Copying an Amazon RDS Custom for SQL Server DB snapshot
With RDS Custom for SQL Server, you can copy automated backups and manual DB snapshots. After copying a snapshot, the copy you create is a manual snapshot. You can make multiple copies of an automated backup or manual snapshot but each copy must have a unique identifier.
You can only copy a snapshot within the same AWS account across different AWS Regions where RDS Custom for SQL Server is available. The following operations are currently not supported:
Copying DB snapshots within the same AWS Region.
Copying DB snapshots across AWS accounts.
RDS Custom for SQL Server supports incremental snapshot copying. For more information, see Considerations for incremental snapshot copying.
Topics
Limitations
The following limitations apply to copying a DB snapshot for RDS Custom for SQL Server:
-
If you delete a source snapshot before the target snapshot becomes available, the snapshot copy might fail. Verify that the target snapshot has a status of
AVAILABLEbefore you delete the source snapshot. -
You cannot specify an option group name or copy an options group in your DB snapshot copy request.
-
If you delete any dependent AWS resources of the source DB snapshot before or during the copy process, your copy snapshot request could fail asynchronously.
-
If you delete the Service Master Key (SMK) backup file for your source DB instance stored in the RDS Custom managed S3 bucket in your account, the DB snapshot copy succeeds asynchronously. However, SQL Server features dependent on SMK such as TDE enabled databases run into issues. For more information, see Troubleshooting PENDING_RECOVERY state for TDE enabled databases in RDS Custom for SQL Server.
-
Copying DB snapshots within the same AWS Region is currently not supported.
Copying DB snapshots across AWS accounts is currently not supported.
The limitations of copying a DB snapshot for Amazon RDS also apply to RDS Custom for SQL Server. For more information, see Limitations.
Handling encryption
All RDS Custom for SQL Server DB instances and DB snapshots are encrypted with KMS keys. You can only copy an encrypted snapshot to an encrypted snapshot, therefore you must specify a KMS key valid in the destination AWS Region for your DB snapshot copy request.
The source snapshot remains encrypted throughout the copy process. Amazon RDS uses envelope encryption to protect data during the copy operation with the specified destination AWS Region KMS key. For more information, see Envelope encryption in the AWS Key Management Service Developer Guide.
Cross-Region copying
You can copy DB snapshots across AWS Regions. However, there are certain constraints and considerations for cross-Region snapshot copying.
Authorizing RDS to communicate across AWS Regions for snapshot copying
After a cross-Region DB snapshot copy request is processed successfully, RDS starts the copy. An authorization request for RDS to access the source snapshot is created. This authorization request links the source DB snapshot to the target DB snapshot. This allows RDS to copy only to the specified target snapshot.
RDS verifies the authorization by using the rds:CrossRegionCommunication permission in the service-linked IAM role.
If the copy is authorized, RDS can communicate with the source Region and complete the copy operation.
RDS doesn’t have access to DB snapshots that weren't authorized previously by a CopyDBSnapshot request. The authorization is revoked after the copy completes.
RDS uses the service-linked role to verify the authorization in the source Region. The copy fails if you delete the service-linked role during the copy process.
For more information, see Using service-linked roles in the AWS Identity and Access Management User Guide.
Using AWS Security Token Service credentials
Session tokens from the global AWS Security Token Service (AWS STS) endpoint are valid only in AWS Regions that are enabled by default (commercial Regions).
If you use credentials from the assumeRole API operation in AWS STS, use the regional endpoint if the source Region is an opt-in Region.
Otherwise, the request fails. Your credentials must be valid in both Regions, which is true for opt-in Regions only when you use the regional AWS STS endpoint.
To use the global endpoint, make sure that it's enabled for both Regions in the operations.
Set the global endpoint to Valid in all AWS Regions in the AWS STS account settings.
For more information, see Managing AWS STS in an AWS Region in the AWS Identity and Access Management User Guide.
Snapshots of DB instances created with Custom Engine Versions (CEV)
For a DB snapshot of a DB instance using a Custom Engine Version (CEV), RDS associates the CEV with the DB snapshot. To copy a source DB snapshot associated with a CEV across AWS Regions, RDS copies the CEV along with the source DB snapshot to the destination region.
If you are copying multiple DB snapshots associated with the same CEV to the same destination region,
the first copy request copies the associated CEV. The copy process of the following requests finds
the initially copied CEV and associates it with the following DB snapshot copies.
The existing CEV copy must be in AVAILABLE state to be associated with the DB snapshot copies.
To copy a DB snapshot associated with a CEV, the requester's IAM policy must have the permissions to authorize both the DB snapshot copying and the associated CEV copying. The following permissions are needed in your requester's IAM policy to allow the associated CEV copying:
-
rds:CopyCustomDBEngineVersion‐ Your requester IAM principal needs to have the permission to copy the source CEV to the target region along with the source DB snapshot. The snapshot copy request fails due to authorization errors if your requester IAM principal is not authorized to copy the source CEV. -
ec2:CreateTags‐ The underlying EC2 AMI of the source CEV is copied to the target region as a part of the CEV copy. RDS Custom attempts to tag the AMI with theAWSRDSCustomtag before copying the AMI. Make sure your requester IAM principal has the permission to create the tag against the AMI underlying the source CEV in the source region.
For more information about CEV copying permissions, see Grant required permissions to your IAM principal.
Grant required permissions to your IAM principal
Make sure that you have sufficient access to copy a RDS Custom for SQL Server DB snapshot. The IAM role or user (referred to as the IAM principal) for copying a DB snapshot using the console or CLI must have either of the following policies for successful DB instance creation:
-
The
AdministratorAccesspolicy or, -
The
AmazonRDSFullAccesspolicy with the following additional permissions:s3:CreateBucket s3:GetBucketPolicy s3:PutBucketPolicy kms:CreateGrant kms:DescribeKey ec2:CreateTags
RDS Custom uses these permissions during snapshot copying across AWS Regions.
These permissions configure resources in your account that are required for RDS Custom operations.
For more information about the kms:CreateGrant permission,
see AWS KMS key management.
The following sample JSON policy grants the required permissions
in addition to AmazonRDSFullAccess policy.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "CreateS3BucketAndReadWriteBucketPolicy", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": "arn:aws:s3:::do-not-delete-rds-custom-*" }, { "Sid": "CreateKmsGrant", "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:DescribeKey" ], "Resource": "*" }, { "Sid": "CreateEc2Tags", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*" } ] }
Note
Make sure that the listed permissions aren't restricted by service control policies (SCPs), permission boundaries, or session policies associated with the IAM principal.
If you use conditions with context keys in the requester's IAM policy, certain conditions can cause the request to fail. For more information about common pitfalls due to IAM policy conditions, see Requesting a cross-Region DB snapshot copy.
Copying a DB snapshot
Use the following procedures to copy a DB snapshot. For each AWS account,
you can copy up to 20 DB snapshots at a time from one AWS Region to another.
If you copy a DB snapshot to another AWS Region, you create a manual DB snapshot
that is retained in that AWS Region. Copying a DB snapshot out of the source AWS Region
incurs Amazon RDS data transfer charges. For more information about data transfer pricing, see Amazon RDS pricing
After the DB snapshot copy has been created in the new AWS Region, the DB snapshot copy behaves the same as all other DB snapshots in that AWS Region.
You can copy a DB snapshot using the AWS Management Console, AWS CLI, or the Amazon RDS API.
