AWS aws-backup documentation change
Summary
Updated EKS restore documentation: clarified required fields, added examples for namespace restoration and nested PVs, fixed metadata formatting, and standardized IAM role references.
Security assessment
Changes primarily improve documentation clarity and correctness. Adding '[Required]' markers and explicit examples helps prevent misconfiguration but doesn't address a specific security vulnerability. The IAM role change in examples appears to be a documentation update rather than a security fix. No evidence of patching a security vulnerability or weakness.
Diff
diff --git a/aws-backup/latest/devguide/restoring-eks.md b/aws-backup/latest/devguide/restoring-eks.md index 257db5766..eb85651c9 100644 --- a//aws-backup/latest/devguide/restoring-eks.md +++ b//aws-backup/latest/devguide/restoring-eks.md @@ -174,3 +174 @@ Use StartRestoreJob. You can specify the following metadata during Amazon EKS re - * `newCluster` \- (true/false) If we should create a new EKS cluster during restore - - * If newCluster is "true", the following metadata fields apply: + * `newCluster` \- (true/false) If we should create a new EKS cluster during restore. If newCluster is "true", the following metadata fields apply: @@ -186 +184 @@ Use StartRestoreJob. You can specify the following metadata during Amazon EKS re - * `subnetIds` \- The subnets associated with your cluster + * `subnetIds [Required]` \- The subnets associated with your cluster @@ -188 +186 @@ Use StartRestoreJob. You can specify the following metadata during Amazon EKS re - * `securityGroupIds` \- The additional security groups associated with your cluster + * `securityGroupIds [Required]` \- The additional security groups associated with your cluster @@ -192 +190 @@ Use StartRestoreJob. You can specify the following metadata during Amazon EKS re - * `nodeGroupId` \- The ID of the node group + * `nodeGroupId [Required]` \- The ID of the node group @@ -194 +192 @@ Use StartRestoreJob. You can specify the following metadata during Amazon EKS re - * `subnetIds` \- The subnets that were specified for the Auto Scaling group that is associated with your node group + * `subnetIds [Required]` \- The subnets that were specified for the Auto Scaling group that is associated with your node group @@ -198 +196 @@ Use StartRestoreJob. You can specify the following metadata during Amazon EKS re - * `nodeRole` \- The IAM role associated with your node group + * `nodeRole [Required]` \- The IAM role associated with your node group @@ -206 +204 @@ Use StartRestoreJob. You can specify the following metadata during Amazon EKS re - * `name` \- The name of the Fargate profile + * `name [Required]` \- The name of the Fargate profile @@ -210 +208 @@ Use StartRestoreJob. You can specify the following metadata during Amazon EKS re - * `podExecutionRoleArn` \- The IAM Role ARN of the Pod execution role to use for a Pod that matches the selectors in the Fargate profile + * `podExecutionRoleArn [Required]` \- The IAM Role ARN of the Pod execution role to use for a Pod that matches the selectors in the Fargate profile @@ -218 +216 @@ Use StartRestoreJob. You can specify the following metadata during Amazon EKS re - * `kubernetesRestoreOrder` \- Override the order the Kubernetes manifests are restored in. This order will take precedence over the default service restore order. This follow the format: group/version/kind or version/kind: + * `kubernetesRestoreOrder` \- Override the order the Kubernetes manifests are restored in. This order will take precedence over the default service restore order. This follow the format: group/version/kind or version/kind @@ -220 +218 @@ Use StartRestoreJob. You can specify the following metadata during Amazon EKS re -["v1/persistentvolumes","v1/pods","customresource/v2/custom"] +Ex: `["v1/persistentvolumes","v1/pods","customresource/v2/custom"]` @@ -224 +222,3 @@ Use StartRestoreJob. You can specify the following metadata during Amazon EKS re - * `namespaces` \- A list of namespaces to restore if namespaceLevelRestore is "true". Can provide up to 5 namespaces to restore + * `namespaces` \- A list of namespaces to restore if namespaceLevelRestore is "true". Can provide up to 5 namespaces to restore. + +Ex: `["ns-1","ns-2","ns-3","ns-4","ns-5"]` @@ -238,2 +238,20 @@ Use StartRestoreJob. You can specify the following metadata during Amazon EKS re - --iam-role-arn "arn:aws:iam::123456789012:role/AWSBackupServiceRolePolicyForEKSRestore" \ - --metadata '{"clusterName":"existing-cluster","newCluster":false}' \ + --iam-role-arn "arn:aws:iam::123456789012:role/AWSBackupDefaultServiceRole" \ + --metadata '{"clusterName":"existing-cluster","newCluster":"false"}' \ + --resource-type "EKS" + +**Restore specific namespaces to an existing cluster:** + + + aws backup start-restore-job \ + --recovery-point-arn "arn:aws:backup:us-west-2:123456789012:recovery-point:composite:eks/my-cluster-20240115" \ + --iam-role-arn "arn:aws:iam::123456789012:role/AWSBackupDefaultServiceRole" \ + --metadata '{"clusterName":"existing-cluster","newCluster":"false","namespaceLevelRestore":"true","namespaces":"[\"ns-1\",\"ns-2\",\"ns-3\",\"ns-4\",\"ns-5\"]"}' \ + --resource-type "EKS" + +**Restore nested persistent volumes to an existing cluster:** + + + aws backup start-restore-job \ + --recovery-point-arn "arn:aws:backup:us-west-2:123456789012:recovery-point:composite:eks/my-cluster-20240115" \ + --iam-role-arn "arn:aws:iam::123456789012:role/AWSBackupDefaultServiceRole" \ + --metadata '{"clusterName":"existing-cluster","newCluster":"false","namespaceLevelRestore":"true","nestedrestorejobs":"{\"arn:aws:ec2:us-west-2::snapshot/snap-abc123\":\"{\\\"AvailabilityZone\\\":\\\"us-west-2a\\\"}\",\"arn:aws:backup:us-west-2:123456789012:recovery-point:fa71a304-2555-4c37-8128-f154b9578032\":\"{\\\"DestinationBucketName\\\":\\\"bucket-name\\\"}\"}"}' \ @@ -247,2 +265,2 @@ Use StartRestoreJob. You can specify the following metadata during Amazon EKS re - --iam-role-arn "arn:aws:iam::123456789012:role/AWSBackupServiceRolePolicyForEKSRestore" \ - --metadata '{"clusterName":"new-cluster","newCluster":true,"clusterRole":"arn:aws:iam::123456789012:role/EKSClusterRole","eksClusterVersion":"1.33","clusterVpcConfig":"{\"vpcId\":\"vpc-1234\",\"subnetIds\":[\"subnet-1\",\"subnet-2\",\"subnet-3\"],\"securityGroupIds\":[\"sg-123\"]}","nodeGroups":"[{\"nodeGroupId\":\"nodegroup-1\",\"subnetIds\":[\"subnet-1\",\"subnet-2\",\"subnet-3\"],\"nodeRole\":\"arn:aws:iam::123456789012:role/EKSNodeGroupRole\",\"instanceTypes\":[\"t3.small\"]}]","fargateProfiles":"[{\"name\":\"fargate-profile-1\",\"subnetIds\":[\"subnet-1\",\"subnet-2\",\"subnet-3\"],\"podExecutionRoleArn\":\"arn:aws:iam::123456789012:role/EKSFargateProfileRole\"}]"}' \ + --iam-role-arn "arn:aws:iam::123456789012:role/AWSBackupDefaultServiceRole" \ + --metadata '{"clusterName":"new-cluster","newCluster":"true","clusterRole":"arn:aws:iam::123456789012:role/EKSClusterRole","eksClusterVersion":"1.33","clusterVpcConfig":"{\"vpcId\":\"vpc-1234\",\"subnetIds\":[\"subnet-1\",\"subnet-2\",\"subnet-3\"],\"securityGroupIds\":[\"sg-123\"]}","nodeGroups":"[{\"nodeGroupId\":\"nodegroup-1\",\"subnetIds\":[\"subnet-1\",\"subnet-2\",\"subnet-3\"],\"nodeRole\":\"arn:aws:iam::123456789012:role/EKSNodeGroupRole\",\"instanceTypes\":[\"t3.small\"]}]","fargateProfiles":"[{\"name\":\"fargate-profile-1\",\"subnetIds\":[\"subnet-1\",\"subnet-2\",\"subnet-3\"],\"podExecutionRoleArn\":\"arn:aws:iam::123456789012:role/EKSFargateProfileRole\"}]"}' \