feat: Backup Compliance Policy CloudFormation Resource

[sivaram-mongodb]

Proposed changes

Added new resource Backup Compliance Policy:

• Manages MongoDB Atlas Backup Compliance Policy at the project level
• Prevents unauthorized modifications or deletions of cluster settings, backups, and backup configurations
• Enforces compliance requirements as minimum policy for all clusters and backups in the project
• Supports scheduled backup policies (hourly, daily, weekly, monthly, yearly) with configurable retention
• Supports on-demand backup policy items for flexible backup scheduling
• Implements copy protection to prevent snapshot deletion until retention period expires
• Enforces encryption at rest using Customer Key Management (CKM) for all clusters
• Enables point-in-time recovery with Continuous Cloud Backup configuration
• Features asynchronous state management with callback-based polling for policy activation
• Full lifecycle management with create, read, update, delete, and list operations

Resource Schema:

Required Properties:

• ProjectId: Unique identifier of the project
• AuthorizedEmail: Email address of authorized user
• AuthorizedUserFirstName: First name of authorized user
• AuthorizedUserLastName: Last name of authorized user

Optional Properties:

• CopyProtectionEnabled: Enable additional copy protection (default: false)
• EncryptionAtRestEnabled: Require Encryption at Rest using CKM (default: false)
• PitEnabled: Enable Continuous Cloud Backup (default: false)
• RestoreWindowDays: Number of days for restore window
• OnDemandPolicyItem: On-demand backup policy configuration
• PolicyItemHourly: Hourly backup policy item
• PolicyItemDaily: Daily backup policy item
• PolicyItemWeekly: Array of weekly backup policy items
• PolicyItemMonthly: Array of monthly backup policy items
• PolicyItemYearly: Array of yearly backup policy items

Create-Only Properties:

• ProjectId: Cannot be changed after creation

Configuration Examples:

Basic Backup Compliance Policy:

{
  "ProjectId": "5e2211c17a3e5a48f5497de3",
  "AuthorizedEmail": "admin@example.com",
  "AuthorizedUserFirstName": "John",
  "AuthorizedUserLastName": "Doe",
  "CopyProtectionEnabled": true,
  "EncryptionAtRestEnabled": true,
  "PitEnabled": true,
  "RestoreWindowDays": 7
}

cfn-testing

Published to AWS private registry

Stack Testing

Atlas

before

create

update

delete

Jira ticket: CLOUDP-369800

Please include a summary of the fix/feature/change, including any relevant motivation and context.

Link to any related issue(s):

Type of change:

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as
  expected)
• This change requires a documentation update
• If changes include removal or addition of 3rd party GitHub actions, I updated our internal document. Reach out to the APIx Integration slack channel to get access to the internal document.

Manual QA performed:

• cfn invoke for each of CRUDL/cfn test
• Updated resource in example
• Published to AWS private registry
• Used the template in example to create and update a stack in AWS
• Deleted stack to ensure resources are deleted
• Created multiple resources in same stack
• Validated in Atlas UI
• Included screenshots

Required Checklist:

• I have signed the MongoDB CLA
• I have added tests that prove my fix is effective or that my feature works
• I have checked that this change does not generate any credentials and that they are NOT accidentally logged anywhere.
• I have added any necessary documentation (if appropriate)
• I have run make fmt and formatted my code
• For CFN Resources: I have released by changes in the private registry and proved by change
  works in Atlas.

[oarbusi]

why not currentModel.ProjectId = policy.GetProjectId()?

[rakhul-mongo]

Valid point, updated as per suggested.

[oarbusi]

nit, but this way you don't have to declare the variables with the zero values

Suggested change

	frequencyInterval := 0
	if item.FrequencyInterval != nil {
	frequencyInterval = *item.FrequencyInterval
	}
	retentionValue := 0
	if item.RetentionValue != nil {
	retentionValue = *item.RetentionValue
	}
	retentionUnit := ""
	if item.RetentionUnit != nil {
	retentionUnit = *item.RetentionUnit
	}
	return &admin.BackupComplianceOnDemandPolicyItem{
	Id: item.Id,
	FrequencyInterval: frequencyInterval,
	FrequencyType: "ondemand",
	RetentionUnit: retentionUnit,
	RetentionValue: retentionValue,
	}
	onDemandPolicy := &admin.BackupComplianceOnDemandPolicyItem{
	Id: item.Id,
	FrequencyType: "ondemand",
	}
	if item.FrequencyInterval != nil {
	onDemandPolicy.FrequencyInterval = *item.FrequencyInterval
	}
	if item.RetentionValue != nil {
	onDemandPolicy.RetentionValue = *item.RetentionValue
	}
	if item.RetentionUnit != nil {
	onDemandPolicy.RetentionUnit = *item.RetentionUnit
	}
	return onDemandPolicy

[rakhul-mongo]

This is better, thanks

[oarbusi]

same suggestion from ExpandOnDemandPolicyItem could be applied here

[rakhul-mongo]

Done

[oarbusi]

LGTM, just some suggestions