AWS Disaster Recovery
This documentation is for Kyvos 2026.6.x. To view documentation for other Kyvos versions, click here. |
|---|
Prerequisites
Before you perform the Disaster Recovery (DR), ensure you must complete the following prerequisites:
Ensure the database instance and secrets are promoted to the DR region.
Disaster Recovery (specify the region for DR) must be selected before deploying a cluster.
Provide appropriate permission on KMS in the Disaster Recovery region if another IAM user will deploy.
Note
The Kyvos Manager UI will be accessible to the customer only after all the required DR steps are completed.
On this page:
Disaster Recovery
Enable Console Access for kmsadmin-stackname User.
Login to IAM Console. Sign in to the AWS Management Console using your IAM user credentials.
Enable Console Access for kmsadmin-stackname
Locate and access the IAM user named kmsadmin-stackname.
Enable console access for this user.
Provide Permissions to kmsadmin-stackname User
Assign the AWSKeyManagementServicePowerUser permission to the kmsadmin-stackname IAM user.
Login to AWS Using kmsadmin-stackname User
Use the login credentials (password) created for the kmsadmin-stackname user to sign in to the AWS Management Console.
Give Permission on KMS Keys to Your User (User who will be performing DR)
Navigate to the KMS console.
Grant Permissions on KMS Keys
Locate the KMS Key: Identify the KMS key needed for DR deployment (identified by its alias, e.g., stackname).
Edit Key Policy, give your user (User who will be performing DR) permission on below 3 Statement IDs
Update the key policy to grant permissions for the following SIDs:
"Sid": "Enable IAM User Permissions"
"Sid": "Allow administration of the key"
"Sid": "Allow use of the key for Lambda, EC2 & EMR Service role"
Add below arns in DR Region KMS Key before the Recovery deployment.
QA- "arn:aws:iam::815559998352:role/ElasticBeanstalk-Ec2-Role"
Dev- "arn:aws:iam::456531263183:role/aws-elasticbeanstalk-ec2-role"
Prod- "arn:aws:iam::247489016023:role/aws-elasticbeanstalk-ec2-role"
Ensure that the stack name must be the same as the primary stack name.
Deploy the DR cluster with the Kyvos SaaS DR template, providing the necessary details. Ensure to select the appropriate Recovery Mode:
Auto: Automates disaster recovery; doesn’t require any manual steps.
Manual: Requires user’s intervention to perform disaster recovery steps.
After the DR cluster is deployed, log in to Kyvos Manager through the Kyvos SaaS Portal. Based on the selected Recovery Mode, follow the corresponding disaster recovery procedure:
Input for the Deployment environment variable is environment specific.
If you perform deployment in the kyvos-ms account, the input value must be dev.
If you perform the deployment in the kyvos-dev account, the input value should be test.
For production deployment, the input value must be prod.