Profile Applicability:
- Level 1
Description:
In Amazon RDS, when you create snapshots of DB clusters, it is essential to copy the tags associated with the RDS instance to the snapshot to ensure that the snapshot retains the metadata related to the DB cluster. Copying tags to snapshots allows for better organization, management, and governance of RDS snapshots, and it simplifies tracking and compliance for backup management and resource tagging.
This SOP ensures that the copy tags to snapshots option is enabled for RDS DB clusters so that any snapshots taken for these clusters automatically retain the tags assigned to the original RDS DB clusters.
Rationale:
Governance: Tags help you categorize and manage AWS resources effectively. If snapshots inherit the same tags as the original DB cluster, it ensures proper identification, reporting, and cost allocation.
Operational Efficiency: Automatically copying tags reduces manual effort and ensures consistency in resource management, making it easier to manage snapshots.
Compliance: Many compliance frameworks (e.g., SOC 2, PCI-DSS) require that backups (including snapshots) are tracked and managed with appropriate metadata such as tags.
Security: Tags can be used for access control (e.g., ensuring that snapshots are accessible only by authorized users or services).
Impact:
Pros:
Improved Management: Enables more efficient management of snapshots by associating them with the original DB cluster’s tags.
Consistency: Ensures that all RDS snapshots are consistently tagged, which helps with tracking and auditing.
Operational Visibility: Provides better visibility into your AWS resources and simplifies tasks like billing and cost management by leveraging tags.
Cons:
Configuration Overhead: Enabling the feature requires initial configuration, though it’s a one-time setup per DB cluster.
Potential for Tagging Errors: If tags are not correctly assigned to the DB clusters, they may propagate incorrectly to the snapshots.
Default Value:
By default, RDS DB clusters do not have the "copy tags to snapshots" option enabled. This setting must be explicitly configured when creating or modifying the DB cluster.
Pre-requisite:
AWS IAM Permissions:
rds:DescribeDBClusters
rds:ModifyDBCluster
rds:CreateDBClusterSnapshot
AWS CLI installed and configured.
Ensure that the RDS DB cluster has tags assigned before enabling the option to copy tags.
Test Plan:
Using AWS Console:
Sign in to the AWS Management Console.
Navigate to Amazon RDS under Services.
In the RDS Dashboard, go to Databases and select the DB cluster for which you want to check the "copy tags to snapshots" setting.
Under the Modify section, look for the Copy Tags to Snapshots setting.
If this option is enabled, it will be checked.
If this option is disabled, you will need to enable it.
If disabled, check the box for Copy Tags to Snapshots, then save changes.
Using AWS CLI:
To check if copy tags to snapshots is enabled, run:
aws rds describe-db-clusters --query 'DBClusters[*].{DBClusterIdentifier:DBClusterIdentifier,CopyTagsToSnapshots:CopyTagsToSnapshots}'Review the output:
If CopyTagsToSnapshots is true, the option is enabled.
If false, the option is not enabled.
To enable copy tags to snapshots, run:
aws rds modify-db-cluster --db-cluster-identifier <cluster-id> --copy-tags-to-snapshots --apply-immediately
Verify the change:
aws rds describe-db-clusters --query 'DBClusters[*].{DBClusterIdentifier:DBClusterIdentifier,CopyTagsToSnapshots:CopyTagsToSnapshots}'
Implementation Steps:
Using AWS Console:
Log in to the AWS Management Console and navigate to Amazon RDS.
In the RDS Dashboard, select Databases and click the DB cluster for which you want to enable the feature.
Click Modify in the Cluster Details section.
In the Backup section, check the Copy Tags to Snapshots option.
Click Continue and then Apply Changes to save the configuration.
Using AWS CLI:
To enable copy tags to snapshots, run the following command:
aws rds modify-db-cluster --db-cluster-identifier <cluster-id> --copy-tags-to-snapshots --apply-immediately
Verify the configuration:
aws rds describe-db-clusters --query 'DBClusters[*].{DBClusterIdentifier:DBClusterIdentifier,CopyTagsToSnapshots:CopyTagsToSnapshots}'
Backout Plan:
Using AWS Console:
If enabling Copy Tags to Snapshots causes issues, sign in to the AWS Management Console.
Navigate to Amazon RDS, select the DB cluster, and click Modify.
Uncheck the Copy Tags to Snapshots option.
Save the changes, and the feature will be disabled for future snapshots.
Using AWS CLI:
To disable Copy Tags to Snapshots, run the following command:
aws rds modify-db-cluster --db-cluster-identifier <CLUSTER_ID> --no-copy-tags-to-snapshots --apply-immediately
Verify that Copy Tags to Snapshots has been disabled:
aws rds describe-db-clusters --db-cluster-identifier <CLUSTER_ID>