[{"data":1,"prerenderedAt":10},["ShallowReactive",2],{"public:public\u002Fcontent\u002Fdocs\u002Faws-rds":3},{"slug":4,"title":5,"description":6,"draft":7,"updated":8,"html":9},"aws-rds","AWS (RDS and S3)","Keep pg_dump backups of RDS or Aurora PostgreSQL in S3 and give Verestore a read-only, prefix-scoped IAM user.",false,null,"\u003Ch1>AWS: RDS \u002F Aurora PostgreSQL with S3\u003C\u002Fh1>\n\u003Cp>RDS automated snapshots can't be downloaded as PostgreSQL backups (snapshot exports are Parquet), so keep a logical backup in S3 alongside them. That is also the copy an auditor means by "we can restore it anywhere".\u003C\u002Fp>\n\u003Ch2>1. Write dumps to S3\u003C\u002Fh2>\n\u003Cp>A scheduled ECS task, a small EC2 instance or a CI job runs:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-sh\">pg_dump --format=custom --no-owner "$DATABASE_URL" \\\n  | aws s3 cp - "s3:\u002F\u002Facme-backups\u002Forders\u002Forders-$(date -u +%Y-%m-%dT%H-%M).dump"\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch2>2. Create a read-only IAM user (or role) for Verestore\u003C\u002Fh2>\n\u003Cp>Attach this policy. Replace the bucket name and prefix:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-json\">{\n  "Version": "2012-10-17",\n  "Statement": [\n    {\n      "Sid": "ListOnlyThePrefix",\n      "Effect": "Allow",\n      "Action": "s3:ListBucket",\n      "Resource": "arn:aws:s3:::acme-backups",\n      "Condition": { "StringLike": { "s3:prefix": ["orders\u002F*"] } }\n    },\n    {\n      "Sid": "ReadOnlyThePrefix",\n      "Effect": "Allow",\n      "Action": "s3:GetObject",\n      "Resource": "arn:aws:s3:::acme-backups\u002Forders\u002F*"\n    }\n  ]\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>If the bucket uses \u003Cstrong>SSE-KMS\u003C\u002Fstrong>, also allow decrypt through S3 only:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-json\">{\n  "Sid": "DecryptViaS3Only",\n  "Effect": "Allow",\n  "Action": "kms:Decrypt",\n  "Resource": "arn:aws:kms:eu-west-3:123456789012:key\u002FKEY-ID",\n  "Condition": { "StringEquals": { "kms:ViaService": "s3.eu-west-3.amazonaws.com" } }\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Create an access key for the user and add the target in Verestore with endpoint \u003Ccode>https:\u002F\u002Fs3.<region>.amazonaws.com\u003C\u002Fcode>, your region, bucket \u003Ccode>acme-backups\u003C\u002Fcode> and prefix \u003Ccode>orders\u002F\u003C\u002Fcode>.\u003C\u002Fp>\n",1794290783588]