## Overview

This template uses the AWS Backup API calls to list and retrieve metrics.
For more information, please refer to the [AWS Backup API](https://docs.aws.amazon.com/aws-backup/latest/devguide/api-reference.html) page.

Additional information about metrics and API methods used in the template:
* [Metrics related to a Backup vault](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BackupVaultListMember.html)
* [Metrics related to a Backup job](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BackupJob.html)


## Setup

The template gets AWS Backup vault metrics and uses the script item to make HTTP requests to the AWS Backup API.

Before using the template, you need to create an IAM policy with the necessary permissions for the Zabbix role in your AWS account.

### Required Permissions
Add the following required permissions to your Zabbix IAM policy in order to collect AWS Backup vaults and jobs.

```json
{
    "Version":"2012-10-17",
    "Statement":[
        {
            "Action":[
                "backup:ListBackupVaults",
                "backup:ListBackupJobs",
                "backup:ListCopyJobs",
                "backup:ListRestoreJobs"
            ],
            "Effect":"Allow",
            "Resource":"*"
        }
    ]
    }
```

### Access Key Authorization
If you are using access key authorization, you need to generate an access key and secret key for an IAM user with the necessary permissions:

1. Create an IAM user with programmatic access.
2. Attach the required policy to the IAM user.
3. Generate an access key and secret key.
4. Use the generated credentials in the macros `{$AWS.ACCESS.KEY.ID}` and `{$AWS.SECRET.ACCESS.KEY}`.

### Assume Role Authorization
For using assume role authorization, add the appropriate permissions to the role you are using:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::{Account}:user/{UserName}"
        },
        {
            "Effect": "Allow",
            "Action": [
                "backup:ListBackupVaults",
                "backup:ListBackupJobs",
                "backup:ListCopyJobs",
                "backup:ListRestoreJobs"
            ],
            "Resource": "*"
        }
    ]
}
```

#### Trust Relationships for Assume Role Authorization
Next, add a principal to the trust relationships of the role you are using:

```json
{
    "Version": "2012-10-17",
    "Statement": [
    {
        "Effect": "Allow",
        "Principal": {
        "AWS": "arn:aws:iam::{Account}:user/{UserName}"
        },
        "Action": "sts:AssumeRole"
    }
    ]
}
```
Set the following macros: `{$AWS.ACCESS.KEY.ID}`, `{$AWS.SECRET.ACCESS.KEY}`, `{$AWS.STS.REGION}`, `{$AWS.ASSUME.ROLE.ARN}`.

### Role-Based Authorization
If you are using role-based authorization, set the appropriate permissions:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::<<--account-id-->>:role/<<--role_name-->>"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "backup:ListBackupVaults",
                "backup:ListBackupJobs",
                "backup:ListCopyJobs",
                "backup:ListRestoreJobs"
            ],
            "Resource": "*"
        }
    ]
}
```

#### Trust Relationships for Role-Based Authorization
Next, add a principal to the trust relationships of the role you are using:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "backup.amazonaws.com"
                ]
            },
            "Action": [
                "sts:AssumeRole"
            ]
        }
    ]
}
```

**Note**: Using role-based authorization is only possible when you use a Zabbix server or proxy inside AWS.

Set the macros: `{$AWS.AUTH_TYPE}`, `{$AWS.REGION}`, and `{$AWS.BACKUP_VAULT.NAME}`.

For more information about managing access keys, see the [official AWS documentation](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys).

See the section below for a list of macros used for LLD filters.