Disaster recovery and backup

#!/bin/bash
# Schedule via cron: 0 */6 * * * /path/to/backup-state.sh

BACKUP_DIR="/secure/terraform-backups/m365"
DATE=$(date +%Y%m%d-%H%M%S)

# Pull current state
terraform state pull > "${BACKUP_DIR}/terraform-${DATE}.tfstate"

# Compress and encrypt
tar -czf - "${BACKUP_DIR}/terraform-${DATE}.tfstate" | \
  gpg --encrypt --recipient [email protected] > \
  "${BACKUP_DIR}/terraform-${DATE}.tfstate.tar.gz.gpg"

# Remove unencrypted backup
rm "${BACKUP_DIR}/terraform-${DATE}.tfstate"

# Retain last 30 days of backups
find "${BACKUP_DIR}" -name "terraform-*.tfstate.tar.gz.gpg" -mtime +30 -delete

echo "State backup completed: ${DATE}"

# Terraform state files (use remote backend instead)
*.tfstate
*.tfstate.*
terraform.tfstate.backup

# Sensitive variable files
*.tfvars
!terraform.tfvars.example
secrets.auto.tfvars

# Terraform directories
.terraform/
.terraform.lock.hcl

# Crash logs
crash.log
crash.*.log

# Override files
override.tf
override.tf.json
*_override.tf
*_override.tf.json

# CLI configuration files
.terraformrc
terraform.rc

# Environment files
.env
.env.local

name: Backup Terraform State

on:
  schedule:
    - cron: '0 */6 * * *'  # Every 6 hours
  workflow_dispatch:  # Manual trigger

jobs:
  backup:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.14.0
      
      - name: Pull current state
        run: terraform state pull > terraform-$(date +%Y%m%d-%H%M%S).tfstate
        env:
          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          ARM_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      
      - name: Upload to artifact storage
        uses: actions/upload-artifact@v4
        with:
          name: terraform-state-backup-${{ github.run_number }}
          path: terraform-*.tfstate
          retention-days: 90
      
      - name: Upload to secondary storage
        run: |
          # Upload to S3, Azure Blob, etc.
          az storage blob upload \
            --account-name backupstorage \
            --container-name terraform-backups \
            --name m365/terraform-$(date +%Y%m%d-%H%M%S).tfstate \
            --file terraform-*.tfstate

name: Detect Configuration Drift

on:
  schedule:
    - cron: '0 8 * * *'  # Daily at 8 AM UTC
  workflow_dispatch:

jobs:
  detect-drift:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - uses: hashicorp/setup-terraform@v3
      
      - name: Terraform Init
        run: terraform init
      
      - name: Detect Drift
        id: plan
        run: |
          terraform plan -detailed-exitcode -parallelism=1 > plan_output.txt
          echo "exit_code=$?" >> $GITHUB_OUTPUT
        continue-on-error: true
      
      - name: Post drift alert
        if: steps.plan.outputs.exit_code == '2'
        run: |
          # Send alert to Slack, Teams, email, etc.
          curl -X POST ${{ secrets.SLACK_WEBHOOK }} \
            -H 'Content-Type: application/json' \
            -d '{"text":"Configuration drift detected in M365 Terraform!"}'
      
      - name: Upload drift report
        if: steps.plan.outputs.exit_code == '2'
        uses: actions/upload-artifact@v4
        with:
          name: drift-report-${{ github.run_number }}
          path: plan_output.txt