
                  Service = "backup.amazonaws.com"
                }
                Action = "sts:AssumeRole"
              }
            ]
          })
        }

        # Attach AWS managed policy commonly used for FSx backups
        resource "aws_iam_role_policy_attachment" "BACKUP_SERVICE_ROLE_POLICY" {
          role       = aws_iam_role.BACKUP_SERVICE_ROLE.name
          policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
        }

        # Existing or new AWS Backup plan
        resource "aws_backup_plan" "FSX_BACKUP_PLAN" {
          name = "fsx-backup-plan"

          rule {
            rule_name         = "fsx-daily-backup"
            target_vault_name = aws_backup_vault.FSX_BACKUP_VAULT.name
            schedule          = "cron(0 5 * * ? *)"
            lifecycle {
              delete_after = 30
            }
          }
        }

        resource "aws_backup_vault" "FSX_BACKUP_VAULT" {
          name = "fsx-backup-vault"
        }

        # This is the Terraform equivalent of:
        # aws backup create-backup-selection --backup-plan-id ... --backup-selection ...
        resource "aws_backup_selection" "FSX_FILESYSTEM_SELECTION" {
          name         = "fsx-${aws_fsx_lustre_file_system.FSX_FILESYSTEM.id}-selection"
          plan_id      = aws_backup_plan.FSX_BACKUP_PLAN.id
          iam_role_arn = aws_iam_role.BACKUP_SERVICE_ROLE.arn

          resources = [
            aws_fsx_lustre_file_system.FSX_FILESYSTEM.arn,
          ]
        }
        ```

        Substitute:

        * `FSX_FILESYSTEM` with your FSx filesystem resource name.
        * `FSX_SUBNET` with the subnet resource that hosts FSx.
        * `BACKUP_SERVICE_ROLE`, `FSX_BACKUP_PLAN`, `FSX_BACKUP_VAULT` names as desired.

        This change does not replace the FSx filesystem; it only creates/updates backup-related resources.

        Verification with `terraform plan` should show:

        * `aws_backup_selection.FSX_FILESYSTEM_SELECTION` being created (and, if you added them, the IAM role, policy attachment, backup vault, and backup plan).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>