AWSTemplateFormatVersion: '2010-09-09'
Description: "DLM Default Policy for EBS Snapshot management"
Parameters:
  Description:
    Type: String
    Description: Policy description. Allowed characters are a-z, A-Z, 0-9, space, "-" (hyphen) and "_" (underscore)
    Default: "Default Policy for EBS Snapshot management - created by CloudFormation"
  CreateInterval:
    Type: Number
    Description: 'Number of days between consecutive backups. Min: 1, Max: 7. Must be less than or equal to RetainInterval.'
    Default: 1
    AllowedValues:
      - 1
      - 2
      - 3
      - 4
      - 5
      - 6
      - 7
  RetainInterval:
    Type: Number
    Description: 'Number of days to retain backups before deleting. Min: 2, Max: 14. Must be greater than or equal to CreateInterval.'
    Default: 7
    AllowedValues:
      - 2
      - 3
      - 4
      - 5
      - 6
      - 7
      - 8
      - 9
      - 10
      - 11
      - 12
      - 13
      - 14
  ExcludeVolumeTypes:
    Type: CommaDelimitedList
    Description: (optional) Volume types to exclude, such as 'io1', 'gp2', etc.
    Default: ""
  ExcludeBootVolumes:
    Type: String
    Description: (optional) Whether to skip creating snapshots of volumes that are attached as a root volume of any EC2 instance
    AllowedValues:
      - true
      - false
    Default: false
  CopyRegion1:
    Type: String
    Description: (optional) Region to copy snapshots to
    Default: ""
  CopyRegion2:
    Type: String
    Description: (optional) Region to copy snapshots to
    Default: ""
  CopyRegion3:
    Type: String
    Description: (optional) Region to copy snapshots to
    Default: ""
  CopyTags:
    Type: String
    Description: (optional) Whether to copy tags from the source volume to the snapshots created
    AllowedValues:
      - true
      - false
    Default: false
  ExtendDeletion:
    Type: String
    Description: (optional) Whether to continue deleting snapshots after the policy is errored/deleted/disabled, and delete the last snapshot of a given volume
    AllowedValues:
      - true
      - false
    Default: false
  State:
    Type: String
    Description: Specify whether to enable the policy immediately after creation or modification. If you do not enable the policy now, then it will not begin creating snapshots or AMIs until you manually set its activation status to enabled.
    AllowedValues:
      - 'ENABLED'
      - 'DISABLED'
    Default: 'ENABLED'

Conditions:
  # Determine whether lists are empty by joining their elements and checking
  # for equality with empty string
  HasExcludeVolumeTypes: !Not [!Equals [!Join ['', !Ref ExcludeVolumeTypes], '']]
  HasCopyRegion1: !Not [!Equals [!Ref CopyRegion1, '']]
  HasCopyRegion2: !Not [!Equals [!Ref CopyRegion2, '']]
  HasCopyRegion3: !Not [!Equals [!Ref CopyRegion3, '']]
    
Resources:
  DefaultSnapshotPolicy:
    Type: "AWS::DLM::LifecyclePolicy"
    Properties:
      DefaultPolicy: "VOLUME"
      PolicyDetails:
        PolicyLanguage: "SIMPLIFIED"
        PolicyType: "EBS_SNAPSHOT_MANAGEMENT"
        ResourceType: "VOLUME"
        CreateInterval: !Ref CreateInterval
        RetainInterval: !Ref RetainInterval
        CopyTags: !Ref CopyTags
        CrossRegionCopyTargets:
          - !If [HasCopyRegion1, TargetRegion: !Ref CopyRegion1, !Ref 'AWS::NoValue']
          - !If [HasCopyRegion2, TargetRegion: !Ref CopyRegion2, !Ref 'AWS::NoValue']
          - !If [HasCopyRegion3, TargetRegion: !Ref CopyRegion3, !Ref 'AWS::NoValue']
        Exclusions:
          # To exclude volumes with specific tags, uncomment the following block and add the tags to exclude
          # ExcludeTags:
          #   - Key: "exclude-key1"
          #     Value: "exclude-value1"
          #   - Key: "exclude-key2"
          #     Value: "exclude-value2"
          ExcludeVolumeTypes: !If [HasExcludeVolumeTypes, !Ref ExcludeVolumeTypes, !Ref 'AWS::NoValue']
          ExcludeBootVolumes: !Ref ExcludeBootVolumes
        ExtendDeletion: !Ref ExtendDeletion
      Description: !Ref Description
      State: !Ref State
      ExecutionRoleArn:
        Fn::GetAtt: [ExecutionRole, Arn]

  ExecutionRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: ['sts:AssumeRole']
            Effect: Allow
            Principal:
              Service: [dlm.amazonaws.com]
            Condition:
              StringEquals:
                "aws:SourceAccount": !Ref AWS::AccountId
              ArnLike:
                "aws:SourceArn": !Sub "arn:${AWS::Partition}:dlm:*:${AWS::AccountId}:policy/*"
        Version: '2012-10-17'
      ManagedPolicyArns: [{"Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSDataLifecycleManagerServiceRole"}]
    Type: AWS::IAM::Role
