AWS documentdb documentation change
Summary
Updated documentation for copying shared snapshots across regions and accounts, added detailed CLI examples for cross-region encrypted/unencrypted shared snapshot copies, and clarified KMS key requirements.
Security assessment
The changes emphasize proper handling of encrypted snapshots (requiring KMS key access) when copying shared snapshots across regions/accounts, but there's no evidence of addressing a specific vulnerability. The updates improve clarity about security practices rather than fixing a security issue.
Diff
diff --git a/documentdb/latest/developerguide/backup_restore-copy_cluster_snapshot.md b/documentdb/latest/developerguide/backup_restore-copy_cluster_snapshot.md index 9a2972fa7..fcc01c610 100644 --- a//documentdb/latest/developerguide/backup_restore-copy_cluster_snapshot.md +++ b//documentdb/latest/developerguide/backup_restore-copy_cluster_snapshot.md @@ -9,3 +9 @@ Copying shared snapshotsCopying snapshots across AWS RegionsLimitationsHandling -In Amazon DocumentDB, you can copy manual and automatic snapshots within the same AWS Region or to a different AWS Region within the same account. You can also share snapshots owned by other AWS accounts in the same AWS Region. However, you can't copy a cluster snapshot across AWS Regions and AWS account in a single step. These actions must be performed individually. - -As an alternative to copying, you can also share manual snapshots with other AWS accounts. For more information, see [Sharing Amazon DocumentDB cluster snapshots](./backup_restore-share_cluster_snapshots.html). +In Amazon DocumentDB, you can copy snapshots within the same AWS Region or to a different AWS Region. You can also copy shared snapshots to your account in the same AWS Region or in a different AWS Region. For more information on sharing snapshots, see [Sharing Amazon DocumentDB cluster snapshots](./backup_restore-share_cluster_snapshots.html). @@ -36,3 +34 @@ Amazon DocumentDB bills you based upon the amount of backup and snapshot data yo -You can copy snapshots shared to you by other AWS accounts. If you are copying an encrypted snapshot that has been shared from another AWS account, you must have access to the AWS KMS encryption key that was used to encrypt the snapshot. - -You can only copy a shared snapshot in the same AWS Region, whether the snapshot is encrypted or not. For more information, see Handling encryption. +You can copy snapshots shared to you by other AWS accounts. If you are copying an encrypted snapshot that has been shared from another AWS account, you must have access to the AWS KMS encryption key that was used to encrypt the snapshot. For more information, see Handling encryption. @@ -44,2 +39,0 @@ When you copy a snapshot to an AWS Region that is different from the source snap -Depending on the AWS Regions involved and the amount of data to be copied, a cross-region snapshot copy can take hours to complete. In some cases, there might be a large number of cross-region snapshot copy requests from a given source AWS Region. In these cases, Amazon DocumentDB might put new cross-region copy requests from that source AWS Region into a queue until some in-progress copies complete. No progress information is displayed about copy requests while they are in the queue. Progress information is displayed when the copy starts. - @@ -54 +48 @@ The following are some limitations when you copy snapshots: - * Depending on the regions involved and the amount of data to be copied, a cross-region snapshot copy can take hours to complete. For more information, see Copying snapshots across AWS Regions. + * Depending on the AWS Regions involved and the amount of data to be copied, a cross-region snapshot copy can take hours to complete. In some cases, there might be a large number of cross-region snapshot copy requests from a given source AWS Region. In these cases, Amazon DocumentDB might put new cross-region copy requests from that source AWS Region into a queue until some in-progress copies complete. No progress information is displayed about copy requests while they are in the queue. Progress information is displayed when the copy starts. @@ -145 +139 @@ To make a copy of an unencrypted cluster snapshot using the AWS CLI, use the `co - * `--source-db-cluster-snapshot-identifier` — Required. The identifier of the cluster snapshot to make a copy of. The cluster snapshot must exist and be in the _available_ state. If you are copying the snapshot to another AWS Region, this identifier must be in the ARN format for the source AWS Region. This parameter is not case sensitive. + * `--source-db-cluster-snapshot-identifier` — Required. The identifier of the cluster snapshot to make a copy of. The cluster snapshot must exist and be in the available state. If you are copying the snapshot to another AWS Region or if you are copying a shared cluster snapshot, this identifier must be in the ARN format of the source cluster snapshot. This parameter is not case sensitive. @@ -270,2 +264,2 @@ Output from this operation looks something like the following. - "DBClusterSnapshotArn": "arn:aws:rds:us-east-1:111122223333:cluster-snapshot:sample-cluster-snapshot-copy", - "SourceDBClusterSnapshotArn": "arn:aws:rds:us-east-1:111122223333:cluster-snapshot:sample-cluster-snapshot", + "DBClusterSnapshotArn": "arn:aws:rds:us-east-1:123456789012:cluster-snapshot:sample-cluster-snapshot-copy", + "SourceDBClusterSnapshotArn": "arn:aws:rds:us-east-1:123456789012:cluster-snapshot:sample-cluster-snapshot", @@ -304 +298 @@ Output from this operation looks something like the following. - "DBClusterIdentifier": "ayhu-xrsc-test-ap-southeast-1-small-cluster-kms", + "DBClusterIdentifier": "sample-cluster", @@ -317,3 +311,95 @@ Output from this operation looks something like the following. - "KmsKeyId": "arn:aws:kms:us-east-1:111122223333:key/sample-key-id", - "DBClusterSnapshotArn": "arn:aws:rds:us-east-1:111122223333:cluster-snapshot:sample-cluster-snapshot-copy", - "SourceDBClusterSnapshotArn": "arn:aws:rds:us-west-2:111122223333:cluster-snapshot:sample-cluster-snapshot", + "KmsKeyId": "arn:aws:kms:us-east-1:123456789012:key/0846496a-d48e-41c4-9353-86d8301d7e35", + "DBClusterSnapshotArn": "arn:aws:rds:us-east-1:123456789012:cluster-snapshot:sample-cluster-snapshot-copy", + "SourceDBClusterSnapshotArn": "arn:aws:rds:us-west-2:123456789012:cluster-snapshot:sample-cluster-snapshot", + } + } + +**Example 4: Copy an unencrypted shared snapshot across AWS Regions** + +The following AWS CLI example, account - `123456789012`, creates a copy of an unencrypted cluster snapshot `sample-cluster-snapshot` shared by account - `999999999999` from the us-east-1 Region to the us-west-2 Region. This command is called in the us-west-2 Region. For more information on sharing snapshots, see [Sharing a snapshot](./backup_restore-share_cluster_snapshots.html#backup_restore-share_snapshots). + +For Linux, macOS, or Unix: + + + aws docdb copy-db-cluster-snapshot \ + --region us-west-2 \ + --source-db-cluster-snapshot-identifier arn:aws:rds:us-east-1:999999999999:cluster-snapshot:sample-cluster-snapshot \ + --target-db-cluster-snapshot-identifier sample-cluster-snapshot-copy + +For Windows: + + + aws docdb copy-db-cluster-snapshot ^ + --region us-west-2 ^ + --source-db-cluster-snapshot-identifier arn:aws:rds:us-east-1:999999999999:cluster-snapshot:sample-cluster-snapshot ^ + --target-db-cluster-snapshot-identifier sample-cluster-snapshot-copy + +Output from this operation looks something like the following. + + + { + "DBClusterSnapshots": [ + { + "AvailabilityZones": [], + "DBClusterSnapshotIdentifier": "sample-cluster-snapshot-copy", + "DBClusterIdentifier": "sample-cluster", + "SnapshotCreateTime": "2025-08-22T11:27:00.497000+00:00", + "Engine": "docdb", + "Status": "copying", + "Port": 0, + "ClusterCreateTime": "2024-07-02T16:44:50.246000+00:00", + "MasterUsername": "master-user", + "EngineVersion": "5.0.0", + "SnapshotType": "manual", + "PercentProgress": 0, + "StorageEncrypted": false, + "DBClusterSnapshotArn": "arn:aws:rds:us-west-2:123456789012:cluster-snapshot:sample-cluster-snapshot-copy", + "SourceDBClusterSnapshotArn": "arn:aws:rds:us-east-1:999999999999:cluster-snapshot:sample-cluster-snapshot" + } + ] + } + +**Example 5: Copy an encrypted shared snapshot across AWS Regions** + +The following AWS CLI example, account - `123456789012` creates a copy of an encrypted cluster snapshot `sample-cluster-snapshot` shared by account - `999999999999` from the us-east-1 Region to the us-west-2 Region. The target snapshot is encrypted with a customer managed KMS key - `arn:aws:kms:us-west-2:123456789012:key/6c1f3264-1797-472b-ba37-03011e682d28`. This command is called in the us-west-2 Region. For more information on sharing snapshots, see [Sharing a snapshot](./backup_restore-share_cluster_snapshots.html#backup_restore-share_snapshots). + +For Linux, macOS, or Unix: + + + aws docdb copy-db-cluster-snapshot \ + --region us-west-2 \ + --source-db-cluster-snapshot-identifier arn:aws:rds:us-east-1:999999999999:cluster-snapshot:sample-cluster-snapshot \ + --target-db-cluster-snapshot-identifier sample-cluster-snapshot-copy \ + --kms-key-id arn:aws:kms:us-west-2:123456789012:key/6c1f3264-1797-472b-ba37-03011e682d28 + +For Windows: + + + aws docdb copy-db-cluster-snapshot ^ + --region us-west-2 ^ + --source-db-cluster-snapshot-identifier arn:aws:rds:us-east-1:999999999999:cluster-snapshot:sample-cluster-snapshot ^ + --target-db-cluster-snapshot-identifier sample-cluster-snapshot-copy ^ + --kms-key-id arn:aws:kms:us-west-2:123456789012:key/6c1f3264-1797-472b-ba37-03011e682d28 + +Output from this operation looks something like the following. + + + { + "DBClusterSnapshots": [ + { + "AvailabilityZones": [], + "DBClusterSnapshotIdentifier": "sample-cluster-snapshot-copy", + "DBClusterIdentifier": "sample-cluster", + "SnapshotCreateTime": "2025-08-22T11:27:00.497000+00:00", + "Engine": "docdb", + "Status": "copying", + "Port": 0, + "ClusterCreateTime": "2024-07-02T16:44:50.246000+00:00", + "MasterUsername": "master-user", + "EngineVersion": "5.0.0", + "SnapshotType": "manual", + "PercentProgress": 0, + "StorageEncrypted": true, + "KmsKeyId": "arn:aws:kms:us-west-2:123456789012:key/6c1f3264-1797-472b-ba37-03011e682d28", + "DBClusterSnapshotArn": "arn:aws:rds:us-west-2:123456789012:cluster-snapshot:sample-cluster-snapshot-copy", + "SourceDBClusterSnapshotArn": "arn:aws:rds:us-east-1:999999999999:cluster-snapshot:sample-cluster-snapshot" @@ -320,0 +407 @@ Output from this operation looks something like the following. + ]