AWS Snapshots
Complete Guide to EBS and RDS Backup Strategies

# Restore RDS to specific point in time
aws rds restore-db-instance-to-point-in-time \
  --source-db-instance-identifier mydb-prod \
  --target-db-instance-identifier mydb-pitr-restore \
  --restore-time 2025-10-10T10:27:43Z \
  --db-instance-class db.r6g.xlarge \
  --multi-az \
  --vpc-security-group-ids sg-xxxxx

# Or restore to latest restorable time (most recent transaction log)
aws rds restore-db-instance-to-point-in-time \
  --source-db-instance-identifier mydb-prod \
  --target-db-instance-identifier mydb-latest-restore \
  --use-latest-restorable-time \
  --db-instance-class db.r6g.xlarge

# Enable FSR on a snapshot for specific AZs
aws ec2 enable-fast-snapshot-restores \
  --availability-zones us-east-1a us-east-1b \
  --source-snapshot-ids snap-1234567890abcdef0

# Check FSR status
aws ec2 describe-fast-snapshot-restores \
  --filters Name=snapshot-id,Values=snap-1234567890abcdef0

# Read every block to initialize volume (slow but works)
sudo dd if=/dev/xvdf of=/dev/null bs=1M status=progress

# Time: ~1 hour per 500GB on gp3

# Share snapshot with specific account
aws ec2 modify-snapshot-attribute \
  --snapshot-id snap-1234567890abcdef0 \
  --attribute createVolumePermission \
  --operation-type add \
  --user-ids 123456789012

# Target account copies snapshot to their own account (same region)
aws ec2 copy-snapshot \
  --source-region us-east-1 \
  --source-snapshot-id snap-1234567890abcdef0 \
  --description "Copy of shared production snapshot"

# Or copy to different region
aws ec2 copy-snapshot \
  --source-region us-east-1 \
  --source-snapshot-id snap-1234567890abcdef0 \
  --region us-west-2 \
  --description "Cross-region copy of shared snapshot"

# Original account can revoke access
aws ec2 modify-snapshot-attribute \
  --snapshot-id snap-1234567890abcdef0 \
  --attribute createVolumePermission \
  --operation-type remove \
  --user-ids 123456789012

# Share RDS snapshot with another account
aws rds modify-db-snapshot-attribute \
  --db-snapshot-identifier mydb-snapshot \
  --attribute-name restore \
  --values-to-add 123456789012

# Target account copies snapshot
aws rds copy-db-snapshot \
  --source-db-snapshot-identifier arn:aws:rds:us-east-1:999999999999:snapshot:mydb-snapshot \
  --target-db-snapshot-identifier mydb-copy \
  --region us-east-1

import boto3
import random
from datetime import datetime

def lambda_handler(event, context):
    ec2 = boto3.client('ec2')
    sns = boto3.client('sns')

    # Get production snapshots from last 7 days
    snapshots = ec2.describe_snapshots(
        Filters=[
            {'Name': 'tag:Environment', 'Values': ['Production']},
            {'Name': 'status', 'Values': ['completed']}
        ],
        OwnerIds=['self']
    )['Snapshots']

    if not snapshots:
        raise Exception("No snapshots found for verification")

    # Select random snapshot for testing
    test_snapshot = random.choice(snapshots)
    snapshot_id = test_snapshot['SnapshotId']

    try:
        # Create test volume
        volume = ec2.create_volume(
            SnapshotId=snapshot_id,
            AvailabilityZone='us-east-1a',
            VolumeType='gp3',
            TagSpecifications=[{
                'ResourceType': 'volume',
                'Tags': [
                    {'Key': 'Purpose', 'Value': 'SnapshotVerification'},
                    {'Key': 'DeleteAfter', 'Value': datetime.now().isoformat()}
                ]
            }]
        )

        volume_id = volume['VolumeId']

        # Wait for volume to be available
        waiter = ec2.get_waiter('volume_available')
        try:
            waiter.wait(
                VolumeIds=[volume_id],
                WaiterConfig={'Delay': 15, 'MaxAttempts': 40}
            )
        except Exception as waiter_error:
            # Cleanup failed volume and alert
            try:
                ec2.delete_volume(VolumeId=volume_id)
            except:
                pass  # Volume may not exist
            raise Exception(f"Volume failed to become available: {str(waiter_error)}")

        # In real scenario: attach to test EC2, mount, verify filesystem, run integrity checks
        # For brevity, we'll just verify volume creation succeeded

        # Cleanup: Delete test volume
        ec2.delete_volume(VolumeId=volume_id)

        # Report success
        sns.publish(
            TopicArn='arn:aws:sns:us-east-1:123456789012:snapshot-verification',
            Subject=f'✅ Snapshot Verification SUCCESS: {snapshot_id}',
            Message=f'Successfully verified snapshot {snapshot_id} from {test_snapshot["StartTime"]}'
        )

        return {
            'statusCode': 200,
            'body': f'Verification successful for {snapshot_id}'
        }

    except Exception as e:
        # Alert on failure
        sns.publish(
            TopicArn='arn:aws:sns:us-east-1:123456789012:snapshot-verification',
            Subject=f'❌ Snapshot Verification FAILED: {snapshot_id}',
            Message=f'Failed to verify snapshot {snapshot_id}: {str(e)}'
        )
        raise