We use snapshots for regular backups, and have implemented a solutions to share and copy snapshots to a different aws account.
But given that our production database is absolutely vital to the existence of the company I’d like to have an easy way to create a secure ‘not affliated with Amazon’ copy regularly in case of the nightmare scenario where an account is compromised/terminated
rsync.net has 'rclone' built into the environment[1] so it is trivially easy to call rclone, over SSH:
ssh user@rsync.net rclone s3:/some/bucket /rsync/account
Also, the snapshots are immutable (read-only) so your data gains some protection against ransomware and other threats like accidental deletion.
You should trust us with your backups because we've been doing this since 2001.
The challenge with RDS in the past has always been getting the data easily and scriptable into an S3/etc bucket to start with. This might be a good enough solution.
Restore would be a pain, but at the point its needed the pain would be acceptable.
I can't speak specifically to this, but I will point out that you can just as easily run those 'rclone' commands in reverse, to move data from an rsync.net snapshot out to (insert cloud):
ssh user@rsync.net rclone .zfs/snapshot/1dayago/bucket s3:/some/bucketThe ssh access is not to Amazon, or S3 or RDS, etc. - you run the rclone command at rsync.net, over ssh:
ssh user@rsync.net rclone s3:/some/bucket local/rsync.net/dirHow do you do this if the db is encrypted? Or rather, how do you restore from the encrypted backup in the second account if the master key in the original account is somehow deleted without anyone noticing and intervening before the deletion becomes finalized?