EBS volume is protected by a backup plan

# Minimal AWS Backup plan protecting all EBS volumes
resource "aws_backup_plan" "<example_resource_name>" {
  name = "<example_resource_name>"

  rule {
    rule_name         = "<example_rule_name>"
    target_vault_name = "Default"
  }
}

resource "aws_backup_selection" "<example_resource_name>" {
  name         = "<example_resource_name>"
  plan_id      = aws_backup_plan.<example_resource_name>.id
  iam_role_arn = "arn:aws:iam::<example_account_id>:role/service-role/AWSBackupDefaultServiceRole"

  resources = [
    "arn:aws:ec2:*:*:volume/*" # Critical: selects all EBS volumes to satisfy the check
  ]
}

# CloudFormation: protect all EBS volumes by assigning them to a backup plan
Resources:
  <example_resource_name>BackupPlan:
    Type: AWS::Backup::BackupPlan
    Properties:
      BackupPlan:
        BackupPlanName: <example_resource_name>
        Rules:
          - RuleName: <example_rule_name>
            TargetBackupVault: Default

  <example_resource_name>BackupSelection:
    Type: AWS::Backup::BackupSelection
    Properties:
      BackupPlanId: !Ref <example_resource_name>BackupPlan
      BackupSelection:
        SelectionName: <example_resource_name>
        IamRoleArn: arn:aws:iam::<example_account_id>:role/service-role/AWSBackupDefaultServiceRole
        Resources:
          - arn:aws:ec2:*:*:volume/*  # Critical: wildcard includes all EBS volumes so they are covered by the plan