AWS Backup policy for cross account and cross region

0

One of our customer have 60 AWS accounts and 5-6 AWS regions per account. They have EC2 and RDS(many are encrypted with AWS default key) in those regions. They want to protect their backups cross account and cross region. We can not move backup cross account and cross region for RDS in a single backup plan and for EC2 when using default encryption key so we used AWS Backup plan to create backup and used copy backup in same plan to move copy in same account but cross region so that AWS- Backup can translate the recovery point encryption key from the default encryption key to the Vault key used in cross region vault which is CMK. Now we leveraged event bridge to trigger lambda based on AWS Backup event to move backup copy to cross account in same region. This way we are able to achieve what we want but this solution is very tough to scale when it comes to implementation in 60 accounts and 5-6 regions per account. Sorry, trying summarizing in fewer sentences hence problem become complex to explain. Any one solved such problem in past or can suggest some solution please?

AWS
asked a year ago527 views
1 Answer
1

CMK is a hard requirement for cross-account copies because the immutability aspects of AWS Managed Key's KMS policy. What you are implementing is the only solution today. https://aws.amazon.com/blogs/storage/protecting-encrypted-amazon-rds-instances-with-cross-account-and-cross-region-backups/

profile pictureAWS
EXPERT
answered 10 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions