本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。
AWSSupport-ShareRDSSnapshot
描述
The AWSSupport-ShareRDSSnapshot
document provides an automated solution for the procedure outlined in the Knowledge
Center article How can I share an encrypted Amazon RDS DB snapshot with another account?SnapshotName
parameter, or the latest snapshot found for the selected Amazon RDS DB instance or
cluster.
If you do not specify a value for the KMSKey
parameter, the automation creates a new AWS KMS CMK in your account that is used
to encrypt the snapshot.
文档类型
Automation
所有者
Amazon
平台
数据库
参数
-
AccountIds
Type: StringList
描述:(Required) Comma-separated list of account IDs to share the snapshot with.
-
AutomationAssumeRole
类型:字符串
说明:(可选)允许 Systems Manager Automation 代表您执行操作的 AWS Identity and Access Management (IAM) 角色的 Amazon 资源名称 (ARN)。如果未指定任何角色,则 Systems Manager Automation 使用运行此文档的用户的权限。
-
数据库
类型: 字符串
描述:(Required) The name of the Amazon RDS DB instance or cluster whose snapshot you want to share. This parameter is optional if you specify a value for the
SnapshotName
parameter. -
KMSKey
类型: 字符串
描述:(Optional) The full Amazon Resource Name (ARN) of the AWS KMS CMK used to encrypt the snapshot.
-
SnapshotName
类型: 字符串
描述:(Optional) The ID of the DB cluster or instance snapshot that you want to use.
所需的 IAM 权限
AutomationAssumeRole
需要执行以下操作才能成功运行 Automation 文档。
-
ssm:StartAutomationExecution
-
rds:DescribeDBInstances
-
rds:DescribeDBSnapshots
-
rds:CopyDBSnapshot
-
rds:ModifyDBSnapshotAttribute
The AutomationAssumeRole
requires the following actions to successfully run the Automation document for a
DB cluster.
-
ssm:StartAutomationExecution
-
rds:DescribeDBClusters
-
rds:DescribeDBClusterSnapshots
-
rds:CopyDBClusterSnapshot
-
rds:ModifyDBClusterSnapshotAttribute
The IAM role used to run the automation must be added as a key user to use the AWS
KMS CMK specified in the ARNKmsKey
parameter. For information about adding key users to a AWS KMS CMK, see Changing a key policy in the AWS Key Management Service Developer Guide.
The AutomationAssumeRole
requires the following additional actions to successfully run the Automation document
if you do not specify a value for the KMSKey
parameter.
-
kms:CreateKey
-
kms:ScheduleKeyDeletion
文档步骤
-
aws:executeScript - Checks whether a value was provided for the
KMSKey
parameter, and creates a AWS KMS CMK if no value is found. -
aws:branch - Checks whether a value was provided for the
SnapshotName
parameter, and branches accordingly. -
aws:executeAwsApi - Checks whether the snapshot provided is from a DB instance.
-
aws:executeScript - Formats the
SnapshotName
parameter replacing colons with a hyphen. -
aws:executeAwsApi - Copies the snapshot using the specified
KMSKey
. -
aws:waitForAwsResourceProperty - Waits for the copy snapshot operation to complete.
-
aws:executeAwsApi - Shares the new snapshot with the
AccountIds
specified. -
aws:executeAwsApi - Checks whether the snapshot provided is from a DB cluster.
-
aws:executeScript - Formats the
SnapshotName
parameter replacing colons with a hyphen. -
aws:executeAwsApi - Copies the snapshot using the specified
KMSKey
. -
aws:waitForAwsResourceProperty - Waits for the copy snapshot operation to complete.
-
aws:executeAwsApi - Shares the new snapshot with the
AccountIds
specified. -
aws:executeAwsApi - Checks whether the value provided for the
Database
parameter is a DB instance. -
aws:executeAwsApi - Checks whether the value provided for the
Database
parameter is a DB cluster. -
aws:executeAwsApi - Retrieves a list of snapshots for the specified
Database
. -
aws:executeScript - Determines the latest snapshot available from the list assembled in the previous step.
-
aws:executeAwsApi - Copies the DB instance snapshot using the specified
KMSKey
. -
aws:waitForAwsResourceProperty - Waits for the copy snapshot operation to complete.
-
aws:executeAwsApi - Shares the new snapshot with the
AccountIds
specified. -
aws:executeAwsApi - Retrieves a list of snapshots for the specified
Database
. -
aws:executeScript - Determines the latest snapshot available from the list assembled in the previous step.
-
aws:executeAwsApi - Copies the DB instance snapshot using the specified
KMSKey
. -
aws:waitForAwsResourceProperty - Waits for the copy snapshot operation to complete.
-
aws:executeAwsApi - Shares the new snapshot with the
AccountIds
specified. -
aws:executeScript - Deletes the AWS KMS CMK created by the automation if you did not specify a value for the
KMSKey
parameter and the automation fails.