PolarDB:Shared backup sets

How it works

Sharing a backup set is an authorization mechanism that does not involve copying or transferring backup files. When you (the resource owner) share a backup set, the physical data remains stored in your account. You only grant read-only access to another party (the principal). The principal can view the shared backup set on their PolarDB console and use it to create a new cluster or restore data. However, they cannot delete or re-share the backup set. The entire process is built on the Alibaba Cloud Resource Sharing service, which ensures fine-grained permission control and operational security.

Benefits

• High efficiency: Sharing is nearly instantaneous, eliminating the time and cost of transferring terabytes of data between accounts.

• High security: Data remains in your account at all times. This eliminates the need for data transfers over public networks or sharing of account keys. Access is isolated and controlled through the Alibaba Cloud RAM service, mitigating the risk of data leakage.

• Low cost: Storage costs for the backup set are incurred only by the resource owner. The principal does not pay for the storage of the shared backup set and is charged only for new resources they create using the backup set, such as a new cluster.

• Easy to manage: You can share, view, and cancel shares on the console, and revoke access permissions at any time.

Prerequisites

• Cluster:

  • Sharing is not supported for Multi-master Cluster (Limitless) clusters.

  • Sharing is not supported for clusters that use the Three-AZ (with storage high availability and logger nodes enabled) high-availability mode.

  • You cannot share backup sets from the cluster recycle bin.

  • An available backup set must exist.

• Features: Neither Transparent Data Encryption (TDE) nor cloud disk encryption is enabled.

• Permissions: The RAM user or RAM role sharing the backup set must have administrator permissions for PolarDB (AliyunPolardbFullAccess) and Resource Sharing (AliyunResourceCenterFullAccess).

Limitations

The shared backup set feature has the following limitations:

• Sharing quotas:

  • A single backup set can be shared with a maximum of 64 Alibaba Cloud accounts.

  • By default, an Alibaba Cloud account can share a maximum of 1,000 resources as a resource owner. For PolarDB, you can Apply for a quota to share up to 1,024 backup sets.

    Note

    • The Resource Sharing service limits a single Alibaba Cloud account to sharing a maximum of 1,000 resources as a resource owner.

    • PolarDB limits a single Alibaba Cloud account to sharing a maximum of 1,024 backup sets as a resource owner.

• Cross-region backup sets (backup set IDs that start with rp-xxx) cannot be shared. Both sharing and restoration must occur within the same region. For example, if you share a backup set from a cluster in the China (Beijing) region, the principal can use it to restore data only to a new cluster within the China (Beijing) region.

• Sharing backup sets between the Alibaba Cloud China site and the Alibaba Cloud international site is not supported.

• A principal cannot re-share a shared backup set that they have received. Secondary sharing is not supported.

• The principal loses access if the resource owner releases the source cluster, deletes the backup set, or cancels the share, or if the backup set expires.

  Note

  Revoking access permissions takes about 10 minutes to take effect due to system task scheduling. During this period, the access permissions may still exist, but an attempt to restore the cluster from the backup set will fail.

Billing

• The shared backup set feature is free of charge.

• The resource owner pays the storage costs for the backup set. For more information about the billing rules, see Billing for backup storage that exceeds the free quota.

• A principal is not charged for accepting a shared backup set. However, the principal is charged standard rates for any new clusters they create from the shared backup set.

Share a backup set

1. Go to the PolarDB console. From the Clusters page, navigate to the Settings and Management > Backup and Recovery page of the target cluster.

2. On the Data Backup tab, find the backup set that you want to share and click Actions in the Share Backups column.

3. In the dialog box that appears, select a sharing method:

   Create resource share

   Select this method if you are sharing for the first time or if you want to create a separate management unit for this share.

   1. Set Resource Share Name: Specify a recognizable name for the resource share.

   2. Set Principal Scope: Define the scope of accounts that can be added as principals to this share.

      • Allow sharing with any account: The resource owner can share resources with any principal.

      • Allow sharing only within a resource directory: The resource owner can share resources only within the resource directory. This means the management account or members of a resource directory can share resources with other folders and members within the same resource directory.

   3. Set Principals: Enter the Alibaba Cloud account IDs of the principals with whom you want to share the backup set.

   4. Click OK.

   Use existing resource share

   Select this method to add the backup set to a resource share that you have already created.

   1. Select Resource Share: From the Select Resource Share drop-down list, select an existing resource share. The Shared Resource List displays the resources that are already in the selected resource share.

   2. (Optional) Edit Principals: You can modify the principals in the selected resource share based on your business requirements.

   3. Click OK.

4. After you share the backup set, the value in the Sharing Status column changes to Shared to Others for easy identification.

   Note

   The Shared to Others status appears only after you specify a principal. If no principal is configured, the column shows a hyphen (-).

Accept a shared backup set

After a resource owner shares a backup set, the principal must accept the invitation to use it.

1. Go to the Resource Management console. In the left-side navigation pane, choose Resource Sharing > Shared With Me.

2. In the upper-left corner, select the region where the shared backup set is located.

3. Find the sharing invitation from the resource owner and click Accept.

4. After you accept the invitation, the status of the backup set changes to Enabled.

Use a shared backup set

After you accept a shared backup set, you can use it to restore data to a new cluster.

1. Go to the PolarDB console. In the left-side navigation pane, choose Shared Backups.

2. On the Shared Backups page, go to the Shared With Me tab. Find the target backup set and click restore data to new cluster.

Manage shared backup sets

After you share or accept a shared backup set, you can manage it on the PolarDB console.

FAQ

References

• What is Resource Sharing?

• Manage shared resources as a resource owner

• Manage shared resources as a principal