/
Kyvos SaaS Portal Disaster Recovery Steps

Kyvos SaaS Portal Disaster Recovery Steps

This documentation is for Kyvos 2026.6.x. To view documentation for other Kyvos versions, click here.

This documentation is for Kyvos 2026.6.x. To view documentation for other Kyvos versions, click here.

Overview

This page provides a step-by-step guide for setting up Active-Passive Disaster Recovery (DR) for the Kyvos SaaS Portal on AWS, covering the creation and configuration of all required DR-region resources — RDS read replicas, Secrets Manager, SQS, MQ, S3 replication, AMI copies, and Elastic Beanstalk environments.

It also details the failover procedure, including promoting replicas to standalone, updating configurations and database URLs to point to the DR region, and recovering the SaaS Reporting Cluster with SSO and security settings.

Creating Resources for Active-Passive Disaster Recovery (DR) of the SaaS Portal

Before configuring Active-Passive Disaster Recovery (DR) for the SaaS Portal, create and configure the required AWS resources in the DR region. These resources ensure that the DR environment can be activated with minimal downtime during a failover event.

The following resources must be created and configured in the DR region:

  • Amazon RDS Read Replica

  • AWS Secrets Manager Secret Replication

  • Amazon SQS Queues

  • Amazon MQ Broker

  • Amazon S3 Bucket Replication

  • Amazon Machine Image (AMI) Replication

  • AWS Elastic Beanstalk Environment

  • Create VPC and DB subnet group

After these resources are provisioned, update the required configuration values and secrets to point to the DR-region resources before promoting the DR environment to active status.

Create an RDS Read Replica in the DR Region

  1. Open the Amazon RDS console.

  2. Switch to the primary AWS Region (for example, us-east-1).

  3. Select the primary RDS instance.

  4. Ensure that automated backups are enabled.

  5. Click Actions > Create read replica.

  6. Select the DR Region (for example, af-south-1) as the destination Region.

  7. Configure the read replica using the same:

    • DB instance class

    • Storage type

    • Parameter group

    • Option group

  8. Configure the VPC, subnet group, and security groups for the DR Region.

  9. If encryption is enabled, select the appropriate KMS key in the DR Region.

  10. Click Create read replica.

  11. Wait for the replica status to become Available.

Replicate Secrets to the DR Region

  1. Open AWS Secrets Manager.

  2. Switch to the primary AWS Region (for example, us-east-1).

  3. Select the secret to replicate.

  4. Click Actions > Replicate secret to other Regions.

  5. Select the DR Region (for example, af-south-1).

  6. Select the KMS key to use for encryption in the DR Region.

  7. Click Replicate secret.

  8. Verify that the replicated secret is available in the DR Region.

  9. Update the secret values with DR-specific configuration, as required.

On this page:

Secret Values to Update After Promoting the Secret to Standalone

The following secret values must be updated after the DR resources are provisioned and the replicated secret is converted to a the standalone secret.

Note

The following parameters are currently not present in the primary region secret:

  • notification.sqs.onscreen-queue-url

  • sqs.email.queue.url

  • notification.sqs.email-queue-url

Ensure that these parameters are added to the DR region secret before proceeding.

Secret

perform

cluster.emr.deployment.template.url

Change region and bucket name in URL

cluster.k8s.deployment.template.url

Change region and bucket name in URL

dbUrl

Update the URL with the replicated DB URL

sqs.queue.url

Update the URL with the new SQS URL

sqs.email.queue.url

Update the Region in the existing URL

sqs.cluster.queue.url

Update the value with new one

notification.sqs.email-queue-url

Update the Region in the existing URL

notification.sqs.onscreen-queue-url

Update the Region in the existing URL

cluster.deployment.template.url

Change the URL with new S3 URl

mq.host

change value with new endpoint (without port and protocol)

Ex: old - b-10e25e73-bc5b-45e8-94db-1129558e2a11-1.mq.us-east-1.amazonaws.com

New - b-5d2d7597-29e8-47b9-9d29-c8c8fc6675c9-1.mq.af-south-1.amazonaws.com

mq.client.username

(user will be `saas-mq-user`) Step during the mq creation

mq.client.passcode

Generation of passcode at the time of creation

Note: Use the same username and passcode as in the primary environment.

mq.system.username

(user will be `saas-mq-user`) Step during the mq creation

mq.system.passcode

Generation of passcode at the time of creation

intellicus.dns.mapped.url

(Cost analysis dashboard URL --

no need to change if same dns mapping is being used after Cost Analysis Dashboard Kyvos Cluster DR)

azure.template.url

Update the new S3 link of replicated bucket

Create Amazon SQS Queues in the DR Region

  1. Open the Amazon SQS console.

  2. Switch to the DR Region (for example, af-south-1).

  3. Note the queue names and configuration settings of the SQS queues in the primary Region.

  4. Click Create queue.

  5. Select the same queue type as the corresponding primary queue (Standard or FIFO).

  6. Configure the queue using the same settings as the primary queue:

    • Visibility timeout

    • Message retention period

    • Delivery delay

    • Maximum message size

    • Dead-letter queue configuration

    • Encryption settings

    • IAM access policies

  7. Create the queue.

  8. Repeat the procedure for each SQS queue required in the DR Region.

  9. Note the queue URLs and ARNs for use in the DR environment configuration.

Note

Use the same queue names as the primary Region whenever possible.

Create an Amazon MQ Broker in the DR Region

  1. Open the Amazon MQ console.

  2. Switch to the DR Region (for example, af-south-1).

  3. Click Create broker.

  4. Enter a broker name. Use the same broker name as the primary Region, if available.

  5. Configure the broker using the same settings as the primary broker:

    • Broker engine and version

    • Deployment mode

    • Instance type

    • Networking configuration

    • Security groups

  6. Create the broker user and specify a username and password.

  7. Complete the broker creation process.

  8. Wait for the broker status to change to Running.

  9. If a password was not configured during broker creation:
    a. Open the broker details page.
    b. Select Users.
    c. Click Edit.
    d. Create or update the user password.
    e. Save the changes.

  10. Record the broker endpoint for use in the DR environment configuration.

S3 Bucket Replication

  • Buckets in the Dev account:

    • saas-public-mailboxes-blacklist

  • Buckets in the QA account:

    • kyvos-saas-terraform-bucket-qa

  • Buckets in the MS account:

  1. Open the Amazon S3 console.

  2. Switch to the primary Region (us-east-1).

  3. Verify that the required source buckets are available.

  4. Create corresponding buckets in the DR Region (af-south-1), if they do not already exist.

  5. Enable versioning on both the source and destination buckets.

  6. Open the source bucket and navigate to Management > Replication rules.

  7. Click Create replication rule.

  8. Select the destination bucket in the DR Region.

  9. Configure the IAM replication role.

  10. Enable replication for all objects.

  11. Enable replication of delete markers, if required.

  12. Save the replication rule.

  13. Repeat the preceding steps for each bucket that requires replication.

  14. Verify that replication is configured successfully.

  15. Upload a test file to the source bucket and confirm that it is replicated to the destination bucket.

  16. Verify that the bucket policies and permissions are correctly configured in the DR Region.

AMI Replication

  1. Open the Amazon EC2 console.

  2. Switch to the primary Region (us-east-1).

  3. Navigate to AMIs.

  4. Select the AMI currently used by the Elastic Beanstalk environment.

  5. Click Actions > Copy AMI.

  6. Select the DR Region (af-south-1) as the destination Region.

  7. Specify an AMI name using the existing naming convention.

  8. Configure the snapshot and encryption settings, as required.

  9. Click Copy AMI.

  10. Switch to the DR Region (af-south-1).

  11. Wait for the copied AMI status to change to Available.

  12. Note the AMI ID of the copied image.

Create an Elastic Beanstalk Environment in the DR Region

  1. Open the AWS Elastic Beanstalk console.

  2. Switch to the DR Region (af-south-1).

  3. Create the application, if it does not already exist.

  4. Create a new environment for the application.

  5. Specify an environment name. Use the same name as the primary environment, if available.

  6. Select the same platform and platform version as the primary environment.

  7. Upload the same application version or deployment package used in the primary Region.

  8. Configure the same environment type (Load Balanced or Single Instance).

  9. Configure the same EC2 instance type and Auto Scaling settings.

  10. Configure the same VPC, subnets, and security groups.

  11. Configure the same environment variables and application settings.

  12. Attach the same IAM instance profile and service role.

  13. Configure the same load balancer settings and health checks.

  14. Update the configuration to use the DR Region resources, including the RDS, MQ, SQS, and S3 endpoints.

  15. Click Create environment.

  16. Wait for the environment health status to become Green.

  17. Validate application accessibility and functionality.

  18. Perform smoke testing for the application UI and APIs.

  19. Verify logs, monitoring, and overall application health in the DR Region.

Update the AMI for the Elastic Beanstalk DR Environment

  1. Open a terminal with AWS CLI configured.

  2. Run the following command to update the AMI used by the Elastic Beanstalk environment:

    aws elasticbeanstalk update-environment \ --region af-south-1 \ --environment-name Kyvos-saas-portal-QA-env-1 \ --option-settings Namespace=aws:autoscaling:launchconfiguration,OptionName=ImageId,Value=<DR-AMI-ID>

For example:

aws elasticbeanstalk update-environment \ --region af-south-1 \ --environment-name Kyvos-saas-portal-QA-env-1 \ --option-settings Namespace=aws:autoscaling:launchconfiguration,OptionName=ImageId,Value=ami-031dda554271eefdd

Perform Active-Passive DR for the SaaS Portal

Verify the DR Environment Capacity

  1. Open the AWS Elastic Beanstalk console.

  2. Switch to the DR Region (af-south-1).

  3. Open the DR Elastic Beanstalk environment.

  4. Navigate to Configuration > Capacity.

  5. Verify the Auto Scaling configuration:

    • Minimum instances = 0

    • Maximum instances = as required for the DR environment

  6. Confirm that no EC2 instances are currently running in the DR environment before initiating the DR process.

Promote the RDS Read Replica to a Standalone Database

  1. Open the Amazon RDS console.

  2. Switch to the DR Region (af-south-1).

  3. Navigate to Databases.

  4. Select the DR read replica.

  5. Verify that the replication status is healthy.

  6. Click Actions > Promote read replica.

  7. Specify a backup retention period, if required.

  8. Confirm the promotion.

  9. Wait for the database status to change to Available.

  10. Verify that replication has been removed and that the database is operating as a standalone instance.

  11. Note the writable database endpoint.

  12. Update the application or Elastic Beanstalk configuration to use the DR database endpoint.

  13. Restart application services, if required.

  14. Validate database connectivity and application functionality.

Promote the Replicated Secret to a Standalone Secret

  1. Open AWS Secrets Manager.

  2. Switch to the DR Region (af-south-1).

  3. Open the replicated secret.

  4. Verify that the secret is available in the DR Region.

  5. Retrieve and review the secret values.

  6. Update the secret values with DR-specific configuration.

  7. Ensure that all DR endpoints and credentials are correctly configured.

  8. Save the updated secret.

  9. Verify that applications and services are using the updated secret.

  10. Test database and API authentication using the updated secret.

  11. Validate application connectivity.

Update Environment Variables in the Elastic Beanstalk Environment

  1. Open the AWS Elastic Beanstalk console.

  2. Switch to the DR Region (af-south-1).

  3. Open the DR Elastic Beanstalk environment.

  4. Navigate to Configuration.

  5. Under Updates, Monitoring, and Logging, click Edit.

  6. Add or update the environment variables required for the DR Region.

  7. Update the following variables:

 

Variable

Value

terraform.s3.bucket

Dev -

TERRAFORM_S3_BUCKET

like kyvos-saas-terraform-bucket-dev.af-south-1

 

QA-

TERRAFORM_S3_BUCKET

like kyvos-saas-terraform-bucket-qa.af-south-1

 

 

Production-

TERRAFORM_S3_BUCKET

like kyvos-saas-terraform-bucket-prod.af-south-1

 

email.blacklist.bucket

EMAIL_BLACKLIST_BUCKET_NAME

like saas-public-mailboxes-blacklist.af-south-1

aws.template.region

AWS_TEMPLATE_REGION

af-south-1

email.blacklist.region

EMAIL_BLACKLST_REGION

af-south-1

aws.secrets.manager.gcp-template-region

AWS_SECRETS_MANAGER_GCP_TEMPLATE_REGION

af-south-1

aws.secrets.manager.region

AWS_SECRETS_MANAGER_REGION

af-south-1

terraformBucket.s3.region

TERRAFORMBUCKET_S3_REGION

af-south-1

aws.secrets.manager.azure-template-region

AWS_SECRETS_MANAGER_AZURE_TEMPLATE_REGION

af-south-1

  1. Click Apply.

  2. Wait for the environment update to complete.

  3. Verify that the environment health status changes to Green.

  4. Validate application functionality using the updated DR configuration.

Update Database URLs for the DR Region

  1. Connect to the bastion host using SSH.

  2. Connect to the DR RDS instance using the following command:

psql --host=<DR-RDS-ENDPOINT> \ --port=5432 \ --username=postgres \ --dbname=kyvos_saas_db

  1. Enter the database password when prompted.

  2. Run the database update scripts in the DR RDS instance.

Execute the following SQL commands:

UPDATE kyvos_version SET deployment_templateurl = REPLACE(deployment_templateurl, 'us-east-1', 'af-south-1') WHERE deployment_templateurl LIKE '%us-east-1%'; UPDATE kyvos_version SET deployment_templateurl = REPLACE(deployment_templateurl, 'kyvos-saas-prerequisites-ms', 'kyvos-saas-prerequisites-ms.af-south-1') WHERE deployment_templateurl LIKE '%kyvos-saas-prerequisites-ms%';

  1. Validate the updated values by running:

SELECT deployment_templateurl FROM kyvos_version;

  1. Verify that the URLs contain:

    • af-south-1

    • kyvos-saas-prerequisites-ms.af-south-1

  2. Exit the database session.

Enable Session Stickiness for the Target Group

  1. Open the Amazon EC2 console.

  2. Switch to the DR Region (af-south-1).

  3. Open Target Groups.

  4. Select the target group associated with the DR Elastic Beanstalk load balancer.

  5. Open the Attributes tab and click Edit.

  6. Enable Stickiness.

  7. Select Load balancer generated cookie as the stickiness type.

  8. Configure the stickiness duration, as required.

  9. Click Save changes.

  10. Verify that stickiness is enabled.

  11. Validate session persistence after logging in to the application.

Deploy the Application JAR File

  1. Open the AWS Elastic Beanstalk console.

  2. Switch to the DR Region (af-south-1).

  3. Open the DR Elastic Beanstalk environment.

  4. Click Upload and Deploy.

  5. Select the application JAR file.

  6. Enter a version label.

  7. Click Deploy.

  8. Wait for the deployment to complete.

  9. Verify that the environment health status changes to Green.

  10. Review the application logs for startup validation.

  11. Verify that the EC2 instances are running the updated application version.

  12. Access the application URL and validate functionality.

  13. Perform smoke testing for the UI and APIs.

  14. Confirm that the deployment completed successfully.

Disaster Recovery of SaaS Reporting Cluster

To disaster recovery of SaaS Reporting cluster, perform the following steps.

  1. Create a Kyvos SNS cluster.

  2. Retrieve the SSO private key from the Kyvos cluster and update it in the SaaS secret.

  3. Create a connection to the SaaS RDS.

  4. Deploy the SaaS CAB in the Kyvos cluster.

  5. Configure HTTPS. (This step is not required for SaaS Kyvos clusters, as HTTPS is already enabled.)

  6. Configure Cross-Site settings:

    • Go to Kyvos Manager > Network Security.

    • Click the three-dot menu.

    • Enter the SaaS Portal URL.

    • Change the SameSite attribute to None.

  7. Configure Kyvos authentication:

    • Go to Security > Kyvos Authentication.

    • Click the three-dot menu next to Revert.

    • Add the following configuration:

      { "groupName": "SAAS-WorkbookAccess" }

  8. In Kyvos Properties, add the following property:

    • Key: EXT_AUTH_HEADER_ID

    • Value: sessionid

  9. Set the REFINE_USERNAME_FOR_SSO property to NO in Kyvos Properties.

  10. Add secure="true" to the 8081 connector section in the server.xml file. (This step is not required for HTTPS-enabled Kyvos clusters.)

  11. Go to Kyvos Manager > Data Security, upload the JAR file, specify the class com.custom.AccountFilterProvider, and click Save.

Copyright Kyvos, Inc. 2026. All rights reserved.