Quickstart: Configure backup for Azure Database for PostgreSQL - Flexible Server using a Terraform template

Article
02/28/2025

This quickstart describes how to configure backup for the Azure Database for PostgreSQL - Flexible Server using the Terraform template.

Azure Backup allows you to back up your Azure PostgreSQL - Flexible servers using multiple clients, such as Azure portal, PowerShell, CLI, Azure Resource Manager, Bicep, and so on.

Prerequisites

Before you configure backup for Azure Database for PostgreSQL - Flexible Server, ensure that the following prerequisites are met:

You need an Azure account with an active subscription. If you don't have one, create an account for free.
Install and configure Terraform.
Sign in to your Azure account and authenticate to Azure.

Note

Terraform only supports authenticating to Azure with the Azure CLI. Authenticating using Azure PowerShell isn't supported. Therefore, while you can use the Azure PowerShell module when doing your Terraform work, you first need to authenticate to Azure.

Implement the Terraform code

Note

See more articles and sample code showing how to use Terraform to manage Azure resources.

Create a directory you can use to test the sample Terraform code and make it your current directory.

Create a file named providers.tf and insert the following code:

terraform {
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "3.99.0"
    }
  }
}

provider "azurerm" {
   features {}
   subscription_id   = "<azure_subscription_id>"
   tenant_id = "<azure_subscription_tenant_id>"
}

Create a file named main.tf and insert the following code:


# Step 1: Create the Backup Vault
resource "azurerm_data_protection_backup_vault" "backup_vault" {
  name                = var.backup_vault_name
  resource_group_name = var.backup_vault_resource_group
  location            = var.region

  identity {
    type = "SystemAssigned"
  }

  storage_settings {
    datastore_type = "VaultStore"
    type           = "LocallyRedundant"
  }
}

# Step 2: Create Backup Policy for PostgreSQL
resource "azurerm_data_protection_backup_policy" "postgresql_backup_policy" {
  name                = var.policy_name
  resource_group_name = var.backup_vault_resource_group
  vault_name          = azurerm_data_protection_backup_vault.backup_vault.name

  rule {
    name = "BackupSchedule"

    backup_parameters {
      object_type = "AzureBackupParams"
    }

    trigger {
      schedule {
        recurrence_rule {
          frequency = "Weekly"
          interval  = var.backup_schedule_frequency
        }
      }
    }

    data_store {
      datastore_type = "VaultStore"
    }
  }

  retention_rule {
    name       = "RetentionRule"
    is_default = true

    lifecycle {
      delete_after {
        object_type = "AbsoluteDeleteOption"
        duration    = format("P%dM", var.retention_duration_in_months)
      }
    }
  }

  depends_on = [
    azurerm_data_protection_backup_vault.backup_vault
  ]
}

# Step 3: Role Assignment for PostgreSQL Flexible Server Long Term Retention Backup Role
data "azurerm_postgresql_flexible_server" "postgresql_server" {
  name                = var.postgresql_server_name
  resource_group_name = var.postgresql_resource_group
}

resource "azurerm_role_assignment" "backup_role" {
  principal_id         = azurerm_data_protection_backup_vault.backup_vault.identity[0].principal_id
  role_definition_name = "PostgreSQL Flexible Server Long Term Retention Backup Role"
  scope                = data.azurerm_postgresql_flexible_server.PostgreSQL_server.id

  depends_on = [
    azurerm_data_protection_backup_policy.postgresql_backup_policy
  ]
}

# Step 4: Role Assignment for Reader on Resource Group
data "azurerm_resource_group" "postgresql_resource_group" {
  name = var.postgresql_resource_group
}

resource "azurerm_role_assignment" "reader_role" {
  principal_id         = azurerm_data_protection_backup_vault.backup_vault.identity[0].principal_id
  role_definition_name = "Reader"
  scope                = data.azurerm_resource_group.postgresql_resource_group.id

  depends_on = [
    azurerm_role_assignment.backup_role
  ]
}

# Step 5: Create Backup Instance for PostgreSQL
resource "azurerm_data_protection_backup_instance" "postgresql_backup_instance" {
  name                = "PostgreSQLBackupInstance"
  resource_group_name = var.backup_vault_resource_group
  vault_name          = azurerm_data_protection_backup_vault.backup_vault.name
  location            = var.region

  datasource {
    object_type     = "Datasource"
    datasource_type = "AzureDatabaseForPostgreSQLFlexibleServer"
    resource_id     = data.azurerm_PostgreSQL_flexible_server.postgresql_server.id
  }

  policy_id = azurerm_data_protection_backup_policy.postgresql_backup_policy.id

  depends_on = [
    azurerm_role_assignment.reader_role
  ]
}

Create a file named variables.tf and insert the following code:


variable "backup_vault_name" {
      type        = string
      default     = "BackupVaultTF"
      description = "Name of the Backup Vault"
}
variable "backup_vault_resource_group" {
      type        = string
      default     = "Contoso_TF_RG"
      description = "Name of the resource group to which backup vault belongs to"
}

variable "postgresql_server_name" {
      type        = string
      default     = "Contoso_PostgreSQL_TF"
      description = "Name of the PostgreSQL server"
}

variable "postgresql_resource_group" {
      type        = string
      default     = "Contoso_TF_RG"
      description = "Name of the resource group to which PostgreSQL server belongs to"
}

variable "region" {
      type        = string
      default     = "eastus"
      description = "Location of the PostgreSQL server"
}

variable "policy_name" {
      type        = string
      default     = "PostgreSQLbackuppolicytfv1"
      description = "Name of the backup policy"
}

variable "backup_schedule_frequency" {
      type        = string
      default     = "1"
      description = "Schedule frequency for backup"
}
variable "retention_duration_in_months" {
      type        = string
      default     = "3"
      description = "Retention duration for backup in month"
}

Initialize Terraform

Run terraform init to initialize the Terraform deployment. This command downloads the Azure provider required to manage your Azure resources.

terraform init -upgrade

Key points:

The -upgrade parameter upgrades the necessary provider plugins to the newest version that complies with the configuration's version constraints.

Create a Terraform execution plan

Run terraform plan to create an execution plan.

terraform plan -out main.tfplan

Key points:

The terraform plan command creates an execution plan, but doesn't execute it. Instead, it determines what actions are necessary to create the configuration specified in your configuration files. This pattern allows you to verify whether the execution plan matches your expectations before making any changes to actual resources.
The optional -out parameter allows you to specify an output file for the plan. Using the -out parameter ensures that the plan you reviewed is exactly what is applied.

Apply a Terraform execution plan

Run terraform apply to apply the execution plan to your cloud infrastructure.

terraform apply main.tfplan

Key points:

The example terraform apply command assumes you previously ran terraform plan -out main.tfplan.
If you specified a different filename for the -out parameter, use that same filename in the call to terraform apply.
If you didn't use the -out parameter, call terraform apply without any parameters.

Troubleshoot Terraform on Azure

Troubleshoot common problems when using Terraform on Azure.

Next steps

Restore Azure Database for PostgreSQL - Flexible server using Azure CLI.

Share via

Quickstart: Configure backup for Azure Database for PostgreSQL - Flexible Server using a Terraform template

Prerequisites

Implement the Terraform code

Initialize Terraform

Create a Terraform execution plan

Apply a Terraform execution plan

Troubleshoot Terraform on Azure

Next steps

Feedback

Additional resources