Sharing a DB snapshot

Using Amazon RDS, you can share a manual DB snapshot in the following ways:

For more information on copying a snapshot, see Copying a DB snapshot. For more information on restoring a DB instance from a DB snapshot, see Restoring from a DB snapshot.

You can share a manual snapshot with up to 20 other Amazon accounts.

The following limitations apply when sharing manual snapshots with other Amazon accounts:

Sharing public snapshots

You can also share an unencrypted manual snapshot as public, which makes the snapshot available to all Amazon accounts. Make sure when sharing a snapshot as public that none of your private information is included in the public snapshot.

When a snapshot is shared publicly, it gives all Amazon accounts permission both to copy the snapshot and to create DB instances from it.

You aren't billed for the backup storage of public snapshots owned by other accounts. You're billed only for snapshots that you own.

If you copy a public snapshot, you own the copy. You're billed for the backup storage of your snapshot copy. If you create a DB instance from a public snapshot, you're billed for that DB instance. For Amazon RDS pricing information, see the Amazon RDS product page.

You can delete only the public snapshots that you own. To delete a shared or public snapshot, make sure to log into the Amazon account that owns the snapshot.

Viewing public snapshots owned by other Amazon accounts

You can view public snapshots owned by other accounts in a particular Amazon Region on the Public tab of the Snapshots page in the Amazon RDS console. Your snapshots (those owned by your account) don't appear on this tab.

Viewing your own public snapshots

You can use the following Amazon CLI command (Unix only) to view the public snapshots owned by your Amazon account in a particular Amazon Region.

aws rds describe-db-snapshots --snapshot-type public --include-public | grep account_number

The output returned is similar to the following example if you have public snapshots.

"DBSnapshotArn": "arn:aws-cn:rds:us-east-1:123456789012:snapshot:mysnapshot1",
"DBSnapshotArn": "arn:aws-cn:rds:us-east-1:123456789012:snapshot:mysnapshot2",

Sharing encrypted snapshots

You can share DB snapshots that have been encrypted "at rest" using the AES-256 encryption algorithm, as described in Encrypting Amazon RDS resources. To do this, take the following steps:

These restrictions apply to sharing encrypted snapshots:

Allowing access to an Amazon KMS key

For another Amazon account to copy an encrypted DB snapshot shared from your account, the account that you share your snapshot with must have access to the Amazon KMS key that encrypted the snapshot.

To allow another Amazon account access to a KMS key, update the key policy for the KMS key. You update it with the Amazon Resource Name (ARN) of the Amazon account that you are sharing to as Principal in the KMS key policy. Then you allow the kms:CreateGrant action.

After you have given an Amazon account access to your KMS key, to copy your encrypted snapshot that Amazon account must create an Amazon Identity and Access Management (IAM) role or user if it doesn't already have one. In addition, that Amazon account must also attach an IAM policy to that IAM permission set or roles that allows the permission set or roles to copy an encrypted DB snapshot using your KMS key. The account must be an IAM user and can't be a root Amazon account identity due to Amazon KMS security restrictions.

In the following key policy example, user 111122223333 is the owner of the KMS key, and user 444455556666 is the account that the key is being shared with. This updated key policy gives the Amazon account access to the KMS key by including the ARN for the root Amazon account identity for user 444455556666 as a Principal for the policy, and by allowing the kms:CreateGrant action.

{
  "Id": "key-policy-1",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Allow use of the key",
      "Effect": "Allow",
      "Principal": {"Amazon": [
        "arn:aws-cn:iam::111122223333:user/KeyUser",
        "arn:aws-cn:iam::444455556666:root"
      ]},
      "Action": [
        "kms:CreateGrant",
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Allow attachment of persistent resources",
      "Effect": "Allow",
      "Principal": {"Amazon": [
        "arn:aws-cn:iam::111122223333:user/KeyUser",
        "arn:aws-cn:iam::444455556666:root"
      ]},
      "Action": [
        "kms:CreateGrant",
        "kms:ListGrants",
        "kms:RevokeGrant"
      ],
      "Resource": "*",
      "Condition": {"Bool": {"kms:GrantIsForAWSResource": true}}
    }
  ]
}				
			

Creating an IAM policy to enable copying of the encrypted snapshot

Once the external Amazon account has access to your KMS key, the owner of that Amazon account can create a policy that allows an IAM user created for that account to copy an encrypted snapshot encrypted with that KMS key.

The following example shows a policy that can be attached to an IAM user for Amazon account 444455556666 that enables the IAM user to copy a shared snapshot from Amazon account 111122223333 that has been encrypted with the KMS key c989c1dd-a3f2-4a5d-8d96-e793d082ab26 in the us-west-2 region.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowUseOfTheKey",
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey",
                "kms:CreateGrant",
                "kms:RetireGrant"
            ],
            "Resource": ["arn:aws-cn:kms:us-west-2:111122223333:key/c989c1dd-a3f2-4a5d-8d96-e793d082ab26"]
        },
        {
            "Sid": "AllowAttachmentOfPersistentResources",
            "Effect": "Allow",
            "Action": [
                "kms:CreateGrant",
                "kms:ListGrants",
                "kms:RevokeGrant"
            ],
            "Resource": ["arn:aws-cn:kms:us-west-2:111122223333:key/c989c1dd-a3f2-4a5d-8d96-e793d082ab26"],
            "Condition": {
                "Bool": {
                    "kms:GrantIsForAWSResource": true
                }
            }
        }
    ]
}
			

For details on updating a key policy, see Key policies in the Amazon KMS Developer Guide.

Sharing a snapshot

You can share a DB snapshot using the Amazon Web Services Management Console, the Amazon CLI, or the RDS API.

aws rds modify-db-snapshot-attribute \
--db-snapshot-identifier db7-snapshot \
--attribute-name restore \
--values-to-add 123456789012

aws rds modify-db-snapshot-attribute ^
--db-snapshot-identifier db7-snapshot ^
--attribute-name restore ^
--values-to-add 123456789012

aws rds modify-db-snapshot-attribute \
--db-snapshot-identifier manual-snapshot1 \
--attribute-name restore \
--values-to-add {"111122223333","444455556666"}

aws rds modify-db-snapshot-attribute ^
--db-snapshot-identifier manual-snapshot1 ^
--attribute-name restore ^
--values-to-add "[\"111122223333\",\"444455556666\"]"

aws rds modify-db-snapshot-attribute \
--db-snapshot-identifier manual-snapshot1 \
--attribute-name restore \
--values-to-remove 444455556666

aws rds modify-db-snapshot-attribute ^
--db-snapshot-identifier manual-snapshot1 ^
--attribute-name restore ^
--values-to-remove 444455556666