feat: Add AWS Backup restore testing support (#238, #239)

[lgallard]

Summary

This PR implements comprehensive AWS Backup restore testing capabilities to address issues #238 and #239.

Issues Addressed

• feat: Add support for aws_backup_restore_testing_plan #238: Add support for aws_backup_restore_testing_plan
• feat: Add support for aws_backup_restore_testing_selection #239: Add support for aws_backup_restore_testing_selection

Both issues are related and form a cohesive feature set for automated backup validation.

Key Features Implemented

🏗️ Core Resources

• aws_backup_restore_testing_plan - Automated testing schedule and recovery point selection
• aws_backup_restore_testing_selection - Granular resource selection for testing
• Conditional resource creation based on module enablement
• Comprehensive validation and security patterns

🔒 Security & IAM

• Automatic IAM role creation for restore testing operations
• Least-privilege policy attachments (EC2, RDS, S3, CloudWatch)
• Cross-partition support (standard AWS + GovCloud)
• Custom policy for advanced restore testing permissions
• 15+ validation blocks ensuring security and AWS compliance

💰 Cost Optimization

• Configurable instance types for testing (default: t3.nano)
• Configurable validation windows to minimize costs
• Resource cleanup automation
• Efficient scheduling options

📊 Enhanced Outputs

• Detailed restore testing plan and selection information
• Actionable console URLs for direct AWS Console access
• CLI examples for common operations
• Comprehensive summary with monitoring guidance

🧪 Testing & Examples

• Complete production-ready example (examples/restore_testing_plan/)
• Integration tests with retry logic and custom IAM role scenarios
• Comprehensive README with architecture diagrams
• Test fixtures for both basic and advanced scenarios

📚 Documentation

• Updated README.md with new restore testing capabilities
• Added to Features section and Usage examples
• Comprehensive example documentation with troubleshooting

Technical Implementation

File Structure

├── restore_testing.tf              # Core restore testing resources
├── iam.tf                         # Extended IAM for restore testing
├── variables.tf                   # New restore testing variables
├── outputs.tf                     # Enhanced outputs with URLs/CLI
├── examples/restore_testing_plan/ # Complete example
└── test/                          # Integration tests

Compliance Benefits

• SOC 2: Automated backup validation evidence
• ISO 27001: Backup effectiveness demonstration
• HIPAA: Backup integrity for sensitive data
• PCI DSS: Automated recovery procedures validation

Test Plan

Manual Testing

• Terraform validate passes
• Terraform fmt applied
• Pre-commit hooks pass
• Example deploys successfully
• Integration tests pass

Automated Testing

• New integration tests for restore testing plans
• New integration tests for restore testing selections
• Custom IAM role testing scenarios
• Output validation tests

Backward Compatibility

✅ Fully backward compatible - No breaking changes to existing functionality.
All new features are opt-in via new variables.

Usage Example

module "aws_backup" {
  source = "lgallard/backup/aws"

  # Existing backup configuration
  enabled    = true
  vault_name = "my-backup-vault"
  
  plans = {
    daily_backup = {
      name = "daily-backup-plan"
      # ... existing plan configuration
    }
  }

  # NEW: Restore testing configuration
  restore_testing_plans = {
    weekly_restore_test = {
      name                = "weekly-restore-test"
      schedule_expression = "cron(0 6 ? * SUN *)"
      
      recovery_point_selection = {
        algorithm            = "LATEST_WITHIN_WINDOW"
        include_vaults       = ["*"]
        recovery_point_types = ["SNAPSHOT"]
        selection_window_days = 7
      }
    }
  }

  restore_testing_selections = {
    ec2_restore_selection = {
      name                      = "ec2-restore-selection"
      restore_testing_plan_name = "weekly_restore_test"
      protected_resource_type   = "EC2"
      validation_window_hours   = 24

      protected_resource_conditions = {
        string_equals = [{
          key   = "aws:ResourceTag/Environment"
          value = "production"
        }]
      }
    }
  }
}

Review Notes

This implementation follows the module's established patterns and maintains full backward compatibility. The restore testing functionality enhances the module's compliance capabilities while providing cost-effective automated validation of backup recovery procedures.

Closes #238
Closes #239