search

awslabs / rds-snapshot-tool

The Snapshot Tool for Amazon RDS automates the task of creating manual snapshots, copying them into a different account and a different region, and deleting them after a specified number of days
Apache License 2.0
341 stars 145 forks source link

Encrypted snapshots are not correctly copied #24

Closed LijieZhou closed 5 years ago

LijieZhou commented 5 years ago

Hey,

I ran into an issue when trying to copy the encrypted snapshots to the secondary account. The snapshots in the primary account are created using the default KMS key, however, that is not allowed to share to the secondary account by AWS for security reason. Any idea how to fix that?

warpspeed6 commented 5 years ago

You can't share a snapshot that has been encrypted using the default AWS KMS encryption key of the AWS account that shared the snapshot. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ShareSnapshot.html

LijieZhou commented 5 years ago

I fixed the problem by changing one method from the takeSnapshot lambda function in the source account assuming the source account does auto-backup. The idea is to copy the automated backup snapshots with a given KMS key (instead of the default). I will submit a PR just in case someone also needs this feature.

LijieZhou commented 5 years ago

So correct me if I am wrong: the snapshot created by copying the DB instance are encrypted by the default KMS key. Since create_db_snapshot does not take KMS as a parameter, I wind up using copy_db_snapshot instead. I chose to copy the latest automated snapshots (sort by timestamp) and pass the KMS key in that way.