Configuring Image-Level Backup Settings

In the Backups section of the Targets step of the wizard, you can instruct the backup appliance to create image-level backups of the processed DB instances and to copy backups to a long-term archive storage.

Configuring Backup Settings

To instruct the backup appliance to create image-level backups of the selected RDS resources, do the following:

1. Set the Enable backups toggle to On.
2. In the Repositories window, select a either a backup repository or a storage vault where the created image-level backups will be stored, and click Apply.

For a repository to be displayed in the list of available repositories, it must be added to the backup appliance as described in sections Adding Backup Repositories and Adding Storage Vaults Using Console. The list shows only repositories of the S3 Standard or S3 Standard-IA storage classes.

Note that if you have added Microsoft SQL Server DB instances to the backup scope at step 4 of the wizard, the backup appliance will create a number of temporary Amazon S3 buckets in the same AWS Region in which the processed instances reside and then remove these buckets automatically — but only in case they are not used by any data protection or disaster recovery operations. To learn how the backup appliance creates image-level backups, see RDS Backup.

Keep in mind that if you have instructed the backup appliance to deploy worker instances without public IPv4 addresses, it must be able to connect to the public s3.<region>.amazonaws.com endpoint to access temporary Amazon S3 buckets. Otherwise, the backup appliance will not be able to create image-level backups of Microsoft SLQ Server DB instances. For more information on the private network deployment functionality, see Configuring General Settings.

Configuring Archive Settings

To instruct the backup appliance to store backed-up data in a low-cost, long-term archive storage, do the following:

1. Select the Archives will be stored in check box.
2. In the Repositories window, select a backup repository where the archived data will be stored, and click Apply.

For an archive backup repository to be displayed in the list of available repositories, it must be added to the backup appliance as described in section Adding Backup Repositories. The list shows only backup repositories of the S3 Glacier Flexible Retrieval or S3 Glacier Deep Archive storage classes.

For more information on backup archiving, see Enabling Backup Archiving.

Configuring Worker Settings

Depending on the option selected at step 3 of the wizard, the following will happen:

• If you have selected the Account option, you will be able to choose an IAM role that will be attached to the worker instances and used by the backup appliance to communicate with these instances. The role you choose must belong to the same account to which the IAM role specified for the backup operation belongs, and must be assigned the permissions listed in section Worker Deployment Role Permissions in Production Accounts.

For an IAM role to be displayed in the list of available roles, it must be added to the backup appliance with the Production worker role selected as described in section Adding IAM Roles. If you have not added the necessary IAM role to the backup appliance beforehand, you can do it without closing the Add Policy wizard. To do that, click Add and complete the Add IAM Role wizard.

• If you have selected the Organization option, the backup appliance will automatically choose an IAM role that will be attached to the worker instances and used by the backup appliance to communicate with these instances. It will be one of the roles specified in the settings of the selected organization identity — either the IAM role whose permissions will be used to perform the backup operation (that is, the Backup and restore IAM role), or the IAM role that will be attached to the worker instances and used by the backup appliance to communicate with these instances (that is, the Production worker IAM role).

For the backup appliance to be able to choose an IAM role automatically, it must be created in all AWS accounts belonging to the selected organization identity, and specified in the organization settings as described in section Adding AWS Organizations (step 3).

In both cases, you will have to assign additional permissions to the IAM role that will be used to perform the backup operation. For more information on the required permissions, see section RDS Backup IAM Role Permissions.

Worker Instance Requirements

To perform RDS image-level backups, the backup appliance deploys worker instances in production accounts in the same AWS Regions and VPCs in which processed PostgreSQL DB instances reside. By default, the backup appliance uses the most appropriate network settings of AWS Regions in production accounts to deploy worker instances. However, you can add specific worker configurations to specify network settings for each region in which worker instances will be deployed.

If no specific worker configurations are added to the backup appliance, the most appropriate network settings of AWS Regions are used to deploy worker instances for the RDS backup operation. For the backup appliance to be able to deploy a worker instance used to create an image-level backup:

• The DNS resolution option must be enabled for the VPC network. For more information, see AWS Documentation.
• As the backup appliance uses public access to communicate with worker instances, the public IPv4 addressing attribute must be enabled at least for one subnet in the Availability Zone where the DB instance resides and the VPC network to which the subnet belongs must have an internet gateway attached. VPC network and subnet route tables must have routes that direct internet-bound traffic to this internet gateway.

If you want worker instances to operate in a private network, enable the private network deployment functionality and configure specific VPC endpoints for the subnet to let the backup appliance use private IPv4 addresses. Alternatively, configure VPC interface endpoints as described in section Appendix C. Configuring Endpoints in AWS.