ddb-backup-cf.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Sschedule DynamoDB table backup using Lambda",
	"Parameters": {
		"BucketName":{
			"Type": "String",
			"Description": "Enter bucket name"
			},
		"FileName":{
			"Type": "String",
			"Description": "Enter file name"
    },
    "DDBTableName":{
      "Type": "String",
      "Description": "Enter DynamoDB Table name to enable backup"
    },
    "BackupRetention": {
      "Type": "Number",
      "Description": "Days keep the backup"
    }
	},
  "Metadata" : {
     "AWS::CloudFormation::Interface" : {
      "ParameterGroups" : [
        {
          "Label" : { "default" : "Lambda Function" },
          "Parameters" : [ "BucketName", "FileName" ]
        },
        {
          "Label" : { "default":"Target DynamoDB table to backup" },
          "Parameters" : [ "DDBTableName", "BackupRetention" ]
        }
      ]
     }
  },
  "Resources": {
        "LambdaServiceExecutionRole": {
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Statement": [
                        {
                            "Action": [
                                "sts:AssumeRole"
                            ],
                            "Effect": "Allow",
                            "Principal": {
                                "Service": [
                                    "lambda.amazonaws.com"
                                ]
                            }
                        }
                    ],
                    "Version": "2012-10-17"
                },
                "Path": "/"
            },
            "Type": "AWS::IAM::Role"
        },
        "LambdaServiceExecutionRolePolicy":{
           "Type": "AWS::IAM::Policy",
           "Properties": {
              "PolicyName": "DDBBackupLambdaRolePolicy",
              "PolicyDocument": {
                  "Version": "2012-10-17",
                  "Statement": [{
                      "Effect": "Allow",
                      "Action": ["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],
                      "Resource": {
                        "Fn::Join": [
                          "",
                          [
                            "arn:aws:logs:",
                            {"Ref": "AWS::Region"},
                            ":",
                            {"Ref": "AWS::AccountId"},
                            ":",
                            "log-group:",
                            "/aws/lambda/",
                            {"Ref": "DDBBackup"},
                            ":*"
                          ]
                        ]
                      }
                  },
                  {
                      "Effect": "Allow",
                      "Action": [ "dynamodb:CreateBackup" ],
                      "Resource": [{
                        "Fn::Join": [
                          "",
                          [
                            "arn:aws:dynamodb:",
                            {"Ref": "AWS::Region"},
                            ":",
                            {"Ref": "AWS::AccountId"},
                            ":",
                            "table/",
                            {"Ref": "DDBTableName"}
                          ]
                        ]
                      }
                    ]
                  },
                  {
                      "Effect": "Allow",
                      "Action": [ "dynamodb:ListBackups", "dynamodb:DeleteBackup" ],
                      "Resource": "*"
                  }]
              },
              "Roles": [ { "Ref": "LambdaServiceExecutionRole" } ]
           }
        },
        "ScheduledEvent": {
            "Properties": {
                "Description": "CloudWatch event to trigger lambda SG function",
                "ScheduleExpression": "rate(1 day)",
                "State": "ENABLED",
                "Targets": [
                    {
                        "Arn": { "Fn::GetAtt" : ["DDBBackup", "Arn"] },
                        "Id": "DDBTarget"
                    }
                ]
            },
            "Type": "AWS::Events::Rule"
        },
        "LambdaInvokePermission": {
          "Type": "AWS::Lambda::Permission",
          "Properties": {
            "FunctionName" : { "Fn::GetAtt" : ["DDBBackup", "Arn"] },
            "Action": "lambda:InvokeFunction",
            "Principal": "events.amazonaws.com",
            "SourceArn" : { "Fn::GetAtt" : ["ScheduledEvent", "Arn"] }
          }
        },
        "DDBBackup": {
            "Properties": {
                "Code": {
                    "S3Bucket": {"Ref": "BucketName"},
                    "S3Key": {"Ref": "FileName"}

                },
                "Handler": "ddbbackup.lambda_handler",
                "MemorySize": 128,
                "Role": {
                    "Fn::GetAtt": [
                        "LambdaServiceExecutionRole",
                        "Arn"
                    ]
                },
                "Runtime": "python3.6",
                "Timeout": 300,
                "Environment": {
                  "Variables": {
                    "DDBTable": { "Ref": "DDBTableName"},
                    "BackupRetention": { "Ref": "BackupRetention"}
                  }
                }
            },
            "Type": "AWS::Lambda::Function"
        }
  }
}