fix(aws-backup): added aws-region for lambda

modules/aws-backup/README.md

@@ -211,6 +211,7 @@ The module is organized with the following directory and file structure:
 | <a name="input_copy_action_default_values"></a> [copy\_action\_default\_values](#input\_copy\_action\_default\_values) | Default values for the copy action configuration in backup plan rules. If not provided, the copy action will not be created. | <pre>object({<br/>    destination_account_id = string<br/>    destination_region     = string<br/>    delete_after           = number<br/>  })</pre> | <pre>{<br/>  "delete_after": 14,<br/>  "destination_account_id": null,<br/>  "destination_region": null<br/>}</pre> | no |
 | <a name="input_enable_cross_account_backup"></a> [enable\_cross\_account\_backup](#input\_enable\_cross\_account\_backup) | Enable cross-account backup in AWS Backup global settings. If set to true, the module will manage the global settings resource to enable cross-account backup. If set to false, you can configure it separately if needed. | `bool` | `false` | no |
 | <a name="input_lambda_memory"></a> [lambda\_memory](#input\_lambda\_memory) | Lambda memory in MB | `number` | `128` | no |
+| <a name="input_lambda_region"></a> [lambda\_region](#input\_lambda\_region) | Region where the Lambda function for automatic replication will be deployed. If not provided, it will be deployed in the same region as the backup vault. | `string` | `null` | no |
 | <a name="input_lambda_timeout"></a> [lambda\_timeout](#input\_lambda\_timeout) | Lambda timeout in seconds | `number` | `600` | no |
 | <a name="input_source_account_id"></a> [source\_account\_id](#input\_source\_account\_id) | Account id that copies backups into this vault | `string` | `null` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | Default tags to apply to all resources. | `map(string)` | `{}` | no |

modules/aws-backup/eventbridge.tf

@@ -5,7 +5,7 @@ resource "aws_cloudwatch_event_rule" "rds_backup_job_completed" {
   count       = local.has_cross_account_copy ? 1 : 0
   name        = "backup-job-completed"
   description = "Capture AWS backup point state change"
-
+  region      = var.lambda_region
   event_pattern = jsonencode({
     "source" : ["aws.backup"],
     "detail-type" : ["Recovery Point State Change"],
@@ -19,14 +19,16 @@ resource "aws_cloudwatch_event_rule" "rds_backup_job_completed" {
 }
 
 resource "aws_cloudwatch_event_target" "invoke_lambda" {
-  count = local.has_cross_account_copy ? 1 : 0
-  rule  = aws_cloudwatch_event_rule.rds_backup_job_completed[0].name
-  arn   = module.lambda_automatic_replication[0].lambda_function_arn
+  count  = local.has_cross_account_copy ? 1 : 0
+  region = var.lambda_region
+  rule   = aws_cloudwatch_event_rule.rds_backup_job_completed[0].name
+  arn    = module.lambda_automatic_replication[0].lambda_function_arn
   # Optional: configure retry policy or input transformer if needed
 }
 
 resource "aws_lambda_permission" "allow_eventbridge" {
   count         = local.has_cross_account_copy ? 1 : 0
+  region        = var.lambda_region
   statement_id  = "AllowExecutionFromEventBridge"
   action        = "lambda:InvokeFunction"
   function_name = module.lambda_automatic_replication[0].lambda_function_name

modules/aws-backup/lambda.tf

@@ -42,7 +42,7 @@ module "lambda_automatic_replication" {
   function_name = "backups-automatic-replication"
   handler       = "handler.lambda_handler"
   runtime       = "python3.14"
-  region        = "eu-west-1"
+  region        = var.lambda_region
   source_path   = ["${path.module}/src/common"]
 
   timeout     = var.lambda_timeout

modules/aws-backup/variables.tf

@@ -116,4 +116,11 @@ variable "lambda_memory" {
   description = "Lambda memory in MB"
   type        = number
   default     = 128
+}
+
+variable "lambda_region" {
+  description = "Region where the Lambda function for automatic replication will be deployed. If not provided, it will be deployed in the same region as the backup vault."
+  type        = string
+  default     = null
+
 }