Last week, at the AWS Summit San Francisco, AWS unveiled the new AWS Secrets Manager service. This new service allows you to: Save your secrets, passwords, and API keys in a KMS-encrypted storage service, Retrieve your secrets from your applications using the AWS CLI and AWS SDKs, and Automatically rotate your secrets on a custom schedule.
Back in 2016, AWS extended the resource ID length from 8 characters to 17 characters. Back then, this change applied to EC2 instances, EBS snapshots, EBS volumes, and EC2 instance reservation IDs. Now they’re doing it again with the remainder of EC2 resource types.
In our previous posts, I showed you how to copy your DB and Aurora snapshots to ensure they are preserved beyond the lifetime of your RDS instance. However, those copies were simply second copies in the same region as the original. In this post, I’ll show you how to copy your RDS snapshots to a second region for extra protection. Please note that I will restrict this post to unencrypted snapshots. Copying encrypted snapshots is more involved, so I’ll show that in a separate post.
RDS snapshots can be unencrypted or they can be encrypted at rest. Today, best practice is to use encryption-at-rest on your RDS instances and clusters, and to encrypt your RDS snapshots. When you create an RDS snapshot from an RDS instance or cluster, the resulting snapshot will be encrypted if the source instance or cluster is encrypted. But if the source is not encrypted, then your RDS snapshot is not encrypted. When you create an RDS snapshot, you are not given the option to encrypt it.
RDS DB snapshots are snapshots created from Amazon RDS DB instances. Those being MySQL, PostgreSQL, MariaDB, Oracle, and Microsoft SQL Server. Amazon Aurora also has snapshots, however, those are considered “cluster snapshots” and are handled differently.
As companies, big or small, move into the cloud, it’s becoming more and more important to ensure that data is protected. There are numerous options for data resilience, including (but not limited to), Amazon EBS and Amazon S3. What you choose to use depends on your business requirements. Amazon EBS volumes are supposed to be redundant within an availability zone, however they have been known to fail, both due to technical issues, and by human error.
Most likely you have heard about Spectre and Meltdown by now. It’s all over the news. As an IT or DevOps engineer, it’s now your job to patch your EC2 instance operating systems. This task can be “fun” if you need to SSH/RDP into every EC2 instance and apply patches. Or, it can be truly fun if you decide to use AWS Systems Manager to apply patches to your OS.
Modern cloud-based data services have revolutionized the way companies manage their data. Tools such as Amazon Athena and Amazon Redshift have changed data warehouse technology, catering for a move towards interactive, real-time, analytical solutions. Both Amazon Athena and Redshift offer their own unique benefits and use cases. Athena provides a cheaper and more portable way to query data while Redshift offers unrivalled performance and scalability.
