AWS aws-backup documentation change
Summary
Added documentation for EKS restore status messages and skipped objects during Kubernetes restore operations.
Security assessment
The change clarifies restore behavior for system-managed Kubernetes objects but doesn't address security vulnerabilities or introduce security features. Skipped objects relate to operational constraints (e.g., EKS-managed resources) rather than security weaknesses.
Diff
diff --git a/aws-backup/latest/devguide/restoring-eks.md b/aws-backup/latest/devguide/restoring-eks.md index 6862f3a1f..d62c4d4a0 100644 --- a//aws-backup/latest/devguide/restoring-eks.md +++ b//aws-backup/latest/devguide/restoring-eks.md @@ -285,0 +286,31 @@ You can subscribe to **Notification Events** for failed and skipped objects for +**Amazon EKS restore status messages** + +When a restore job completes, you might see the following status messages. The table shows the possible scenarios and their corresponding job status values: + +Scenario | Job Status | Example message +---|---|--- +All objects restored successfully | COMPLETED | — +One or more objects failed to be restored | COMPLETED | "One or more Kubernetes objects failed to restore. To get notified of these failures, enable SNS event notifications." +Restore could not complete | FAILED | (error details) + +**Skipped objects during restore** + +The following Kubernetes objects are restored on a best-effort basis. If they fail to restore, they are moved to the skipped list. These objects are system-managed and recreated by Kubernetes or Amazon EKS: + + * FlowSchemas with the `apf.kubernetes.io/autoupdate-spec: "true"` annotation + + * PriorityLevelConfigurations with the `apf.kubernetes.io/autoupdate-spec: "true"` annotation + + * The `eks-exempt` FlowSchema (EKS-managed, references the protected exempt PriorityLevelConfiguration) + + * The `kubernetes` Service in the `default` namespace (API server endpoint) + + * The `kube-dns` Service in the `kube-system` namespace (CoreDNS) + + + + +Objects that already exist on the target cluster are also skipped. EKS restores are non-destructive — existing objects are never overwritten or deleted. + +To receive notifications about skipped or failed objects during restore, subscribe to [SNS event notifications](https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-notifications.html). For more information, see [ Notification options with AWS Backup](https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-notifications.html). +