amazon-web-services - AWS RDS 备份到 S3 失败

Question

我们有一个选项组附加到我们的一个 SQL Server 实例以备份到 S3 存储桶。当我们尝试使用 rds_backup_database 存储过程运行备份时，出现以下错误:

[2021-03-18 20:20:22.260] Aborted the task because of a task failure or an overlap with your preferred backup window for RDS automated backup.
[2021-03-18 20:20:22.270] Task has been aborted
[2021-03-18 20:20:22.270] Access Denied

我读过的所有内容都表明，这意味着用于备份和恢复选项组的 IAM 角色没有对 S3 存储桶的适当权限。

然而，一切似乎都配置正确。这是该角色的权限配置。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::sabmssqldevbackups"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObjectMetaData",
                "s3:GetObject",
                "s3:PutObject",
                "s3:ListMultipartUploadParts",
                "s3:AbortMultipartUpload"
            ],
            "Resource": [
                "arn:aws:s3:::sabmssqldevbackups/sabmssqldev/*"
            ]
        }
    ]
}

至于备份窗口，它被配置为午夜后半小时，所以我们不能与之冲突。

另一个特点是我们的 RDS 实例位于 us-east-2a 区域。我找不到关于什么是 us-east-2a 的任何信息。当您可以选择区域时，您无法选择它。我们的 S3 存储桶位于 us-east-2 中，这是应该的。这两个区域是否相同，还是这种不匹配导致我们无法执行备份？

Answer 1

us-east-2a 看起来是您的数据库所在的 AZ:

区域仍然是 us-east-2

基于数据库快照导出 IAM 角色示例:

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ExportSnapshot.html#USER_ExportSnapshot.SetupIAMRole

您应该在最后一个语句中声明 arn:aws:s3:::your-s3-bucket，

来自:

{
  "Effect": "Allow",
  "Action": [
    "s3:GetObjectMetaData",
    "s3:GetObject",
    "s3:PutObject",
    "s3:ListMultipartUploadParts",
    "s3:AbortMultipartUpload"
  ],
  "Resource": [
    "arn:aws:s3:::sabmssqldevbackups/sabmssqldev/*"
  ]
}

到:

{
  "Effect": "Allow",
  "Action": [
    "s3:GetObjectMetaData",
    "s3:GetObject",
    "s3:PutObject",
    "s3:ListMultipartUploadParts",
    "s3:AbortMultipartUpload"
  ],
  "Resource": [
    "arn:aws:s3:::sabmssqldevbackups/sabmssqldev"
    "arn:aws:s3:::sabmssqldevbackups/sabmssqldev/*"
  ]
}

要验证 IAM 角色是否正常工作，您可以展开 AWS CLI 部分:

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ExportSnapshot.html#USER_ExportSnapshot.Exporting

并启动 aws rds start-export-task 命令以验证一切正常:

aws rds start-export-task \
    --export-task-identifier my_snapshot_export \
    --source-arn arn:aws:rds:AWS_Region:123456789012:snapshot:snapshot_name \
    --s3-bucket-name my_export_bucket \
    --iam-role-arn iam_role \
    --kms-key-id master_key