Sharing a DB cluster snapshot

Using Amazon RDS, you can share a manual DB cluster snapshot in the following ways:

For more information on copying a snapshot, see Copying a DB cluster snapshot. For more information on restoring a DB instance from a DB cluster snapshot, see Restoring from a DB cluster snapshot.

For more information on restoring a DB cluster from a DB cluster snapshot, see Overview of backing up and restoring an Aurora DB cluster.

You can share a manual snapshot with up to 20 other Amazon accounts.

The following limitation applies when sharing manual snapshots with other Amazon accounts:

Sharing public snapshots

You can also share an unencrypted manual snapshot as public, which makes the snapshot available to all Amazon accounts. Make sure when sharing a snapshot as public that none of your private information is included in the public snapshot.

When a snapshot is shared publicly, it gives all Amazon accounts permission both to copy the snapshot and to create DB clusters from it.

You aren't billed for the backup storage of public snapshots owned by other accounts. You're billed only for snapshots that you own.

If you copy a public snapshot, you own the copy. You're billed for the backup storage of your snapshot copy. If you create a DB cluster from a public snapshot, you're billed for that DB cluster. For Amazon Aurora pricing information, see the Aurora pricing page.

You can delete only the public snapshots that you own. To delete a shared or public snapshot, make sure to log into the Amazon account that owns the snapshot.

Viewing public snapshots owned by other Amazon accounts

You can view public snapshots owned by other accounts in a particular Amazon Region on the Public tab of the Snapshots page in the Amazon RDS console. Your snapshots (those owned by your account) don't appear on this tab.

Viewing your own public snapshots

You can use the following Amazon CLI command (Unix only) to view the public snapshots owned by your Amazon account in a particular Amazon Region.

aws rds describe-db-cluster-snapshots --snapshot-type public --include-public | grep account_number

The output returned is similar to the following example if you have public snapshots.

"DBClusterSnapshotArn": "arn:aws-cn:rds:us-west-2:123456789012:cluster-snapshot:myclustersnapshot1",
"DBClusterSnapshotArn": "arn:aws-cn:rds:us-west-2:123456789012:cluster-snapshot:myclustersnapshot2",

Sharing encrypted snapshots

You can share DB cluster snapshots that have been encrypted "at rest" using the AES-256 encryption algorithm, as described in Encrypting Amazon Aurora resources. To do this, take the following steps:

These restrictions apply to sharing encrypted snapshots:

Allowing access to an Amazon KMS key

For another Amazon account to copy an encrypted DB cluster snapshot shared from your account, the account that you share your snapshot with must have access to the Amazon KMS key that encrypted the snapshot.

To allow another Amazon account access to a KMS key, update the key policy for the KMS key. You update it with the Amazon Resource Name (ARN) of the Amazon account that you are sharing to as Principal in the KMS key policy. Then you allow the kms:CreateGrant action.

After you have given an Amazon account access to your KMS key, to copy your encrypted snapshot that Amazon account must create an Amazon Identity and Access Management (IAM) role or user if it doesn't already have one. In addition, that Amazon account must also attach an IAM policy to that IAM role or permission set that allows the role or user to copy an encrypted DB cluster snapshot using your KMS key. The account must be a user and cannot be a root Amazon account identity due to Amazon KMS security restrictions.

In the following key policy example, user 111122223333 is the owner of the KMS key, and user 444455556666 is the account that the key is being shared with. This updated key policy gives the Amazon account access to the KMS key by including the ARN for the root Amazon account identity for user 444455556666 as a Principal for the policy, and by allowing the kms:CreateGrant action.

{
  "Id": "key-policy-1",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Allow use of the key",
      "Effect": "Allow",
      "Principal": {"Amazon": [
        "arn:aws-cn:iam::111122223333:user/KeyUser",
        "arn:aws-cn:iam::444455556666:root"
      ]},
      "Action": [
        "kms:CreateGrant",
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Allow attachment of persistent resources",
      "Effect": "Allow",
      "Principal": {"Amazon": [
        "arn:aws-cn:iam::111122223333:user/KeyUser",
        "arn:aws-cn:iam::444455556666:root"
      ]},
      "Action": [
        "kms:CreateGrant",
        "kms:ListGrants",
        "kms:RevokeGrant"
      ],
      "Resource": "*",
      "Condition": {"Bool": {"kms:GrantIsForAWSResource": true}}
    }
  ]
}				
			

Creating an IAM policy to enable copying of the encrypted snapshot

Once the external Amazon account has access to your KMS key, the owner of that Amazon account can create a policy that allows a user created for that account to copy an encrypted snapshot encrypted with that KMS key.

The following example shows a policy that can be attached to a user for Amazon account 444455556666 that enables the user to copy a shared snapshot from Amazon account 111122223333 that has been encrypted with the KMS key c989c1dd-a3f2-4a5d-8d96-e793d082ab26 in the us-west-2 region.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowUseOfTheKey",
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey",
                "kms:CreateGrant",
                "kms:RetireGrant"
            ],
            "Resource": ["arn:aws-cn:kms:us-west-2:111122223333:key/c989c1dd-a3f2-4a5d-8d96-e793d082ab26"]
        },
        {
            "Sid": "AllowAttachmentOfPersistentResources",
            "Effect": "Allow",
            "Action": [
                "kms:CreateGrant",
                "kms:ListGrants",
                "kms:RevokeGrant"
            ],
            "Resource": ["arn:aws-cn:kms:us-west-2:111122223333:key/c989c1dd-a3f2-4a5d-8d96-e793d082ab26"],
            "Condition": {
                "Bool": {
                    "kms:GrantIsForAWSResource": true
                }
            }
        }
    ]
}
			

For details on updating a key policy, see Key policies in the Amazon KMS Developer Guide.

Sharing a snapshot

You can share a DB cluster snapshot using the Amazon Web Services Management Console, the Amazon CLI, or the RDS API.

aws rds modify-db-cluster-snapshot-attribute \
--db-cluster-snapshot-identifier cluster-3-snapshot \
--attribute-name restore \
--values-to-add 123456789012

aws rds modify-db-cluster-snapshot-attribute ^
--db-cluster-snapshot-identifier cluster-3-snapshot ^
--attribute-name restore ^
--values-to-add 123456789012

aws rds modify-db-cluster-snapshot-attribute \
--db-cluster-snapshot-identifier manual-cluster-snapshot1 \
--attribute-name restore \
--values-to-add {"111122223333","444455556666"}

aws rds modify-db-cluster-snapshot-attribute ^
--db-cluster-snapshot-identifier manual-cluster-snapshot1 ^
--attribute-name restore ^
--values-to-add "[\"111122223333\",\"444455556666\"]"

aws rds modify-db-cluster-snapshot-attribute \
--db-cluster-snapshot-identifier manual-cluster-snapshot1 \
--attribute-name restore \
--values-to-remove 444455556666

aws rds modify-db-cluster-snapshot-attribute ^
--db-cluster-snapshot-identifier manual-cluster-snapshot1 ^
--attribute-name restore ^
--values-to-remove 444455556666