{Neptune}Amazon Neptune DB クラスターのバックアップと復元

手動 DB クラスタースナップショットを共有すると、暗号化されているかいないかに関係なく、
権限のある DB クラスタースナップショットがAWSアカウントを使用して、DB クラスターをコピーしてそこから復元するのではなく、
スナップショットから DB クラスターを直接復元できます。

-- 1. KMSカスタマキーの作成
vim key01.json

{
"Id": "key01",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::999999999999:root"
},
"Action": "kms:*",
"Resource": "*"
},
{
"Sid": "Allow access for Key Administrators",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::999999999999:user/iamuser"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
},
{
"Sid": "Allow use of the key",
"Effect": "Allow",
"Principal": {"AWS": [
"arn:aws:iam::999999999999:user/iamuser",
"arn:aws:iam::888888888888:root"
]},
"Action": [
"kms:CreateGrant",
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": "*"
},
{
"Sid": "Allow attachment of persistent resources",
"Effect": "Allow",
"Principal": {"AWS": [
"arn:aws:iam::999999999999:user/iamuser",
"arn:aws:iam::888888888888:root"
]}, "Action": [
"kms:CreateGrant",
"kms:ListGrants",
"kms:RevokeGrant"
],
"Resource": "*",
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": "true"
}
}
}
]
}

aws kms create-key \
--description key01 \
--policy file://key01.json

-- 2. DBクラスター作成
cluster01 <-- 暗号化なし
cluster02 <-- 暗号化有

aws neptune create-db-cluster \
--db-cluster-identifier cluster01 \
--engine neptune \
--engine-version 1.0.5.0 \
--port 8182 \
--no-storage-encrypted \
--no-deletion-protection

aws neptune create-db-instance \
--db-cluster-identifier cluster01 \
--engine neptune \
--db-instance-identifier instance01 \
--db-instance-class db.t3.medium \
--no-multi-az \
--no-auto-minor-version-upgrade

aws neptune create-db-cluster \
--db-cluster-identifier cluster02 \
--engine neptune \
--engine-version 1.0.5.0 \
--port 8182 \
--storage-encrypted \
--no-deletion-protection \
--kms-key-id arn:aws:kms:ap-northeast-1:999999999999:key/11111111-2222-3333-4444-555555555555

aws neptune create-db-instance \
--db-cluster-identifier cluster02 \
--engine neptune \
--db-instance-identifier instance02 \
--db-instance-class db.t3.medium \
--no-multi-az \
--no-auto-minor-version-upgrade

aws neptune describe-db-clusters
aws neptune describe-db-instances

-- 3. ポイントインタイムに復元する

aws neptune restore-db-cluster-to-point-in-time \
--db-cluster-identifier cluster11 \
--source-db-cluster-identifier cluster01 \
--restore-to-time 2021-08-28T12:31:25.070Z

aws neptune create-db-instance \
--db-instance-identifier instance11 \
--db-instance-class db.t3.medium \
--engine neptune \
--no-auto-minor-version-upgrade \
--db-cluster-identifier cluster11

aws neptune restore-db-cluster-to-point-in-time \
--db-cluster-identifier cluster12 \
--source-db-cluster-identifier cluster02 \
--restore-to-time 2021-08-28T12:31:45.377Z

aws neptune create-db-instance \
--db-instance-identifier instance12 \
--db-instance-class db.t3.medium \
--engine neptune \
--no-auto-minor-version-upgrade \
--db-cluster-identifier cluster12

-- 4. クラスタースナップショットを作成する

aws neptune create-db-cluster-snapshot \
--db-cluster-identifier cluster01 \
--db-cluster-snapshot-identifier snap01

aws neptune create-db-cluster-snapshot \
--db-cluster-identifier cluster02 \
--db-cluster-snapshot-identifier snap02

-- 5. クラスタースナップショットからの復元

aws neptune restore-db-cluster-from-snapshot \
--db-cluster-identifier cluster21 \
--snapshot-identifier snap01 \
--engine neptune

aws neptune create-db-instance \
--db-instance-identifier instance21 \
--db-instance-class db.t3.medium \
--engine neptune \
--no-auto-minor-version-upgrade \
--db-cluster-identifier cluster21

aws neptune restore-db-cluster-from-snapshot \
--db-cluster-identifier cluster22 \
--snapshot-identifier snap02 \
--engine neptune

aws neptune create-db-instance \
--db-instance-identifier instance22 \
--db-instance-class db.t3.medium \
--engine neptune \
--no-auto-minor-version-upgrade \
--db-cluster-identifier cluster22

-- 6. クラスタースナップショットのコピー

-- ①Copy an unencrypted snapshot to the same Region

aws neptune copy-db-cluster-snapshot \
--source-db-cluster-snapshot-identifier snap01 \
--target-db-cluster-snapshot-identifier snap31

-- ②Copy an unencrypted snapshot across AWS Regions

export AWS_DEFAULT_REGION=ap-southeast-1
aws neptune copy-db-cluster-snapshot \
--source-db-cluster-snapshot-identifier arn:aws:rds:ap-northeast-1:999999999999:cluster-snapshot:snap01 \
--target-db-cluster-snapshot-identifier snap41

export AWS_DEFAULT_REGION=ap-northeast-1

-- ③Copy an encrypted snapshot to the same Region

aws neptune copy-db-cluster-snapshot \
--source-db-cluster-snapshot-identifier snap02 \
--target-db-cluster-snapshot-identifier snap32

-- ④Copy an encrypted snapshot across AWS Regions

export AWS_DEFAULT_REGION=ap-southeast-1

aws neptune copy-db-cluster-snapshot \
--source-db-cluster-snapshot-identifier arn:aws:rds:ap-northeast-1:999999999999:cluster-snapshot:snap02 \
--target-db-cluster-snapshot-identifier snap42 \
--source-region ap-northeast-1 \
--kms-key-id arn:aws:kms:ap-southeast-1:999999999999:key/66666666-7777-8888-9999-aaaaaaaaaaaa

export AWS_DEFAULT_REGION=ap-northeast-1

-- 7. クラスタースナップショットの共有

-- ①暗号化されていないスナップショットの共有

-- 共有の追加
aws neptune modify-db-cluster-snapshot-attribute \
--db-cluster-snapshot-identifier snap01 \
--attribute-name restore \
--values-to-add '["888888888888"]'

-- 共有の削除
aws neptune modify-db-cluster-snapshot-attribute \
--db-cluster-snapshot-identifier snap01 \
--attribute-name restore \
--values-to-remove '["888888888888"]'

-- ②暗号化されたスナップショットの共有

-- 共有の追加
aws neptune modify-db-cluster-snapshot-attribute \
--db-cluster-snapshot-identifier snap02 \
--attribute-name restore \
--values-to-add '["888888888888"]'

-- 共有の削除
aws neptune modify-db-cluster-snapshot-attribute \
--db-cluster-snapshot-identifier snap02 \
--attribute-name restore \
--values-to-remove '["888888888888"]'

※共有された暗号化スナップショットを復元する前に共有先のアカウントにスナップショットをコピーする必要はない
ただし、コンソールからは実行できない

-- 8. クリーンアップ

-- インスタンス削除
aws neptune delete-db-instance --db-instance-identifier instance01 --skip-final-snapshot
aws neptune delete-db-instance --db-instance-identifier instance02 --skip-final-snapshot

aws neptune delete-db-instance --db-instance-identifier instance11 --skip-final-snapshot
aws neptune delete-db-instance --db-instance-identifier instance12 --skip-final-snapshot

aws neptune delete-db-instance --db-instance-identifier instance21 --skip-final-snapshot
aws neptune delete-db-instance --db-instance-identifier instance22 --skip-final-snapshot

-- クラスター削除
aws neptune delete-db-cluster --db-cluster-identifier cluster01 --skip-final-snapshot
aws neptune delete-db-cluster --db-cluster-identifier cluster02 --skip-final-snapshot

aws neptune delete-db-cluster --db-cluster-identifier cluster11 --skip-final-snapshot
aws neptune delete-db-cluster --db-cluster-identifier cluster12 --skip-final-snapshot

aws neptune delete-db-cluster --db-cluster-identifier cluster21 --skip-final-snapshot
aws neptune delete-db-cluster --db-cluster-identifier cluster22 --skip-final-snapshot

-- クラスタースナップショットの削除

aws docdb delete-db-cluster-snapshot --db-cluster-snapshot-identifier snap01
aws docdb delete-db-cluster-snapshot --db-cluster-snapshot-identifier snap02

aws docdb delete-db-cluster-snapshot --db-cluster-snapshot-identifier snap31
aws docdb delete-db-cluster-snapshot --db-cluster-snapshot-identifier snap32

export AWS_DEFAULT_REGION=ap-southeast-1
aws docdb delete-db-cluster-snapshot --db-cluster-snapshot-identifier snap41
aws docdb delete-db-cluster-snapshot --db-cluster-snapshot-identifier snap42
export AWS_DEFAULT_REGION=ap-northeast-1

-- KMSキーの一覧
aws kms list-keys

-- KMSキーの削除

aws kms schedule-key-deletion \
--key-id arn:aws:kms:ap-northeast-1:999999999999:key/11111111-2222-3333-4444-555555555555 \
--pending-window-in-days 7

-- ap-southeast-1のKMSキーも削除必要