Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Sharing a DB Cluster Snapshot

Using Neptune, you can share a manual DB cluster snapshot in the following ways:

For more information about restoring a DB cluster from a DB cluster snapshot, see How to restore from a snapshot.

You can share a manual snapshot with up to 20 other Amazon accounts. You can also share an unencrypted manual snapshot as public, which makes the snapshot available to all Amazon accounts. Take care when sharing a snapshot as public so that none of your private information is included in any of your public snapshots.

Sharing an Encrypted DB Cluster Snapshot

You can share DB cluster snapshots that have been encrypted "at rest" using the AES-256 encryption algorithm. For more information, see Encrypting Neptune Resources at Rest. To do this, you must take the following steps:

These restrictions apply to sharing encrypted snapshots:

Allowing Access to an Amazon KMS Encryption Key

For another Amazon account to copy an encrypted DB cluster snapshot shared from your account, the account that you share your snapshot with must have access to the KMS key that encrypted the snapshot. To allow another Amazon account access to an Amazon KMS key, update the key policy for the KMS key with the ARN of the Amazon account that you are sharing to as a Principal in the KMS key policy. Then allow the kms:CreateGrant action. See Allowing users in other accounts to use a KMS key in the Amazon Key Management Service Developer Guide for general instructions.

After you have given an Amazon account access to your KMS encryption key, to copy your encrypted snapshot, that Amazon account must create an IAM user if it doesn’t already have one. KMS security restrictions don't permit use of a root Amazon account identity for this. The Amazon account must also attach an IAM policy to that IAM user that allows the IAM user to copy an encrypted DB cluster snapshot using your KMS key.

In the following key policy example, user 111122223333 is the owner of the KMS encryption key, and user 444455556666 is the account that the key is being shared with. This updated key policy gives the Amazon account access to the KMS key by including the ARN for the root Amazon account identity for user 444455556666 as a Principal for the policy, and by allowing the kms:CreateGrant action.

{
  "Id=": "key-policy-1",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid=": "Allow use of the key",
      "Effect": "Allow",
      "Principal": {"AWS": [
        "arn:aws-cn:iam::111122223333:user/KeyUser",
        "arn:aws-cn:iam::444455556666:root"
      ]},
      "Action": [
        "kms:CreateGrant",
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
      ],
      "Resource": "*"
    },
    {
      "Sid=": "Allow attachment of persistent resources",
      "Effect": "Allow",
      "Principal": {"AWS": [
        "arn:aws-cn:iam::111122223333:user/KeyUser",
        "arn:aws-cn:iam::444455556666:root"
      ]},
      "Action": [
        "kms:CreateGrant",
        "kms:ListGrants",
        "kms:RevokeGrant"
      ],
      "Resource": "*",
      "Condition": {"Bool": {"kms:GrantIsForAWSResource": true}}
    }
  ]
}

Creating an IAM Policy to Enable Copying of the Encrypted Snapshot

After the external Amazon account has access to your KMS key, the owner of that account can create a policy that allows an IAM user created for the account to copy an encrypted snapshot encrypted with that KMS key.

The following example shows a policy that can be attached to an IAM user for Amazon account 444455556666. It enables the IAM user to copy a shared snapshot from Amazon account 111122223333 that has been encrypted with the KMS key c989c1dd-a3f2-4a5d-8d96-e793d082ab26 in the us-west-2 Region.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid=": "AllowUseOfTheKey",
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey",
                "kms:CreateGrant",
                "kms:RetireGrant"
            ],
            "Resource": ["arn:aws-cn:kms:us-west-2:111122223333:key/c989c1dd-a3f2-4a5d-8d96-e793d082ab26"]
        },
        {
            "Sid=": "AllowAttachmentOfPersistentResources",
            "Effect": "Allow",
            "Action": [
                "kms:CreateGrant",
                "kms:ListGrants",
                "kms:RevokeGrant"
            ],
            "Resource": ["arn:aws-cn:kms:us-west-2:111122223333:key/c989c1dd-a3f2-4a5d-8d96-e793d082ab26"],
            "Condition": {
                "Bool": {
                    "kms:GrantIsForAWSResource": true
                }
            }
        }
    ]
}

For details on updating a key policy, see Key Policies in the Amazon Key Management Service Developer Guide.

Sharing a DB Cluster Snapshot

You can share a DB cluster snapshot using the Amazon Web Services Management Console, the Amazon CLI, or the Neptune API.

Using the Console to Share a DB Cluster Snapshot

Using the Neptune console, you can share a manual DB cluster snapshot with up to 20 Amazon accounts. You can also stop sharing a manual snapshot with one or more accounts.