Cross-account database

When the database is in one account and the data lake in another, the export runs in the source account and writes straight into the Data Pump bucket. The raw data does not travel twice, and the snapshot does not need to be shared or copied.

This has one good practical consequence: the cluster does not need to use its own KMS key. Snapshots encrypted with the default RDS key (aws/rds) work — which would not be true if the snapshot had to be shared.

What is created in the source account

Only the minimum needed to export:

• One RDS event subscription, which reports when the snapshot is ready
• Two minimally scoped IAM roles: one for the export, one for the event

No data stays in that account, and Data Pump gains access to nothing beyond the exported snapshot.

Order matters

The source account goes into the package

Each source account adds permissions to the template, so it has to be stated in the handoff. Integrating a new account later requires a new package — it is not configurable in the console.

The two accounts reference each other, so the installation has three steps:

1. In the Data Pump account

sh install-datapump.sh

Creates the bucket and the export key, and prints the ARNs that step 2 needs.

2. In the source account

With the credentials of the account that hosts the cluster:

VERSION=v1.0.0 \
DATAPUMP_ACCOUNT=111122223333 \
DATAPUMP_TOPIC_ARN=arn:...:datapump-rds-snapshot-export-to-s3-prd \
DATAPUMP_BUCKET_ARN=arn:aws:s3:::datapump-datalake-prd \
DATAPUMP_EXPORT_KMS_KEY_ARN=arn:aws:kms:...:key/... \
SOURCE_CLUSTER_IDENTIFIER=meu-cluster \
sh install-source-account.sh

The four ARNs come from the output of step 1.

3. Back in the Data Pump account

sh source-accounts.sh add 444455556666

Authorizes the roles created in step 2 to write to the bucket and use the key. Without this step, the export fails with a permission error.

More than one source account

Repeat steps 2 and 3 for each account. source-accounts.sh keeps the list and reapplies the authorization for all of them — adding a new account does not remove the previous ones.

To see the current list:

sh source-accounts.sh list

After installing

The rest is the same as the single-account scenario: mark the cluster under Origens (Sources) and the databases under Bancos (Databases). See set up ingestion.

In the console, sources appear identified by account, so clusters with the same name in different accounts are not confused.