Share backup sets

Sharing database backups with other teams for analysis or testing traditionally involves complex and time-consuming data exports and transfers. The shared backup set feature of PolarDB simplifies this process. Built on the Alibaba Cloud Resource Sharing service, it allows you to securely authorize another Alibaba Cloud account to use a specific backup set. The recipient can then use the shared backup set to quickly restore data to a cluster in their own account, significantly improving the efficiency and security of cross-account data collaboration.

Note

The shared backup set feature is currently in beta. To use this feature, submit a ticket to have it enabled.

How it works

Sharing a backup set is an authorization mechanism, not a data copy or transfer. When you, the resource owner, share a backup set, the physical data remains in your account. You only grant read-only access to another party (the principal). The principal can view the shared backup set in their PolarDB console and use it to create a new cluster or restore data, but they cannot delete or re-share it. The entire process is built on the Alibaba Cloud Resource Sharing service, ensuring fine-grained permission control and operational security.

Benefits

Efficient: Sharing is nearly instantaneous, eliminating the time and labor costs of transferring terabytes of data between accounts.
Secure: Data remains in your account and is not transferred over the public internet. Access is controlled through the Alibaba Cloud RAM system, preventing data leaks without needing to share account keys.
Cost-effective: The resource owner is responsible for backup storage costs. A principal does not pay for the storage of the shared backup set, only for new resources (such as new clusters) created from it.
Manageable: You can share, view, and cancel sharing through the console, and you can revoke access permissions at any time.

Prerequisites

Cluster:
- Sharing backup sets is not supported for Multi-master Cluster (Limitless) clusters.
- Sharing backup sets is not supported for clusters with the high-availability mode set to Three AZs (with storage hot-standby clusters and Logger nodes enabled).
- Sharing backup sets is not supported for PolarDB for PostgreSQL Distributed Edition clusters.
- You cannot share backup sets from the cluster recycle bincluster recycle bincluster recycle bin.
- An available backup set must exist.
Feature: Neither Transparent Data Encryption (TDE) nor cloud disk encryptionTransparent Data Encryption (TDE)Transparent Data Encryption (TDE) is enabled.
Permissions: The RAM user or RAM role performing the sharing operation must have administrator permissions for PolarDB (AliyunPolardbFullAccess) and Resource Sharing (AliyunResourceCenterFullAccess).

Limitations

Keep the following limitations in mind when using shared backup sets:

Sharing quota limits:
- A single backup set can be shared with a maximum of 64 Alibaba Cloud accounts.
- By default, an Alibaba Cloud account can share a maximum of 1,000 resources. For PolarDB backup sets, you can Apply for a quota increase to a maximum of 1,024.
  Note
  - The Resource Sharing service limits a single Alibaba Cloud account to sharing a maximum of 1,000 resources as a resource owner.
  - PolarDB limits a single Alibaba Cloud account to sharing a maximum of 1,024 backup sets as a resource owner.
Sharing a cross-region backup set (with a backup set ID starting with rp-xxx) is not supported. Sharing and restoration are supported only within the same region. For example, if you share a backup set from a cluster in China (Beijing), the principal can restore the cluster only in the China (Beijing) region of their Alibaba Cloud account.
Sharing backup sets between the Alibaba Cloud China site and the Alibaba Cloud international site is not supported.
A principal cannot re-share a shared backup set with other accounts (secondary sharing is not supported).
The principal loses access if the resource owner releases the cluster, deletes the backup set, or cancels the share, or if the backup set expires and is automatically released.

Note
Revocation is not immediate and typically takes about 10 minutes to take effect. During this delay, any attempt to restore data from the backup set will fail, even if the share appears to be active.

Billing

The shared backup set feature is free of charge.
The storage cost of the backup set is borne by its resource owner. For detailed billing rules, see Billing rules for backup storage (beyond the free quota)Billing rules for backup storage (beyond the free quota)Billing rules for backup storage (beyond the free quota).
A principal does not incur charges for accepting a shared backup set. However, when using the backup set to restore data or clone a new cluster, standard charges apply based on the specifications of the newly purchased cluster.

Share a backup set

Go to the Clusters page in the PolarDB console and navigate to the Settings and Management > Backup and Recovery page of the target cluster.
On the Data Backup tab, find the backup set that you want to share. In the Actions column, click Share Backups.
In the dialog box that appears, select a sharing method based on your needs:
New resource share

Choose this method if you are sharing for the first time or want to create a separate management unit for this share.
1. Set Resource Share Name: Enter an easy-to-identify name for this resource share.
2. Set Principal Scope: Define the scope of accounts that can be added as principals.
  - All Accounts: The resource owner can share resources with any principal.
  - Objects Within Resource Directory: The resource owner can share resources only within the Resource Directory. This allows the management account and member accounts to share resources with other accounts, folders, or the entire Resource Directory.
3. Set Principals: You can add principals to the current resource share based on your business needs.
4. Click OK.
Existing resource share

Choose this method if you want to add this backup set to a previously created resource share.
1. Select Resource Share: From the Select Resource Share drop-down list, choose an existing resource share. After selection, the Shared Resource List will display the resources already shared in the current resource share.
2. (Optional) Edit Principals: You can modify the principals in the existing resource share based on your business needs.
3. Click OK.
The Sharing Status of a resource can be Associated or Disassociated. In the upper-right corner, you can click the Current Resource Share Details link to view complete information about the resource share.
After you share the backup set, the Sharing Status column for the target backup set shows Shared to Others to help you identify it.

Note
The Shared to Others status is displayed only after a principal has been set. If no principal is set, it shows as -.

Accept a shared backup set

After a resource owner shares a backup set, the principal must accept the invitation to use it.

Go to the Resource Management console. In the left-side navigation pane, choose Resource Sharing > Shared With Me.
In the upper-left corner, select the region where the shared backup set is located.
Find the sharing invitation from the resource owner and click Accept.
After you accept it, the status of the backup set changes to Enabled.

Use a shared backup set

After accepting a shared backup set, you can use it to restore data to a new cluster.

Go to the PolarDB console. In the left-side navigation pane, choose Shared Backups.
On the Shared Backups page, on the Shared With Me tab, find the target backup set and click Restore Data to New Cluster.

Manage shared backup sets

After you share a backup set or accept a shared backup set, you can manage it centrally in the PolarDB console.

Note

If you, as the resource owner, share a backup set without setting a principal, the backup set does not appear on the Shared By Me tab.
When a backup set is in a locked state (for example, while being used for a restoration operation, or when a level-1 backup is being converted to a level-2 backup), you cannot modify or cancel the share.

View sharing relationship

On the Shared Backups page, on the Shared By Me tab, find the target backup set and click Manage Sharing.
On the Resource Sharing > Shared By Me page of the Resource Management console, you can view the resource share and principals associated with the backup set.

Modify sharing settings

On the Shared Backups page, on the Shared By Me tab, find the target backup set and click Shared Backups.
In the dialog box that appears, modify the sharing settings as needed.

Cancel a shared backup set

On the Shared Backups page, on the Shared By Me tab, find the target backup set and click Shared Backups.
In the dialog box that appears, edit the resource principals and Remove the corresponding principal. In the Resource Principals list, find the target principal and click Remove.

FAQ

After I share a backup set, can I, as the resource owner, still use it normally?

Yes. Sharing grants read-only access to others but does not affect your own use of the backup set, such as for data restoration or cluster cloning.

Why can't I find the backup set shared with me on the Shared Backups page in the PolarDB console?

This usually happens because you have not accepted the sharing invitation. Go to the Resource Sharing > Shared With Me page in the Resource Management console, find the invitation, and accept it. After you accept it, the backup set appears on the Shared With Me tab.

Why is there no Shared Backups option in the Actions column for a backup set?

Check whether your cluster has Transparent Data Encryption (TDE) or cloud disk encryptionTransparent Data Encryption (TDE)Transparent Data Encryption (TDE) enabled. Sharing encrypted backup sets is not currently supported.

Why do I get an error when I modify or cancel the sharing of a backup set?

You cannot modify sharing configurations or cancel the sharing of a backup set when it is locked. For example, a backup set is locked when it is being used for a restoration or is being converted from a level-1 to a level-2 backup.