AWS aws-backup documentation change
Summary
Updated restore workflow steps with reordered configuration options, added encryption-at-rest settings, deletion protection, and removed restore role/role tags sections
Security assessment
Added documentation about encryption-at-rest configuration and deletion protection features, which are security controls. No evidence of addressing a specific vulnerability.
Diff
diff --git a/aws-backup/latest/devguide/restoring-docdb.md b/aws-backup/latest/devguide/restoring-docdb.md index 3c784eac4..729eb61df 100644 --- a/aws-backup/latest/devguide/restoring-docdb.md +++ b/aws-backup/latest/devguide/restoring-docdb.md @@ -21 +21 @@ Restoring a Amazon DocumentDB cluster requires that you specify multiple restore - 4. Ensure you are on the console page **Restore Amazon DocumentDB cluster snapshots**. + 4. In the **Configuration** pane, accept the defaults or specify the options for the **Cluster identifier** , **Engine version** , **Instance class** , and **Number of instances**. @@ -23 +23 @@ Restoring a Amazon DocumentDB cluster requires that you specify multiple restore - 5. In the **Instance specifications** pane, select the DB engine you want to use for the instance. + * NOTE: If the default VPC does not exist when restoring, you must specify a subnet in another VPC. @@ -25 +25 @@ Restoring a Amazon DocumentDB cluster requires that you specify multiple restore - 6. In the **Settings** pane, input a unique name for your DB cluster identifier. + 5. In the **Network & Security** pane, "No Preferences" will be displayed. @@ -27 +27 @@ Restoring a Amazon DocumentDB cluster requires that you specify multiple restore -You can use letters, numbers, and hyphens, though you cannot have two consecutive hyphens or end the name with a hyphen. The final name will be all lowercase. + 6. In the **Encryption-at-rest** pane, accept the default or specify the options for the **Enable encryption** or **Disable encryption** settings. @@ -29 +29 @@ You can use letters, numbers, and hyphens, though you cannot have two consecutiv - 7. In the **Database options** pane, select the database port. + 7. In the **Database options** pane, type in the **Port** and choose the **Cluster parameter group**. @@ -31 +31 @@ You can use letters, numbers, and hyphens, though you cannot have two consecutiv -This is the TCP/IP port that the DB instance or cluster will use for application connections. The connection string of any application connecting to the DB instance or cluster must specify its port number. Both the security group applied to the DB instance or cluster and your organization firewalls must allow connections to the port. All DB instances in a DB cluster use the same port. + 8. In the **Log exports** pane, choose the log types to publish to Amazon CloudWatch Logs. The **IAM role** is already defined. @@ -33 +33 @@ This is the TCP/IP port that the DB instance or cluster will use for application - 8. Also in the **Database options** pane, select the DB cluster parameter group. + 9. In the **Maintenance** pane, specify a maintenance window or choose **No preference**. @@ -35 +35 @@ This is the TCP/IP port that the DB instance or cluster will use for application -This is the parameter group associated with this instance's DB cluster. The DB cluster parameter group acts as a container for engine configuration values that are applied to every DB instance in the cluster. + 10. In the **Tags** pane, you can choose **Add tag**. @@ -37 +37 @@ This is the parameter group associated with this instance's DB cluster. The DB c - 9. In the **Encryption** pane, select the key that will be used to encrypt this database volume. The default is `aws/rds`. You may alternatively use a customer managed key (CMK). + 11. In the **Deletion protection** pane, you can choose **Enable deletion protection**. @@ -39,7 +39 @@ This is the parameter group associated with this instance's DB cluster. The DB c - 10. In the **Log exports** pane, choose the log types to publish to Amazon CloudWatch Logs. The **IAM role** is already defined. - - 11. In the **Restore role** pane, choose either the default IAM role for the restore job or a different IAM role. - - 12. In the Protected resource tags pane, you may optionally choose to copy tags from the backup to the restored database cluster. - - 13. After specifying all your settings, choose **Restore backup**. + 12. After specifying all your settings, choose **Restore backup**. @@ -49 +43 @@ The **Restore jobs** pane appears. A message at the top of the page provides inf - 14. After your restore finishes, attach your restored Amazon DocumentDB cluster to an Amazon RDS instance. + 13. After your restore finishes, attach your restored Amazon DocumentDB cluster to an Amazon RDS instance.