1

AWS Provides a great solution to provide point-in-time recovery backups within RDS. However, while we take every measure to protect the root account, I'm paranoid that if someone were to gain access they can wipe the entire AWS account including all backups and therefore take the whole company down. What are the best ways to handle this? Do you have 100% trust in your root account and policies to prevent someone malicious from wiping the database and all backups?

What are the best ways to handle an offsite backup to a different RDS account? Should we simply execute mysqldump periodically from a separate system, or is there a better way?

1

On top of protecting your root account as best as you can, you should be able to reduce the risk of such resource deletion if you have more than 1 resource to protect.

For example if all AWS resources you had to protect were 2 RDS database servers, you could create 2 other accounts that have access to only copy the snapshots of one of your database servers each - and no other access to any other resource. This setup would then require an intruder to hack both root accounts of your main and one backup account each, which should be significantly more difficult.

To copy snapshots from one account A (your current RDS account) to account B (your new account) you should need the following parts (untested)

  • Create a new IAM role in Account A, for access from account B:

enter image description here

  • Create a new policy for reading RDS snapshots from account A

    {
        "Version": "2012-10-17",
        "Statement": [
            {
            "Effect": "Allow",
            "Action":
                [
                    "rds:CopyDbSnapshot",
                    "rds:DescribeDbSnapshots"
    
    
                ],
            "Resource": "arn:aws:rds:::"
            }
       ]
    }
    

and assign it to the IAM role

  • This is what I was looking for details on. How do I go about setting up another account which can copy snapshots in an automated fashion? – Brad May 4 at 23:58
  • Have updated with more details – jdog May 6 at 6:48
0

In terms of your root account, you should be very paranoid about the power it wields and protect it as thoroughly as possible.

I would suggest that you get yourself a Hardware Key Fob as listed in MFA devices on this page: https://aws.amazon.com/iam/details/mfa/

Having a physical factor means that you can be sure only people with access to the physical device could log in and do that kind of damage. You can even secure it in a physical safe.

If your root account is considerably secure, I would be of the opinion that is Good Enough for DB back-ups. If you're worried about those then s3 or other amazon services will have the same problems. While you could look at other storage options, realistically if your aws root account is compromised it might just be the end of days - I would focus on the security aspect personally.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.