Sharing a DB cluster snapshot - Amazon Aurora
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Sharing a DB cluster snapshot

Using Amazon RDS, you can share a manual DB cluster snapshot in the following ways:

  • Sharing a manual DB cluster snapshot, whether encrypted or unencrypted, enables authorized Amazon accounts to copy the snapshot.

  • Sharing a manual DB cluster snapshot, whether encrypted or unencrypted, enables authorized Amazon accounts to directly restore a DB cluster from the snapshot instead of taking a copy of it and restoring from that.

Note

To share an automated DB cluster snapshot, create a manual DB cluster snapshot by copying the automated snapshot, and then share that copy. This process also applies to Amazon Backup–generated resources.

For more information on copying a snapshot, see Copying a DB cluster snapshot. For more information on restoring a DB instance from a DB cluster snapshot, see Restoring from a DB cluster snapshot.

For more information on restoring a DB cluster from a DB cluster snapshot, see Overview of backing up and restoring an Aurora DB cluster.

You can share a manual snapshot with up to 20 other Amazon Web Services accounts.

The following limitation applies when sharing manual snapshots with other Amazon Web Services accounts:

  • When you restore a DB cluster from a shared snapshot using the Amazon Command Line Interface (Amazon CLI) or Amazon RDS API, you must specify the Amazon Resource Name (ARN) of the shared snapshot as the snapshot identifier.

Sharing public snapshots

You can also share an unencrypted manual snapshot as public, which makes the snapshot available to all Amazon Web Services accounts. Make sure when sharing a snapshot as public that none of your private information is included in the public snapshot.

When a snapshot is shared publicly, it gives all Amazon Web Services accounts permission both to copy the snapshot and to create DB clusters from it.

You aren't billed for the backup storage of public snapshots owned by other accounts. You're billed only for snapshots that you own.

If you copy a public snapshot, you own the copy. You're billed for the backup storage of your snapshot copy. If you create a DB cluster from a public snapshot, you're billed for that DB cluster. For Amazon Aurora pricing information, see the Aurora pricing page.

You can delete only the public snapshots that you own. To delete a shared or public snapshot, make sure to log into the Amazon Web Services account that owns the snapshot.

Viewing public snapshots owned by other Amazon Web Services accounts

You can view public snapshots owned by other accounts in a particular Amazon Web Services Region on the Public tab of the Snapshots page in the Amazon RDS console. Your snapshots (those owned by your account) don't appear on this tab.

To view public snapshots
  1. Open the Amazon RDS console at https://console.amazonaws.cn/rds/.

  2. In the navigation pane, choose Snapshots.

  3. Choose the Public tab.

    The public snapshots appear. You can see which account owns a public snapshot in the Owner column.

    Note

    You might have to modify the page preferences, by selecting the gear icon at the upper right of the Public snapshots list, to see this column.

Viewing your own public snapshots

You can use the following Amazon CLI command (Unix only) to view the public snapshots owned by your Amazon Web Services account in a particular Amazon Web Services Region.

aws rds describe-db-cluster-snapshots --snapshot-type public --include-public | grep account_number

The output returned is similar to the following example if you have public snapshots.

"DBClusterSnapshotArn": "arn:aws-cn:rds:us-west-2:123456789012:cluster-snapshot:myclustersnapshot1", "DBClusterSnapshotArn": "arn:aws-cn:rds:us-west-2:123456789012:cluster-snapshot:myclustersnapshot2",

Sharing a snapshot

You can share a DB cluster snapshot using the Amazon Web Services Management Console, the Amazon CLI, or the RDS API.

Using the Amazon RDS console, you can share a manual DB cluster snapshot with up to 20 Amazon Web Services accounts. You can also use the console to stop sharing a manual snapshot with one or more accounts.

To share a manual DB cluster snapshot by using the Amazon RDS console
  1. Sign in to the Amazon Web Services Management Console and open the Amazon RDS console at https://console.amazonaws.cn/rds/.

  2. In the navigation pane, choose Snapshots.

  3. Select the manual snapshot that you want to share.

  4. For Actions, choose Share snapshot.

  5. Choose one of the following options for DB snapshot visibility.

    • If the source is unencrypted, choose Public to permit all Amazon Web Services accounts to restore a DB cluster from your manual DB cluster snapshot, or choose Private to permit only Amazon Web Services accounts that you specify to restore a DB cluster from your manual DB cluster snapshot.

      Warning

      If you set DB snapshot visibility to Public, all Amazon Web Services accounts can restore a DB cluster from your manual DB cluster snapshot and have access to your data. Do not share any manual DB cluster snapshots that contain private information as Public.

    • If the source is encrypted, DB snapshot visibility is set as Private because encrypted snapshots can't be shared as public.

      Note

      Snapshots that have been encrypted with the default Amazon KMS key can't be shared. For information on how to work around this issue, see Sharing encrypted snapshots.

  6. For Amazon Account ID, enter the Amazon Web Services account identifier for an account that you want to permit to restore a DB cluster from your manual snapshot, and then choose Add. Repeat to include additional Amazon Web Services account identifiers, up to 20 Amazon Web Services accounts.

    If you make an error when adding an Amazon Web Services account identifier to the list of permitted accounts, you can delete it from the list by choosing Delete at the right of the incorrect Amazon Web Services account identifier.

    
                                Permit Amazon Web Services accounts to restore a manual DB cluster snapshot
  7. After you have added identifiers for all of the Amazon Web Services accounts that you want to permit to restore the manual snapshot, choose Save to save your changes.

To share a DB cluster snapshot, use the aws rds modify-db-cluster-snapshot-attribute command. Use the --values-to-add parameter to add a list of the IDs for the Amazon Web Services accounts that are authorized to restore the manual snapshot.

Example of sharing a snapshot with a single account

The following example enables Amazon Web Services account identifier 123456789012 to restore the DB cluster snapshot named cluster-3-snapshot.

For Linux, macOS, or Unix:

aws rds modify-db-cluster-snapshot-attribute \ --db-cluster-snapshot-identifier cluster-3-snapshot \ --attribute-name restore \ --values-to-add 123456789012

For Windows:

aws rds modify-db-cluster-snapshot-attribute ^ --db-cluster-snapshot-identifier cluster-3-snapshot ^ --attribute-name restore ^ --values-to-add 123456789012
Example of sharing a snapshot with multiple accounts

The following example enables two Amazon Web Services account identifiers, 111122223333 and 444455556666, to restore the DB cluster snapshot named manual-cluster-snapshot1.

For Linux, macOS, or Unix:

aws rds modify-db-cluster-snapshot-attribute \ --db-cluster-snapshot-identifier manual-cluster-snapshot1 \ --attribute-name restore \ --values-to-add {"111122223333","444455556666"}

For Windows:

aws rds modify-db-cluster-snapshot-attribute ^ --db-cluster-snapshot-identifier manual-cluster-snapshot1 ^ --attribute-name restore ^ --values-to-add "[\"111122223333\",\"444455556666\"]"
Note

When using the Windows command prompt, you must escape double quotes (") in JSON code by prefixing them with a backslash (\).

To list the Amazon Web Services accounts enabled to restore a snapshot, use the describe-db-cluster-snapshot-attributes Amazon CLI command.

You can also share a manual DB cluster snapshot with other Amazon Web Services accounts by using the Amazon RDS API. To do so, call the ModifyDBClusterSnapshotAttribute operation. Specify restore for AttributeName, and use the ValuesToAdd parameter to add a list of the IDs for the Amazon Web Services accounts that are authorized to restore the manual snapshot.

To make a manual snapshot public and restorable by all Amazon Web Services accounts, use the value all. However, take care not to add the all value for any manual snapshots that contain private information that you don't want to be available to all Amazon Web Services accounts. Also, don't specify all for encrypted snapshots, because making such snapshots public isn't supported.

To list all of the Amazon Web Services accounts permitted to restore a snapshot, use the DescribeDBClusterSnapshotAttributes API operation.

Sharing encrypted snapshots

You can share DB cluster snapshots that have been encrypted "at rest" using the AES-256 encryption algorithm, as described in Encrypting Amazon Aurora resources.

The following restrictions apply to sharing encrypted snapshots:

  • You can't share encrypted snapshots as public.

  • You can't share a snapshot that has been encrypted using the default KMS key of the Amazon Web Services account that shared the snapshot.

To work around the default KMS key issue, perform the following tasks:

Create a customer managed key and give access to it

First you create a custom KMS key in the same Amazon Web Services Region as the encrypted DB cluster snapshot. While creating the customer managed key, you give access to it for another Amazon Web Services account.

To create a customer managed key and give access to it
  1. Sign in to the Amazon Web Services Management Console from the source Amazon Web Services account.

  2. Open the Amazon KMS console at https://console.amazonaws.cn/kms.

  3. To change the Amazon Web Services Region, use the Region selector in the upper-right corner of the page.

  4. In the navigation pane, choose Customer managed keys.

  5. Choose Create key.

  6. On the Configure key page:

    1. For Key type, select Symmetric.

    2. For Key usage, select Encrypt and decrypt.

    3. Expand Advanced options.

    4. For Key material origin, select KMS.

    5. For Regionality, select Single-Region key.

    6. Choose Next.

  7. On the Add labels page:

    1. For Alias. enter a display name for your KMS key, for example share-snapshot.

    2. (Optional) Enter a description for your KMS key.

    3. (Optional) Add tags to your KMS key.

    4. Choose Next.

  8. On the Define key administrative permissions page, choose Next.

  9. On the Define key usage permissions page:

    1. For Other Amazon Web Services accounts, choose Add another Amazon Web Services account.

    2. Enter the ID of the Amazon Web Services account to which you want to give access.

      You can give access to multiple Amazon Web Services accounts.

    3. Choose Next.

  10. Review your KMS key, then choose Finish.

Copy and share the snapshot from the source account

Next you copy the source DB cluster snapshot to a new snapshot using the customer managed key. Then you share it with the target Amazon Web Services account.

To copy and share the snapshot
  1. Sign in to the Amazon Web Services Management Console from the source Amazon Web Services account.

  2. Open the Amazon RDS console at https://console.amazonaws.cn/rds/

  3. In the navigation pane, choose Snapshots.

  4. Select the DB cluster snapshot you want to copy.

  5. For Actions, choose Copy snapshot.

  6. On the Copy snapshot page:

    1. For Destination Region, choose the Amazon Web Services Region where you created the customer managed key in the previous procedure.

    2. Enter the name of the DB cluster snapshot copy in New DB Snapshot Identifier.

    3. For Amazon KMS key, choose the customer managed key that you created.

      
                                    Choose the customer managed key.
    4. Choose Copy snapshot.

  7. When the snapshot copy is available, select it.

  8. For Actions, choose Share snapshot.

  9. On the Snapshot permissions page:

    1. Enter the Amazon Web Services account ID with which you're sharing the snapshot copy, then choose Add.

    2. Choose Save.

    The snapshot is shared.

Copy the shared snapshot in the target account

Now you can copy the shared snapshot in the target Amazon Web Services account.

To copy the shared snapshot
  1. Sign in to the Amazon Web Services Management Console from the target Amazon Web Services account.

  2. Open the Amazon RDS console at https://console.amazonaws.cn/rds/

  3. In the navigation pane, choose Snapshots.

  4. Choose the Shared with me tab.

  5. Select the shared snapshot.

  6. For Actions, choose Copy snapshot.

  7. Choose your settings for copying the snapshot as in the previous procedure, but use an Amazon KMS key that belongs to the target account.

    Choose Copy snapshot.

Stopping snapshot sharing

To stop sharing a DB cluster snapshot, you remove permission from the target Amazon Web Services account.

To stop sharing a manual DB cluster snapshot with an Amazon Web Services account
  1. Sign in to the Amazon Web Services Management Console and open the Amazon RDS console at https://console.amazonaws.cn/rds/.

  2. In the navigation pane, choose Snapshots.

  3. Select the manual snapshot that you want to stop sharing.

  4. Choose Actions, and then choose Share snapshot.

  5. To remove permission for an Amazon Web Services account, choose Delete for the Amazon account identifier for that account from the list of authorized accounts.

  6. Choose Save to save your changes.

To remove an Amazon Web Services account identifier from the list, use the --values-to-remove parameter.

Example of stopping snapshot sharing

The following example prevents Amazon Web Services account ID 444455556666 from restoring the snapshot.

For Linux, macOS, or Unix:

aws rds modify-db-cluster-snapshot-attribute \ --db-cluster-snapshot-identifier manual-cluster-snapshot1 \ --attribute-name restore \ --values-to-remove 444455556666

For Windows:

aws rds modify-db-cluster-snapshot-attribute ^ --db-cluster-snapshot-identifier manual-cluster-snapshot1 ^ --attribute-name restore ^ --values-to-remove 444455556666

To remove sharing permission for an Amazon Web Services account, use the ModifyDBClusterSnapshotAttribute operation with AttributeName set to restore and the ValuesToRemove parameter. To mark a manual snapshot as private, remove the value all from the values list for the restore attribute.