SPINECORE-6443: add copy_target_arn_list which is a list of arns

modules/aws-backup-destination/README.md

@@ -16,6 +16,7 @@ The AWS Backup Module helps automates the setup of AWS Backup resources in a des
 | <a name="input_vault_lock_max_retention_days"></a> [vault\_lock\_max\_retention\_days](#input\_vault\_lock\_max\_retention\_days) | The maximum retention period that the vault retains its recovery points | `number` | `365` | no |
 | <a name="input_vault_lock_min_retention_days"></a> [vault\_lock\_min\_retention\_days](#input\_vault\_lock\_min\_retention\_days) | The minimum retention period that the vault retains its recovery points | `number` | `365` | no |
 | <a name="input_vault_lock_type"></a> [vault\_lock\_type](#input\_vault\_lock\_type) | The type of lock that the vault should be, will default to governance | `string` | `"governance"` | no |
+| <a name="input_copy_target_arn_list"></a> [copy\_target\_arn\_list](#input\_copy\_target\_arn\_list) | A list of target ARNs to which restore points are allowed to be copied | `list(string)` | `null` | no |
 
 ## Example
 

modules/aws-backup-destination/backup_vault_policy.tf

@@ -57,11 +57,9 @@ data "aws_iam_policy_document" "vault_policy" {
       ]
       resources = ["*"]
       condition {
-        test     = "StringNotEquals"
+        test     = "ArnNotEquals"
         variable = "backup:CopyTargets"
-        values = [
-          "arn:aws:backup:${var.region}:${var.source_account_id}:backup-vault:${var.region}-${var.source_account_id}-backup-vault"
-        ]
+        values   = local.copy_targets
       }
     }
   }

modules/aws-backup-destination/locals.tf

@@ -0,0 +1,6 @@
+locals {
+  copy_targets = coalescelist(
+    var.copy_target_arn_list,
+    ["arn:aws:backup:${var.region}:${var.source_account_id}:backup-vault:${var.region}-${var.source_account_id}-backup-vault"]
+  )
+}

modules/aws-backup-destination/variables.tf

@@ -65,3 +65,9 @@ variable "changeable_for_days" {
   type        = number
   default     = 14
 }
+
+variable "copy_target_arn_list" {
+  description = "A list of target ARNs to which restore points are allowed to be copied"
+  type        = list(string)
+  default     = null
+}