AWS aws-backup documentation change
Summary
Added documentation about backup retention period outage implications and detailed CLI examples/metadata parameters for RDS/Aurora PITR restores
Security assessment
The change adds security-relevant documentation about preserving tag-based access controls during restores and proper maintenance window planning. While it improves security awareness, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/aws-backup/latest/devguide/point-in-time-recovery.md b/aws-backup/latest/devguide/point-in-time-recovery.md index e5d070b8d..5776eab48 100644 --- a//aws-backup/latest/devguide/point-in-time-recovery.md +++ b//aws-backup/latest/devguide/point-in-time-recovery.md @@ -94 +94 @@ AWS Backup for S3 relies on receiving S3 events through Amazon EventBridge. If t -**Settings:** After you apply an AWS Backup continuous backup rule to an Amazon RDS instance, you can't create or modify continuous backup settings to that instance in Amazon RDS; modifications must be done through the AWS Backup console or the AWS Backup CLI. +**Settings:** After you apply an AWS Backup continuous backup rule to an Amazon RDS instance, you can't create or modify continuous backup settings in Amazon RDS. You must make modifications through the AWS Backup console or the AWS Backup CLI. When you turn on automated backups for the first time, an outage occurs if you change the backup retention period of the DB instance from 0 to a nonzero value. Plan this change during a maintenance window to minimize impact. For more information about enabling automated backups, see [Enabling automated backups](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.BackupRetention.html) in the _Amazon RDS User Guide_. @@ -148,0 +149,52 @@ For general information about working with Amazon RDS, see the [Amazon RDS User +#### CLI examples for RDS and Aurora PITR restore + +The following examples demonstrate how to restore RDS and Aurora databases to a point in time using the AWS Backup CLI with metadata parameters. + +###### Example: Restore RDS database to a point in time with metadata + + + aws backup start-restore-job \ + --recovery-point-arn arn:aws:backup:us-east-1:123456789012:recovery-point:1EB3B5E7-9EB0-435A-A80B-108B488B0D45 \ + --metadata '{"DBInstanceIdentifier":"restored-db-instance","Engine":"mysql","UseLatestRestorableTime":"false","RestoreTime":"2024-01-15T10:30:00Z"}' \ + --iam-role-arn arn:aws:iam::123456789012:role/service-role/AWSBackupDefaultServiceRole \ + --resource-type RDS \ + --copy-source-tags-to-restored-resource + +###### Example: Restore Aurora cluster to a point in time + + + aws backup start-restore-job \ + --recovery-point-arn arn:aws:backup:us-east-1:123456789012:recovery-point:2FC4C6F8-0FC1-546B-B91C-209C599C1D56 \ + --metadata '{"DBClusterIdentifier":"restored-aurora-cluster","Engine":"aurora-mysql","UseLatestRestorableTime":"true"}' \ + --iam-role-arn arn:aws:iam::123456789012:role/service-role/AWSBackupDefaultServiceRole \ + --resource-type Aurora \ + --copy-source-tags-to-restored-resource + +###### Metadata parameters for RDS PITR restore + +The following metadata parameters are supported for RDS and Aurora PITR restores: + + * **DBInstanceIdentifier** (RDS) or **DBClusterIdentifier** (Aurora) - Required. The name for the restored database. + + * **Engine** \- Required. The database engine (e.g., mysql, postgres, aurora-mysql, aurora-postgresql). + + * **UseLatestRestorableTime** \- Optional. Set to "true" to restore to the latest restorable time, or "false" to specify a RestoreTime. + + * **RestoreTime** \- Optional. The date and time to restore to (ISO 8601 format). Required if UseLatestRestorableTime is "false". + + + + +###### Copy tags to restored resource + +Use the `--copy-source-tags-to-restored-resource` flag to copy tags from the source database to the restored database. This ensures tag-based access controls and cost allocation tags are preserved. + +For complete details on RDS PITR restore parameters, see: + + * [RestoreDBInstanceToPointInTime](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBInstanceToPointInTime.html) in the Amazon RDS API Reference + + * [RestoreDBClusterToPointInTime](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBClusterToPointInTime.html) in the Amazon RDS API Reference + + + +