Sign up ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

When using the AWS CLI restore-db-instance-to-point-in-time command, I can't figure out how to set the security group. The doc on this page says:

The target database is created from the source database with the same configuration as the original database except that the DB instance is created with the default DB security group.

Is it possible to override this parameter to use the same security group as the original instance?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Not without an additional API call. You will need to wait for the target database to move to an "available" state and then use modify-db-instance with the target database and security group as parameters.

Here's some pseudocode based off of a similar example I have in Powershell. Selecting information from describe-db-instances will vary by which language you're using the API with, but by default it looks like it comes back as JSON.

restore-db-instance-to-point-in-time --source-db-instance-identifier sourceDatabase --target-db-instance-identifier targetDatabase
while(targetinstance not "available")
    targetinstance = describe-db-instances --db-instance-identifier targetDatabase
    sleep for X seconds
modify-db-instance --db-instance-identifier targetInstance --db-security-groups mySecurityGroup
share|improve this answer
That's what I figured out since, unfortunately! – Benjamin Sep 17 '13 at 20:43

Where ${DB_IDENTIFIER_FROM} is the RDS DB identifier for the database your are duplicating and ${DB_IDENTIFIER_TO} will be the new database's identifier.

"sg-GROUP1" "sg-GROUP2" "sg-GROUP3" should be modified to the security groups you want.

sleep is unfortunately necessary as I've found it sometimes takes a bit for AWS to realize something is changing.

echo "[INFO] Spinning up new RDS from latest production snapshot"
aws rds restore-db-instance-to-point-in-time --source-db-instance-identifier ${DB_IDENTIFIER_FROM} --target-db-instance-identifier ${DB_IDENTIFIER_TO} --use-latest-restorable-time --db-subnet-group-name prodinado --multi-az --no-publicly-accessible --tags Key=workload-type,Value=other
echo "[INFO] Waiting RDS instance to spin up"
sleep 5; aws rds wait db-instance-available --db-instance-identifier ${DB_IDENTIFIER_TO}
echo "[INFO] Configuring the spun up RDS"
aws rds modify-db-instance --db-instance-identifier ${DB_IDENTIFIER_TO} --vpc-security-group-ids "sg-GROUP1" "sg-GROUP2" "sg-GROUP3" --apply-immediately --backup-retention-period 0
echo "[INFO] Waiting RDS instance configuration to finish"
sleep 5; aws rds wait db-instance-available --db-instance-identifier ${DB_IDENTIFIER_TO}
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.