A Backup Policy that Selects by Tag, Backs Up Daily and Copies to a Second Region
Backup for VPC: a policy that selects volumes (or instances) carrying the tags you name, a daily plan that keeps snapshots thirty days and copies the user tags across, and a copy of each snapshot to a second region with an encryption key of yours there; a single region is accepted by name. A policy with no plan backs up nothing; the plan is created here.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-15 · how we verify
Use it from the registry
terraform · opentofumodule "backup_policy" {
source = "www.iac-bazaar.com/iac-bazaar/ibm-backup-policy/ibmcloud"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
ibm-backup-policy
Backup for VPC: a policy that selects volumes by tag, a daily plan
with thirty days of retention, and a copy to a second region. Works
with Terraform and OpenTofu (>= 1.6), ibm provider
>= 1.60, < 3.0.
A policy selects by tag; the tag is the control.
A policy with no plan backs up nothing; the plan is here.
A second region is the resilience; one region by name.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
ibm-block-volume
VPC backup policies match volumes by user tag, so a volume created without the tag sits silently outside the policy; encryption is provider-managed unless a root key CRN is given; and an attachment can delete the volume with the instance. The policy created with its plan and the volume tagged with the tag it matches (none by name), your key when given, the volume kept on instance deletion.
ibm-cos-bucket
Versioning is off by default; encryption is IBM-managed unless a Key Protect root key is given; allowed_ip is an allow list nobody sets, so any address that authenticates reaches the bucket; and a WORM retention rule cannot be removed once set. Versioning on with off by name, your root key when given, allowed ranges taken, retention optional, incomplete uploads freed after a week.
ibm-file-share
An IBM Cloud VPC file share (NFS) wrapped with your Key Protect or HPCS key (provider-managed by name), with one mount target on a virtual network interface in your subnet behind the security groups you name, using user-managed transit encryption (plain NFS has to be accepted by name). One zone; a fleet in two mounts across or replicates.
gcp-backup-dr
The vault and the plan are what the console shows; the association is what makes a backup exist, and a plan associated with nothing backs up nothing. Enforced retention is the setting ransomware cannot undo - no backup younger than it can be deleted by anyone - and WITHIN_PROJECT access lets a compromised owner restore everything. Resources come with the plan; 14 days enforced; org-scoped.
huawei-cbr-backup
A Cloud Backup and Recovery policy that backs up nightly and keeps thirty days, bound to a server vault spread across zones (single-zone by name) that auto-expands rather than stopping when full (a fixed size by name), crash-consistent unless the CBR agent is on every server, with the servers in the map protected. Pay-per-use.
oci-backup-policy
A block volume backup policy that many volumes share: incremental daily backups kept thirty days and full weekly backups kept a year, each copied to a second region (one region by name) and encrypted there with a key of yours when given, deletion prevented until retention ends (deletable by name), and every volume in the map assigned, because a policy with no assignment backs up nothing.