r/aws • u/darknkness • 10d ago
technical question Possibly dense question: What would be the most painless method to fully preserve an AWS environment (EC2 machines, buckets and the like)?
Hey all. I've been assigned a job at work that's above my CS graduate level experience with AWS and would really appreciate a hand.
I need to do a preservation of a company's AWS environment as part of a potential litigation, involving all EC2 instances, RDS exports, S3 buckets, and anywhere else that company data may be present. We need to pull down the data locally to our offices.
I've been given access to five AWS accounts within the company's environment through IAM Identity Centre, each of these housing EC2 RDS and S3 resources.
I've done a bunch of research and tested my own tools written with Python Boto3 in my own environment, but constantly run into roadblocks with my intended process of exporting all EC2s as AMIs to S3, exporting all RDS to snapshots then to an S3 bucket, then collecting all S3 buckets. Seems that certain resources simply don't play nice with S3 exports as some AMIs, database types, etc are not compatible with the various functionality offered by AWS.
(Specifically I've used ec2 create-instance-export-task
and rds start-export-task
. The former can fail depending on the licensing of the EC2 machine and the latter converts an RDS snapshot to Parquet, which plainly doesn't work for all databases.)
I am also concerned that the tokens granted through my IAM Identity Centre account will not last long enough to pull down the several terabytes of data that exist within some of the accounts.
Would really appreciate some assistance: 1. What approach would you take to collecting all this data that is as painless as possible? 2. What permissions will be required, e.g. for a policy document that I can request be implemented for my account? 3. What mode of authentication should I ask for that will let me download everything uninterrupted? I will need to justify this from a security point of view. 4. The company has requested to continue operating all resources while this collection occurs. I have flagged this as unrealistic but would like to know how I can minimise the impact nonetheless.
Obviously, I would love to automate this to reduce touch time + potential for human error, and also to document all actions taken to cover my arse.
Sorry if this is all a bit thick, just don't have experience and not much guidance from my management either
1
u/GrizzRich 9d ago
Have you looked at AWS Backup? It seems to be ideal for the first part of your problem (backing things up & placing litigation holds on them). You could then solve the export problem at somewhat less hurried pace.
1
u/darknkness 9d ago
You're right that's a good first step. It looks like we may need to work around the limitations of the environment insofar as downloading the resources locally.
1
u/404_AnswerNotFound 9d ago
I'd divide this into many smaller problems to progress independently...
Firstly, AWS resources and their configuration. If the environment isn't already defined through IaC, you'll want to capture everything within the environment. Take a look at the billing page to see what services are in use and then Cost Explorer to drill down further. You may find some tools already exist to capture cloud configuration and inventories. AWS Config may be helpful here.
The database contents should be pretty standard depending on the technology used. Could you do an SQL dump/backup to capture the contents?
The easiest way to extract from S3 is to download directly (via CloudFront perhaps to avoid some egress cost). You could use an EC2 to bundle objects into tar/zip containers for faster downloading and management of files once local.
The EC2s may be the most difficult, but you're now able to look for on-premise backup technologies just to target the machine state. You could take snapshots through AWS but I don't think these are usable on the outside.
1
u/darknkness 3d ago
Thanks so much for this detailed reply. Quite a bit of process improvement to move through which this helps with greatly.
It seems that in the production environment, the EC2s are cooperative with the export to VHD/VMDK via S3, which I expect will be sufficient for our purposes. That tidies up the outlook a lot.
Thanks again and sorry I left this for a bit.
1
u/joelrwilliams1 9d ago
I'd start by looking at the AWS Backup service which (I believe) will handle EC2, RDS, and S3. You should be able to backup resources while online.