Cross-region RDS replicated backups

[gruntwork-support]

This message was extracted from a discussion that originally took place in Gruntwork Community Slack. Names and URLs have been removed where appropriate

From a customer

Is there a way to turn on cross-region automated backups with the RDS module? I didn’t see an option for it in vars.tf. I can’t even seem to find any terraform resource to handle this period. hopefully i’m overlooking something though.

[gruntwork-support]

From a grunt

Hi person! I'm looking into this, as I don't know off the top of my head. If there's not even a terraform way to do this, maybe at least there's a workaround.

In your current RDS setup, are all your replicas in a single region, or are you cross-region? I assume from your question that you have it setup across regions. (edited)

Assuming so, your replica in another region might be defined like this: https://github.com/gruntwork-io/terraform-aws-data-storage/blob/4c250e2b62aac9f258[…]23ac35b456/examples/rds-mysql-with-cross-region-replica/main.tf with the

providers = {
  aws = aws.replica
}

where aws.replica is defined at the top for the replica_region.The inputs include non-production settings, but you can change them to support automated backup in there by tweaking them.

That's assuming you have it set up that way, though. I'd like to see if that matches up, or if your cross-region DB instances are defined differently

[gruntwork-support]

From a grunt

Right, that makes sense. So these DB instances in your DR are not managed by Terraform currently?

[gruntwork-support]

From a customer

they are terraform, using the gruntwork RDS module

[gruntwork-support]

From a grunt

Okay, well if that's the case it should be possible to enable backups on them just like on any RDS DB instance.

[gruntwork-support]

From a customer

the automated backups are happening. it just doesn’t replicate the backups to the other region

[gruntwork-support]

From a grunt

Ah, I see what you mean. Let me see. (I feel that there has to be something, as this is a really common DR scenario)

I'm coming to the same conclusion, that there isn't Terraform support to turn this on. The AWS command to run it is like:

aws rds start-db-instance-automated-backups-replication \
--region us-east-1 \
--source-db-instance-arn "arn:aws:rds:us-west-2:123456789012:db:mydatabase" \
--kms-key-id "arn:aws:kms:us-east-1:123456789012:key/AKIAIOSFODNN7EXAMPLE" \
--source-region us-west-2 \
--backup-retention-period 7

It looks like it's a one-time command. I was going to suggest scripting it via a provisioner "local-exec" in a way where it would only run once.

It might be possible via AWS Backup: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_global_settings. That Terraform resource should do exactly what AWS Backup is advertised to let you do: schedule cross-region backups of things, including RDS https://docs.aws.amazon.com/aws-backup/latest/devguide/cross-region-backup.html

Perhaps we can support this in the module. I will relay this back to the team. I personally would like to see support for this!

[gruntwork-support]

From a grunt

Hey person, found out more info. We recommend waiting for the Terraform AWS provider to catch up.We'll probably want to add support for it once this issue is closed: hashicorp/terraform-provider-aws#16708 . The module we currently have for doing this: https://github.com/gruntwork-io/terraform-aws-data-storage/tree/master/modules/lambda-create-snapshot, works in all regions. Is that something you could use in the meantime?

[gruntwork-support]

From a customer

thanks for the update!