使用 AWS re:Post 即表示您同意 AWS re:Post 使用條款
AWS re:Postre:Post

AWS BackUp Cross Account

0

I'm having quite a lot of difficulties getting my head around AWS BackUp in particular cross account.

We have multiple AWS accounts in an organisation:

prod staging qa backup

We'd like to backup the RDS databases in prod, staging and qa using AWS Backup and then have cross account replication to the backup account.

(1) Can the CMK used for encryption be different from the CMK used to encrypt the database? I know it needs to be shared across accounts so should I create a new CMK in the destination backup account and shared it to the source accounts prod staging and qa?

(2) How does lifecyle work, once the backups are copied across to the destination backup account I don't really need them any more in the source account. Is it possible to have a seperate lifecycle rule for the source account and destination account?

Thanks

主題
儲存空間
標籤
AWS Backup
語言
English
AWS-User-8443772
已提問 3 個月前檢視次數 148 次
2 個答案
0

Hi,

You may want to read this blog on the exact use case that you are working on: https://aws.amazon.com/blogs/storage/secure-data-recovery-with-cross-account-backup-and-cross-region-copy-using-aws-backup/

It provides all details on implementation, in particular around management of encryption keys.

Best,

Didier

profile pictureAWS
專家
Didier_Durand
已回答 3 個月前
0
  1. Amazon RDS snapshots are automatically encrypted with the same encryption key that was used to encrypt the source Amazon RDS database, so in order to have a cross-account backup of RDS, we must use CMK to encrypt RDS. (Snapshots of unencrypted Amazon RDS databases are also unencrypted). We use AWS KMS-CMK because it can be shared across accounts.
  2. If you don't need the backup in the source account, you can simply create a shorter retention period so that they expire soon while the destination backup can have a longer retention.
profile pictureAWS
Cristian Pezzo
已回答 3 個月前
  • AWS-User-8443772
    3 個月前

    I appreciate the advice and have reviewed the links. Each RDS instance we have (in prod, staging and qa) use a different CMK for encryption. Does this mean we need to use different AWS BackUp vaults for each one. Or can we just add permissions for AWSServiceRoleforBackup to each of the CMK keys?

  • Cristian Pezzo
    3 個月前

    Each Vault has its own CMK and it is independent from the RDS encryption key and there is no need to create a vault for each RDS instance. When AWS backup backups an instance, it uses the RDS instance CMK to encrypt the instance recovery point, and send the snaps into a vault which is itself encrypted to protect all the other backups you might have.

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋，同時有助於提問者的專業成長。

回答問題指南

相關內容