search

awslabs / rds-snapshot-tool

The Snapshot Tool for Amazon RDS automates the task of creating manual snapshots, copying them into a different account and a different region, and deleting them after a specified number of days
Apache License 2.0
341 stars 146 forks source link

added support to create backup out of automated backups #53

Open ghost opened 4 years ago

ghost commented 4 years ago

Description of changes:

Why?

In some databases eg. ms sql server, during backup process, brief IO suspension happen. This change help reduce burden from live db instances and create backups from automated backups instead.

Similar PR is filed for aurora-snapshot-tool

ghost commented 4 years ago

@mrcoronel please help me review it

nishant3794 commented 4 years ago

Copying automated backup doesn't work in case of encrypted DB. You need to manually add lambda's IAM role as the KMS key administrator to get this working.

ghost commented 4 years ago

@nishant3794 It works for encrypted backups as well. Tested on aurora but doesn't work on mssql. I've opened a ticket with aWS also, but no information from them yet. To make it work on mssql, give KMS Grants permission to your lambda role. That's it.

But if encryption is set via option group eg. TDE on mssql, you can't share snapshot with any other AWS account. This is a hard limit from aws.

nishant3794 commented 4 years ago

@smeena667 Doesn't work for postgres as well. Got "KMSKeyNotAccessibleFault".

ghost commented 4 years ago

KMSKeyNotAccessibleFault

mind sharing your kms key policy?

nishant3794 commented 4 years ago

I got it working earlier by adding lambda's role to KMS key policy so it's all well now.

ghost commented 4 years ago

I got it working earlier by adding lambda's role to KMS key policy so it's all well now.

I would add permissions to lambda role as lambda role name keep on changing on every cf deploy and using wildcard is not safe. In the CF, you can edit lambda role permissions and this way all following lambda functions will use the same permission.

nishant3794 commented 4 years ago

I believe that's better than my way!! Will do that. Thanks..

I would add permissions to lambda role as lambda role name keep on changing on every cf deploy and using wildcard is not safe. In the CF, you can edit lambda role permissions and this way all following lambda functions will use the same permission.