Choose security group for restore-db-instance-to-point-in-time

Question

When using the AWS CLI restore-db-instance-to-point-in-time command, I can't figure out how to set the security group. The doc on this page says:

The target database is created from the source database with the same configuration as the original database except that the DB instance is created with the default DB security group.

Is it possible to override this parameter to use the same security group as the original instance?

Answer 1

Not without an additional API call. You will need to wait for the target database to move to an "available" state and then use modify-db-instance with the target database and security group as parameters.

Here's some pseudocode based off of a similar example I have in Powershell. Selecting information from describe-db-instances will vary by which language you're using the API with, but by default it looks like it comes back as JSON.

restore-db-instance-to-point-in-time --source-db-instance-identifier sourceDatabase --target-db-instance-identifier targetDatabase
while(targetinstance not "available")
{
    targetinstance = describe-db-instances --db-instance-identifier targetDatabase
    sleep for X seconds
}
modify-db-instance --db-instance-identifier targetInstance --db-security-groups mySecurityGroup

Answer 2

Where ${DB_IDENTIFIER_FROM} is the RDS DB identifier for the database your are duplicating and ${DB_IDENTIFIER_TO} will be the new database's identifier.

"sg-GROUP1" "sg-GROUP2" "sg-GROUP3" should be modified to the security groups you want.

sleep is unfortunately necessary as I've found it sometimes takes a bit for AWS to realize something is changing.

echo "[INFO] Spinning up new RDS from latest production snapshot"
aws rds restore-db-instance-to-point-in-time --source-db-instance-identifier ${DB_IDENTIFIER_FROM} --target-db-instance-identifier ${DB_IDENTIFIER_TO} --use-latest-restorable-time --db-subnet-group-name prodinado --multi-az --no-publicly-accessible --tags Key=workload-type,Value=other
echo "[INFO] Waiting RDS instance to spin up"
sleep 5; aws rds wait db-instance-available --db-instance-identifier ${DB_IDENTIFIER_TO}
echo "[INFO] Configuring the spun up RDS"
aws rds modify-db-instance --db-instance-identifier ${DB_IDENTIFIER_TO} --vpc-security-group-ids "sg-GROUP1" "sg-GROUP2" "sg-GROUP3" --apply-immediately --backup-retention-period 0
echo "[INFO] Waiting RDS instance configuration to finish"
sleep 5; aws rds wait db-instance-available --db-instance-identifier ${DB_IDENTIFIER_TO}