AWS Backup
Deep Dive

# ── Step 1: Find Aurora recovery point ───────────────────────────────
aws backup list-recovery-points-by-backup-vault \
  --backup-vault-name "prod-primary-vault" \
  --by-resource-type "Aurora" \
  --query 'RecoveryPoints[*].{ARN:RecoveryPointArn,Created:CreationDate}' \
  --output table

# ── Step 2: Get restore metadata ─────────────────────────────────────
aws backup get-recovery-point-restore-metadata \
  --backup-vault-name "prod-primary-vault" \
  --recovery-point-arn "arn:aws:rds:us-east-1:123456789:cluster-snapshot:awsbackup-aurora-2024-01-17"

# ── Step 3: Start restore ─────────────────────────────────────────────
aws backup start-restore-job \
  --recovery-point-arn "arn:aws:rds:us-east-1:123456789:cluster-snapshot:awsbackup-aurora-2024-01-17" \
  --iam-role-arn "arn:aws:iam::123456789:role/service-role/AWSBackupDefaultServiceRole" \
  --resource-type "Aurora" \
  --metadata '{
    "DBClusterIdentifier":  "prod-aurora-restored-20240117",
    "Engine":               "aurora-mysql",
    "EngineVersion":        "8.0.mysql_aurora.3.04.0",
    "DBSubnetGroupName":    "prod-subnet-group",
    "VpcSecurityGroupIds":  "sg-0abc123",
    "Port":                 "3306"
  }'

# ── Step 4: Add reader instance after cluster is available ────────────
aws rds create-db-instance \
  --db-instance-identifier "prod-aurora-restored-reader-1" \
  --db-cluster-identifier  "prod-aurora-restored-20240117" \
  --db-instance-class       "db.r6g.large" \
  --engine                  "aurora-mysql"

# ── Step 5: Get cluster endpoints ────────────────────────────────────
aws rds describe-db-clusters \
  --db-cluster-identifier "prod-aurora-restored-20240117" \
  --query 'DBClusters[0].{Writer:Endpoint,Reader:ReaderEndpoint}'
    

# ── Step 1: Find EC2 recovery point ──────────────────────────────────
aws backup list-recovery-points-by-backup-vault \
  --backup-vault-name "prod-primary-vault" \
  --by-resource-type "EC2" \
  --output table

# ── Step 2: Get restore metadata ─────────────────────────────────────
aws backup get-recovery-point-restore-metadata \
  --backup-vault-name "prod-primary-vault" \
  --recovery-point-arn "arn:aws:ec2:us-east-1::image/ami-recovered-abc123"

# ── Step 3: Start EC2 restore job ─────────────────────────────────────
aws backup start-restore-job \
  --recovery-point-arn "arn:aws:ec2:us-east-1::image/ami-recovered-abc123" \
  --iam-role-arn "arn:aws:iam::123456789:role/service-role/AWSBackupDefaultServiceRole" \
  --resource-type "EC2" \
  --metadata '{
    "InstanceType":           "t3.medium",
    "SubnetId":               "subnet-0abc123",
    "SecurityGroupIds":       "sg-0abc123",
    "IamInstanceProfileName": "MyProfile",
    "KeyName":                "my-keypair"
  }'

# ── Result: A new AMI is created, then a new EC2 instance launched ────
# ── Step 4: Get the new instance ID from the restore job ──────────────
aws backup describe-restore-job \
  --restore-job-id "RESTORE_JOB_ID" \
  --query 'CreatedResourceArn'

# ── Step 5: Update target group / ASG to include new instance ─────────
aws elbv2 register-targets \
  --target-group-arn "arn:aws:elasticloadbalancing:..." \
  --targets 'Id=i-0newinstanceid123'
    

# ── Step 1: Find DynamoDB recovery point ─────────────────────────────
aws backup list-recovery-points-by-backup-vault \
  --backup-vault-name "prod-primary-vault" \
  --by-resource-type "DynamoDB" \
  --output table

# ── Step 2: Start restore ─────────────────────────────────────────────
aws backup start-restore-job \
  --recovery-point-arn "arn:aws:dynamodb:us-east-1:123456789:table/orders/backup/01234567890123-abc" \
  --iam-role-arn "arn:aws:iam::123456789:role/service-role/AWSBackupDefaultServiceRole" \
  --resource-type "DynamoDB" \
  --metadata '{
    "targetTableName":  "orders-restored-20240117"
  }'

# Note: The restored table inherits capacity/billing settings from the backup.
# To change billing mode or capacity, modify the table after restoration:

aws dynamodb update-table \
  --table-name "orders-restored-20240117" \
  --billing-mode "PAY_PER_REQUEST"

# ── Step 3: Verify the restored table ────────────────────────────────
aws dynamodb describe-table \
  --table-name "orders-restored-20240117" \
  --query 'Table.{Status:TableStatus,Items:ItemCount,Size:TableSizeBytes}'

# ── Step 4: Update app config to point to new table name ─────────────
# (update SSM Parameter Store or env variable)

aws ssm put-parameter \
  --name "/prod/app/dynamo-table-name" \
  --value "orders-restored-20240117" \
  --overwrite
    

# ── Option A: Full restore to a new EFS file system ──────────────────
aws backup start-restore-job \
  --recovery-point-arn "arn:aws:backup:us-east-1:123456789:recovery-point:efs-rp-abc123" \
  --iam-role-arn "arn:aws:iam::123456789:role/service-role/AWSBackupDefaultServiceRole" \
  --resource-type "EFS" \
  --metadata '{
    "newFileSystem":        "true",
    "PerformanceMode":      "generalPurpose",
    "Encrypted":            "true",
    "KmsKeyId":             "arn:aws:kms:us-east-1:123456789:key/my-key",
    "CreationToken":        "restored-efs-20240117"
  }'

# ── Option B: Selective restore into existing EFS (specific path) ─────
aws backup start-restore-job \
  --recovery-point-arn "arn:aws:backup:us-east-1:123456789:recovery-point:efs-rp-abc123" \
  --iam-role-arn "arn:aws:iam::123456789:role/service-role/AWSBackupDefaultServiceRole" \
  --resource-type "EFS" \
  --metadata '{
    "newFileSystem":           "false",
    "file-system-id":          "fs-0existingefs123",
    "ItemsToRestore":          "[\\"/uploads/2024/january\\"]"
  }'

# Note: AWS Backup automatically creates a restore directory named
# aws-backup-restore_<datetime> in the root of the target file system.

# ── Step 3: Remount EFS with new File System ID ───────────────────────
# On EC2 instance, update /etc/fstab:
# fs-0newefs456.efs.us-east-1.amazonaws.com:/ /mnt/efs efs defaults,_netdev 0 0
# Then:

sudo umount /mnt/efs
sudo mount -a
    

import boto3, time, json
from datetime import datetime

backup   = boto3.client('backup',          region_name='us-east-1')
sm       = boto3.client('secretsmanager',  region_name='us-east-1')
rds      = boto3.client('rds',             region_name='us-east-1')

VAULT_NAME      = "prod-primary-vault"
SECRET_ARN      = "arn:aws:secretsmanager:us-east-1:123456789:secret:prod/db"
IAM_ROLE_ARN    = "arn:aws:iam::123456789:role/service-role/AWSBackupDefaultServiceRole"
NEW_DB_ID       = f"prod-mysql-restored-{datetime.now().strftime('%Y%m%d-%H%M')}"

# ── 1. Find the latest successful RDS recovery point ──────────────────
def get_latest_recovery_point():
    resp = backup.list_recovery_points_by_backup_vault(
        BackupVaultName=VAULT_NAME,
        ByResourceType="RDS",
    )
    points = [p for p in resp["RecoveryPoints"] if p["Status"] == "COMPLETED"]
    if not points:
        raise Exception("No completed recovery points found")
    # Sort by creation date descending, take the most recent
    points.sort(key=lambda x: x["CreationDate"], reverse=True)
    return points[0]["RecoveryPointArn"]

# ── 2. Get restore metadata from AWS ─────────────────────────────────
def get_restore_metadata(rp_arn):
    resp = backup.get_recovery_point_restore_metadata(
        BackupVaultName=VAULT_NAME,
        RecoveryPointArn=rp_arn,
    )
    meta = resp["RestoreMetadata"]
    # Override the DB identifier so we get a NEW instance
    meta["DBInstanceIdentifier"] = NEW_DB_ID
    return meta

# ── 3. Start the restore job ──────────────────────────────────────────
def start_restore(rp_arn, metadata):
    resp = backup.start_restore_job(
        RecoveryPointArn=rp_arn,
        Metadata=metadata,
        IamRoleArn=IAM_ROLE_ARN,
        ResourceType="RDS",
    )
    return resp["RestoreJobId"]

# ── 4. Poll until complete ────────────────────────────────────────────
def wait_for_restore(job_id, poll_interval=30):
    while True:
        resp   = backup.describe_restore_job(RestoreJobId=job_id)
        status = resp["Status"]
        pct    = resp.get("PercentDone", "?")
        print(f"  [{datetime.now().strftime('%H:%M:%S')}] Status: {status} ({pct}% done)")
        if status == "COMPLETED":
            return resp["CreatedResourceArn"]   # new RDS ARN
        if status in ("FAILED", "ABORTED"):
            raise Exception(f"Restore job failed: {resp.get('StatusMessage')}")
        time.sleep(poll_interval)

# ── 5. Get new endpoint & update Secrets Manager ──────────────────────
def cutover(new_db_arn):
    db = rds.describe_db_instances(DBInstanceIdentifier=NEW_DB_ID)
    endpoint = db["DBInstances"][0]["Endpoint"]["Address"]
    print(f"  New endpoint: {endpoint}")

    # Update Secrets Manager secret with new host
    current = json.loads(sm.get_secret_value(SecretId=SECRET_ARN)["SecretString"])
    current["host"] = endpoint
    sm.update_secret(SecretId=SECRET_ARN, SecretString=json.dumps(current))
    print("   Secrets Manager updated — app will pick up new endpoint on next restart")

# ── Main ──────────────────────────────────────────────────────────────
if __name__ == "__main__":
    print(" Finding latest recovery point...")
    rp_arn   = get_latest_recovery_point()
    print(f"   → {rp_arn}")

    print(" Fetching restore metadata...")
    metadata = get_restore_metadata(rp_arn)

    print(" Starting restore job...")
    job_id   = start_restore(rp_arn, metadata)
    print(f"   → Job ID: {job_id}")

    print("⏳ Waiting for restore to complete (this takes 15-30 min for RDS)...")
    new_arn  = wait_for_restore(job_id)

    print(" Cutting over to new instance...")
    cutover(new_arn)
    print(" Restore complete!")