手動 DB クラスタースナップショットを共有すると、暗号化されているかいないかに関係なく、
権限を持つ AWS アカウントが DB クラスターをコピーしてそこから復元するのではなく、
スナップショットから DB クラスターを直接復元できるようになります。
-- 1. KMSカスタマキーの作成
vim key01.json
{
"Id": "key01",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::999999999999:root"
},
"Action": "kms:*",
"Resource": "*"
},
{
"Sid": "Allow access for Key Administrators",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::999999999999:user/iamuser"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
},
{
"Sid": "Allow use of the key",
"Effect": "Allow",
"Principal": {"AWS": [
"arn:aws:iam::999999999999:user/iamuser",
"arn:aws:iam::888888888888:root"
]},
"Action": [
"kms:CreateGrant",
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": "*"
},
{
"Sid": "Allow attachment of persistent resources",
"Effect": "Allow",
"Principal": {"AWS": [
"arn:aws:iam::999999999999:user/iamuser",
"arn:aws:iam::888888888888:root"
]}, "Action": [
"kms:CreateGrant",
"kms:ListGrants",
"kms:RevokeGrant"
],
"Resource": "*",
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": "true"
}
}
}
]
}
aws kms create-key \
--description key01 \
--policy file://key01.json
-- 2. DBクラスター作成
cluster01 <-- 暗号化なし
cluster02 <-- 暗号化有
aws rds create-db-cluster \
--db-cluster-identifier cluster01 \
--engine aurora-mysql \
--engine-version 5.7.mysql_aurora.2.10.0 \
--master-username root \
--master-user-password 'password'
aws rds create-db-instance \
--db-instance-identifier cluster01-instance01 \
--db-cluster-identifier cluster01 \
--db-instance-class db.t3.small \
--engine aurora-mysql \
--no-auto-minor-version-upgrade
aws rds create-db-cluster \
--db-cluster-identifier cluster02 \
--engine aurora-mysql \
--engine-version 5.7.mysql_aurora.2.10.0 \
--master-username root \
--master-user-password 'password' \
--storage-encrypted \
--kms-key-id arn:aws:kms:ap-northeast-1:999999999999:key/11111111-2222-3333-4444-555555555555
aws rds create-db-instance \
--db-instance-identifier cluster02-instance01 \
--db-cluster-identifier cluster02 \
--db-instance-class db.t3.small \
--engine aurora-mysql \
--no-auto-minor-version-upgrade
aws rds describe-db-clusters
aws rds describe-db-instances
-- 3. クラスタースナップショットを作成する
aws rds create-db-cluster-snapshot \
--db-cluster-identifier cluster01 \
--db-cluster-snapshot-identifier snap01
aws rds create-db-cluster-snapshot \
--db-cluster-identifier cluster02 \
--db-cluster-snapshot-identifier snap02
-- 4. クラスタースナップショットのコピー
-- ①Copy an unencrypted snapshot to the same Region
aws rds copy-db-cluster-snapshot \
--source-db-cluster-snapshot-identifier snap01 \
--target-db-cluster-snapshot-identifier snap11
-- ②Copy an unencrypted snapshot across AWS Regions
export AWS_DEFAULT_REGION=ap-northeast-3
aws rds copy-db-cluster-snapshot \
--source-db-cluster-snapshot-identifier arn:aws:rds:ap-northeast-1:999999999999:cluster-snapshot:snap01 \
--target-db-cluster-snapshot-identifier snap21
export AWS_DEFAULT_REGION=ap-northeast-1
-- ③Copy an encrypted snapshot to the same Region
aws rds copy-db-cluster-snapshot \
--source-db-cluster-snapshot-identifier snap02 \
--target-db-cluster-snapshot-identifier snap12
-- ④Copy an encrypted snapshot across AWS Regions
export AWS_DEFAULT_REGION=ap-northeast-3
aws rds copy-db-cluster-snapshot \
--source-db-cluster-snapshot-identifier arn:aws:rds:ap-northeast-1:999999999999:cluster-snapshot:snap02 \
--target-db-cluster-snapshot-identifier snap22 \
--source-region ap-northeast-1 \
--kms-key-id arn:aws:kms:ap-northeast-3:999999999999:key/11111111-2222-3333-4444-555555555555
export AWS_DEFAULT_REGION=ap-northeast-1
-- 5. クラスタースナップショットの共有
-- ①暗号化されていないスナップショットの共有
-- 共有の追加
aws rds modify-db-cluster-snapshot-attribute \
--db-cluster-snapshot-identifier snap01 \
--attribute-name restore \
--values-to-add 888888888888
-- 共有の削除
aws rds modify-db-cluster-snapshot-attribute \
--db-cluster-snapshot-identifier snap01 \
--attribute-name restore \
--values-to-remove 888888888888
-- ②暗号化されたスナップショットの共有
-- 共有の追加
aws rds modify-db-cluster-snapshot-attribute \
--db-cluster-snapshot-identifier snap02 \
--attribute-name restore \
--values-to-add 888888888888
-- 共有の削除
aws rds modify-db-cluster-snapshot-attribute \
--db-cluster-snapshot-identifier snap02 \
--attribute-name restore \
--values-to-remove 888888888888
※共有された暗号化スナップショットを復元する前に共有先のアカウントにスナップショットをコピーする必要はない
-- 6. クリーンアップ
-- インスタンス削除
aws rds delete-db-instance --db-instance-identifier cluster01-instance01 --skip-final-snapshot
aws rds delete-db-instance --db-instance-identifier cluster02-instance01 --skip-final-snapshot
-- クラスター削除
aws rds delete-db-cluster --db-cluster-identifier cluster01 --skip-final-snapshot
aws rds delete-db-cluster --db-cluster-identifier cluster02 --skip-final-snapshot
-- クラスタースナップショットの削除
aws docdb delete-db-cluster-snapshot --db-cluster-snapshot-identifier snap01
aws docdb delete-db-cluster-snapshot --db-cluster-snapshot-identifier snap02
aws docdb delete-db-cluster-snapshot --db-cluster-snapshot-identifier snap11
aws docdb delete-db-cluster-snapshot --db-cluster-snapshot-identifier snap12
export AWS_DEFAULT_REGION=ap-northeast-3
aws docdb delete-db-cluster-snapshot --db-cluster-snapshot-identifier snap21
aws docdb delete-db-cluster-snapshot --db-cluster-snapshot-identifier snap22
export AWS_DEFAULT_REGION=ap-northeast-1
-- KMSキーの一覧
aws kms list-keys
-- KMSキーの削除
aws kms schedule-key-deletion \
--key-id arn:aws:kms:ap-northeast-1:999999999999:key/11111111-2222-3333-4444-555555555555 \
--pending-window-in-days 7
-- ap-northeast-3のKMSキーも削除必要
