KMS Key Permission Requirements for Amazon RDS Using Snapshot

To replicate a copy of encrypted Amazon RDS snapshots, you need certain KMS permissions and keys.

Requirements

Create a stack in the AWS CloudFormation console using the YAML template. For details on stack creation, refer to the AWS documentation.

While creating the stack, provide the following parameters:

• Alias: Specify the KMS alias name in the format alias/<any_name>.

• ExternalAccountId: Enter the AWS replication account ID.

  When deployed through CloudFormation, the stack automatically handles the required KMS alias/tag setup, IAM key-user access, and necessary permissions, removing the need for manual configuration.

Configure Encryption Key Sharing in the AWS Console

1. Log on to the AWS Console as the user or with a role associated with the account that contains the snapshots.

2. On the ribbon, click Services.

3. Click Key Management Service.

4. Under Key users, select a key:

   • If you select a key that is tagged with cvlt-rds or cvlt-master, you can add another account by adding the account root in JSON.

   • If you select your own custom key, complete the following steps:

     1. Under Other AWS accounts, click Add Other AWS Account.

        The Other AWS accounts page appears.

     2. In the arn:aws:iam:: box, enter the number of the AWS account that you want to copy the snapshots to.

     3. Click Save changes.

5. Click Save changes.