Field Notes: How to Back Up a Database with KMS Encryption Using AWS Backup
AWS Architecture BlogField Notes: How to Back Up a Database with KMS Encryption Using AWS Backupby Ram Konchada, Agasthi Kothurkar, and Girish Keshav | on19 AUG 2021| inAmazon RDS,Architecture,AWS Backup,Technical How-to|Permalink|ShareAn AWS security best practice fromThe 5 Pillars of the AWS Well-Architected Frameworkis to ensure that data is protected both in transit and at rest. One option is to use SSL/TLS to encrypt data in transit, and use cryptographic keys to encrypt data at rest. To meet your organization’s disaster recovery goals, periodic snapshots of databases should be scheduled and stored across Regions and across administrative accounts. This ensures quick Recovery Point Objective (RPO) and Recovery Time Objective (RTO).From a security standpoint, these snapshots should also be encrypted. Consider a scenario where one administrative AWS account is used for running theAmazon Relational Database Service (Amazon RDS)instance and backups. In this scenario, you may discover a situation where data cannot be recovered either from production instance or backups if this AWS account is compromised. Amazon RDS snapshots encrypted using AWS managed AWS KMS keys cannot be copied across accounts. Cross-account backup helps you avoid this situation.This blog post presents a solution that helps you to perform cross-account backup usingAWS Backupservice and restore database instance snapshots encrypted usingAWS Key Management Service (KMS)keys across the accounts. This can help you to meet your security, compliance, and business continuity requirements. Although the solution uses RDS as the database choice, it can be applied to other database services (with some limitations).ArchitectureFigure 1 illustrates the solution described in this blog post.Figure 1: Reference architecture for Amazon RDS with AWS Backup using KMS over two different accountsSolution overviewWhen your resources like Amazon RDS (including Aurora clusters) are encrypted, cross-account copy can only be performed if they are encrypted byAWS KMS customer managed keys. The default vault is encrypted using root keys. Therefore, to perform cross-account backups, you must use KMS key encrypted vaults instead of using your default backup vault.In the source account, create a backup of the Amazon RDS instance encrypted with customer managed key.Give the backup account access to the customer-managed AWS KMS encryption key used by the source account’s RDS instance.In the backup account, ensure that you have a backup vault encrypted using a customer-managed key created in the backup account. Also, make sure that this vault is shared with the different account using vault policy.Copy the encrypted snapshots to the target account. This will re-encrypt snapshots using the target vault account’s AWS KMS encryption keys in the target Region.PrerequisitesEnsure you are in the correct AWS Region of operation.Two AWS accounts within the sameAWS Organization.Source account where you have a KMS key encrypted Amazon RDS instance.Opt-in to cross-account backup.Backup account to which you will copy the encrypted snapshots.A backup vault encrypted with backup KMS key (different from source KMS key) in the backup account.AnIAM roleto perform cross-account backup. You can also use theAWSBackupDefaultServiceRole.SolutionIn this blog post, two accounts are used that are part of the same organization. Ensure that you update your account IDs accordingly.Source account – 111222333444AWS Backup account – 666777888999Create a customer-managed key in the source accountStep 1 – Create KMS keysCreatesymmetric and asymmetric KMS keysin theAWS Management Console. During this process, you will determine the cryptographic configuration of your KMS key and the origin of its key material. You cannot change these properties after the KMS key is created. You can also set the key policy for the KMS key, which can be changed later. Followkey rotation best practicesto ensure maximum security.ChooseCreate key.To create a symmetric KMS key, for key type chooseSymmetric. Use AWS KMS as the key material origin, and choose the single-region key for Regionality.ChooseNext, and proceed with Step 2.Step 2 – Add labelsType analiasfor the KMS key (alias cannot begin with aws/. The aws/ prefix is reserved by Amazon Web Services to represent AWS managed KMS keys in your account).Add a description that identifies the key usage.Add tags based on an appropriatetagging strategy.ChooseNext, and proceed with Step 3.Step 3 – Key administrative permissionsSelect the IAM users and roles that can administer the KMS key. Ensure that least privilege design is implemented when assigning roles and permissions, in addition to followingbest practices.Step 4 – Key usage permissionsNext, we will need to define the key usage and permissions. Complete the following steps:Select the IAM users and roles that can use the KMS key forcryptographic operations.Within theOther AWS accountssection, type the 12-digit account number of the backup account.Figure 2: Key usage permissionsStep 5 – Key configurationReview the chosen settings, and press theFinishbutton to complete key creation.Figure 3: Key configurationCross-account access key policyRead the blog post onsharing custom encryption keys more securely between accounts using AWS Key Management Servicefor more information.Step 6 – KMS key verificationWithin the AWS KMS console page, verify that the KMS key has been successfully created and status is enabled.Create an Amazon RDS database in source accountChoose the correct AWS Region.Navigate to RDS through the console search option.ChooseCreate a Databaseoption, and choose your Database type.InDatabase encryptionsettings, use the KMS key you created in the preceding steps.Create the database.Follow Amazon RDS security best practices.Automated backups are enabledYourdata is protected(both in transit and at rest)Audit logs are enabled for your RDSCreate an AWS Backup vault in the source accountOn the AWS Backup service, navigate to AWS Backup > AWS Backup vault.Create a backup vault by specifying the name, and add tags based on an appropriatetagging strategy.Create an on-demand AWS Backup in the source accountFor the purpose of this solution, we will create an on-demand backup from theAWS Backupdashboard. You can also choose an existing snapshot if it is already available.ChooseCreate on-demand backup. Choose resource type as Amazon RDS, and select the appropriate database name. Choose the option to create backup now. Complete the setup by providing an appropriate IAM role and tag values (you can use the prepopulated default IAM role).Wait for the backup to be created, processed, and completed. This may take several hours, depending on the size of the database. If this step is too close to an existing scheduled backup time, you may see the following message on the console:Note –this step might fail if the on-demand backup window is too close to or overlapping the scheduled backup time determined by the Amazon RDS service. If this occurs, then create an on-demand backup after the scheduled backup is completed.Figure 4: Create on-demand backupConfirm the status is completed once the backup process has finished.Figure 5: Completed on-demand backupIf you navigate to the backup vault you should see the recovery point stored within the source account’s vault.Figure 6: Backup vaultPrepare AWS Backup account (666777888999)Create SYMMETRIC KMS key in the backup accountFollow the same steps as before in creating a symmetric KMS key in backup account. Ensure that you do not grant access to the source AWS account to this key.Figure 7: KMS key in backup accountAdd IAM policy to users and roles to use KMS key created in source accountThe key policy in the account, that owns the KMS key, sets the valid range for permissions. But, users and roles in the external account cannot use the KMS key until you attach IAM policies that delegate those permissions or use grants to manage access to the KMS key. The IAM policies are set in the external account and follow thebest practices for IAM policies. Review the blog post onsharing custom encryption keys more securely between accounts using AWS Key Management Servicefor more information.Create an AWS Backup vault in backup accountIn the backup account, navigate to the “Backup vaults” section on the AWS Backup service page, and chooseCreate Backup vault. Next, provide a backup vault name, and choose the KMS key you previously created. In addition, you can specify Backup vault tags. Finally, press theCreate Backup vaultbutton.Figure 8: Create backup vaultAllow access to the backup vault from organization (or organizational unit)This step will enable multiple accounts with the organization to store snapshots in the backup vault.{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "backup:CopyIntoBackupVault","Resource": "*","Condition": {"StringEquals": {"aws:PrincipalOrgID": "o-XXXXXXXXXX"}}}]}Copy recovery point from source account vault to backup account vaultInitiate a recovery point copy by navigating to the backup vault in the source account, and create a copy job. Select the correct Region, provide the backup vault ARN, and press theCopybutton.Figure 9: Copy job initiationNext, allow the backup account to copy the data back into source account by adding permissions to your back vault “sourcebackupvault” access policy.Figure 10: Allow AWS Backup vault accessInitiate copy jobFrom the backup vault in the source account, press theCopybutton to copy a recovery point to the backup account (shown in Figure 11).Figure 11: Initiate copy jobVerify copy job is successfully completedVerify that the copy job is completed and the recovery point is copied successfully to the AWS Backup account vault.Figure 12: Copy job is completedRestore Amazon RDS database in AWS Backup accountInitiate restore of recovery pointIn the backup account, navigate to the backup vault on the AWS Backup service page. Push theRestorebutton to initiate the recovery job.Figure 13: Restore recovery pointRestore AWS BackupThe process of restoring the AWS backup will automatically detect the database (DB) engine. Choose the DB instance class, storage type, and theMulti-AZ configurationbased on your application requirements. Set the encryption key to the KMS key created in the backup account.Scroll down to bottom of the page, and press theRestore backupbutton.Figure 14: Restore backupRestore job verificationConfirm that Restore job is completed in the Status field.Figure 15: Restore job verificationDatabase verificationOnce the job completes, the database is restored. This can be verified on the Management Console of the RDS service.ConclusionIn this blog post, we showed you how to cross-account backup AWS KMS encrypted RDS instances using AWS Backup and KMS key. We also verified the encryption keys used by the source and backup snapshots.Using AWS Backup cross-account backup and cross-Region copy capabilities, you can quickly restore data to your backup accounts in your preferred AWS Region. This helps AWS Backup users to minimize business impact in the event of compromised accounts, unexpected disaster or service interruption. You can create consistent database snapshots and recover them across regions to meet your security, compliance, RTO and RPO requirements.Thanks for reading this blog post. If you have any feedback or questions, please add them in the comments section.Field Notes provides hands-on technical guidance from AWS Solutions Architects, consultants, and technical account managers, based on their experiences in the field solving real-world business problems for customers.TAGS:Field NotesRam KonchadaRam is a Senior AWS Solutions Architect in New York City. He works with enterprise customers, enabling them with digital transformation initiatives leveraging AWS and other technologies. Ram loves watching sports and is a tennis enthusiast.Agasthi KothurkarAgasthi Kothurkar is an AWS Solutions Architect, and is based in Boston. Agasthi works with enterprise customers as they transform their business by adopting the Cloud. Prior to joining AWS, he worked with leading IT consulting organizations on customers engagements spanning Cloud Architecture, Enterprise Architecture, IT Strategy, and Transformation. He is passionate about applying Cloud technologies to resolve complex real world business problems.Girish KeshavGirish is a solutions architect at AWS, helping out customers in their cloud migration journey to modernize and run workloads securely and efficiently. He is based in New York, and loves traveling, hiking, watching sports, and exploring craft breweries.
An AWS security best practice from The 5 Pillars of the AWS Well-Architected Framework is to ensure that data is protected both in transit and at rest. One option is to use SSL/TLS to encrypt data in transit, and use cryptographic keys to encrypt data at rest. To meet your organization’s disaster recovery goals, periodic snapshots of […]
Ram Konchada
Amazon RDS Architecture AWS Backup Technical How-to