When using the AWS CLI restore-db-instance-to-point-in-time command, I can't figure out how to set the security group. The doc on this page says:

The target database is created from the source database with the same configuration as the original database except that the DB instance is created with the default DB security group.

Is it possible to override this parameter to use the same security group as the original instance?

2 Answers 2


Not without an additional API call. You will need to wait for the target database to move to an "available" state and then use modify-db-instance with the target database and security group as parameters.

Here's some pseudocode based off of a similar example I have in Powershell. Selecting information from describe-db-instances will vary by which language you're using the API with, but by default it looks like it comes back as JSON.

restore-db-instance-to-point-in-time --source-db-instance-identifier sourceDatabase --target-db-instance-identifier targetDatabase
while(targetinstance not "available")
    targetinstance = describe-db-instances --db-instance-identifier targetDatabase
    sleep for X seconds
modify-db-instance --db-instance-identifier targetInstance --db-security-groups mySecurityGroup
  • 1
    That's what I figured out since, unfortunately!
    – BenMorel
    Commented Sep 17, 2013 at 20:43

Where ${DB_IDENTIFIER_FROM} is the RDS DB identifier for the database your are duplicating and ${DB_IDENTIFIER_TO} will be the new database's identifier.

"sg-GROUP1" "sg-GROUP2" "sg-GROUP3" should be modified to the security groups you want.

sleep is unfortunately necessary as I've found it sometimes takes a bit for AWS to realize something is changing.

echo "[INFO] Spinning up new RDS from latest production snapshot"
aws rds restore-db-instance-to-point-in-time --source-db-instance-identifier ${DB_IDENTIFIER_FROM} --target-db-instance-identifier ${DB_IDENTIFIER_TO} --use-latest-restorable-time --db-subnet-group-name prodinado --multi-az --no-publicly-accessible --tags Key=workload-type,Value=other
echo "[INFO] Waiting RDS instance to spin up"
sleep 5; aws rds wait db-instance-available --db-instance-identifier ${DB_IDENTIFIER_TO}
echo "[INFO] Configuring the spun up RDS"
aws rds modify-db-instance --db-instance-identifier ${DB_IDENTIFIER_TO} --vpc-security-group-ids "sg-GROUP1" "sg-GROUP2" "sg-GROUP3" --apply-immediately --backup-retention-period 0
echo "[INFO] Waiting RDS instance configuration to finish"
sleep 5; aws rds wait db-instance-available --db-instance-identifier ${DB_IDENTIFIER_TO}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.