Problem Description
When performing an air-gapped backup of RDS resources to the Druva Cloud, the backup job fails during Step 2 with the following error message:
“Copying unencrypted cluster with encryption is not supported”
Traceback
During the aws/rdsairgap/copyresource step, the job fails with the status code InvalidParameterValue, indicating that the RDS cluster snapshot cannot be copied because encryption requirements are not met.
"step": "aws/rdsairgap/copyresource",
"status_message": "Copying unencrypted cluster with encryption is not supported",
"status_code": "InvalidParameterValue",
"resource_type": "RDSClusterSnapshot",
"resource_id": "xxxxxxxxxxxxxx",
Cause
This issue occurs due to one of the following encryption-related conditions:
The RDS data being backed up is unencrypted
The RDS data is encrypted using an AWS Managed Key (AMK)
Druva supports air-gapped backups only for RDS data encrypted with a Customer Managed Key (CMK).
Air-gapped backups are not supported for:
Unencrypted RDS data
RDS data encrypted using AWS Managed Keys (AMK)
Resolution
To successfully perform an air-gapped backup for RDS resources:
Verify that the RDS instance or cluster is encrypted
Ensure that encryption is configured using a Customer Managed Key (CMK)
If the RDS resource is unencrypted or encrypted with an AWS Managed Key, reconfigure encryption using a CMK before attempting the backup again
Druva does not support air-gapped backups for unencrypted RDS resources or those encrypted with AWS Managed Keys.
See Also