AWS aws-backup documentation change
Summary
Added documentation about Region triplets for Aurora DSQL multi-region restore, updated error handling guidance including permissions requirements for cross-account copies
Security assessment
The change adds documentation about required permissions (AuroraDsqlServiceLinkedRolePolicy) for cross-account recovery point copies, which helps prevent authorization failures but does not indicate a security vulnerability being patched
Diff
diff --git a/aws-backup/latest/devguide/restore-auroradsql.md b/aws-backup/latest/devguide/restore-auroradsql.md index c79c1873e..22113f3c2 100644 --- a//aws-backup/latest/devguide/restore-auroradsql.md +++ b//aws-backup/latest/devguide/restore-auroradsql.md @@ -83,0 +84,13 @@ AWS CLI +Aurora DSQL multi-Region cluster restore occurs within a closed Region triplet, which is a group of three linked AWS Regions. Multi-Region restore requires that the Regions you specify in the operation are contained in one triplet. + +The three triplets are: + + * US East (N. Virginia); US East (Ohio); US West (N. California) + + * Europe (Ireland); Europe (London); Europe (Paris) + + * Asia Pacific (Tokyo); Asia Pacific (Seoul); Asia Pacific (Osaka) + + + + @@ -90 +103 @@ If you have a backup plan with a rule that automatically creates a cross-Region -First, choose a recovery point stored in a backup vault in US East (N. Virginia), US East (Ohio), or US West (Oregon) AWS Regions. Then, copy the recovery point to one of the other listed Regions (Regions that are not supported will result in a failed restore operation). Next, start a restore job for each cluster. Finally, use the `update-cluster` command to link the newly created DSQL clusters. +First, choose a recovery point stored in a backup vault in one of the triplets shown earlier in this section. Then, copy the recovery point to one of the other listed Regions within the same triplet (Regions that are not supported will result in a failed restore operation). Next, start a restore job for each cluster. Finally, use the `update-cluster` command to link the newly created DSQL clusters. @@ -97 +110 @@ Console -Multi-Region restore is not currently available through the AWS Backup console. You can create a multi-Region restore through AWS CLI by following the steps in the alternate tab. +Multi-Region restore is not yet available in the AWS Backup console. See the adjacent tab AWS CLI for steps to do this procedure through API. @@ -106 +119 @@ Mutli-Region restore is achieved by starting two restore jobs, each in a differe -Both the first recovery point and the copy of that recovery point must be in one of the following Regions. The operation will fail if the clusters are located in Regions not listed. +Both the first recovery point and the copy of that recovery point must be in the same Region triplet. The operation will fail if the clusters are in Regions outside the triplet. @@ -108 +121 @@ Both the first recovery point and the copy of that recovery point must be in one - * US East (N. Virginia) + * US East (N. Virginia); US East (Ohio); US West (N. California) @@ -110 +123 @@ Both the first recovery point and the copy of that recovery point must be in one - * US East (Ohio) + * Europe (Ireland); Europe (London); Europe (Paris) @@ -112 +125 @@ Both the first recovery point and the copy of that recovery point must be in one - * US West (Oregon) + * Asia Pacific (Tokyo); Asia Pacific (Seoul); Asia Pacific (Osaka) @@ -180 +193 @@ Verify the following conditions are met: - * The copied recovery point in your second restore job has a different Region than the first recovery point. + * The copied recovery point in your second restore job has a different Region (but still in the same triplet) than the first recovery point. @@ -182 +195 @@ Verify the following conditions are met: - * The Regions for both recovery points are US East (N. Virginia), US East (Ohio), or US West (Oregon). + * The Regions for both recovery points occur within one of the supported Regional triplets. @@ -197 +210 @@ Example of a cluster update where the recovery point is located in US West (Oreg - --multi-region-properties + -\-multi-region-properties @@ -209 +222,7 @@ Example of a cluster update where the recovery point is located in US West (Oreg -If you encounter any issues with the backup or restore process, you can check the status of your backup and restore jobs in the AWS Backup console or using the AWS CLI. Additionally, you can review the AWS CloudTrail logs for any relevant error messages or events related to your AWS Backup operations. +**Error:** Insufficient permissions + +**Possible cause:** If you try to copy an Aurora DSQL recovery point into an account (cross-account copy) that has never interacted with DSQL API, you may get a permission issue error since the DSQL service-linked role isn't set up in the destination account. + +**Remedy:** Attach the [DSQL managed policy](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/working-with-service-linked-roles.html) that includes the DSQL service-linked role, [AuroraDsqlServiceLinkedRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ AuroraDsqlServiceLinkedRolePolicy.html), to a role in the destination account. + +If you encounter any other issues with the backup or restore process, you can check the status of your backup and restore jobs in the AWS Backup console or using the AWS CLI. Additionally, you can review the AWS CloudTrail logs for any relevant error messages or events related to your AWS Backup operations.