S3 Backup & Cross-Region Replication

🎯 Mục tiêu Task 16: Setup S3 Cross-Region Replication - DISASTER RECOVERY + BACKUP

16.0 S3 CRR Overview

Task 16 enable cross-region backup:

  • 🌏 Cross-Region Replication: Auto-sync data across regions
  • 💾 Disaster Recovery: Backup critical data
  • 🏪 Business Continuity: Service availability during outages
  • 📊 Compliance: Meet DR requirements

Backup Strategy: Primary Region (ap-southeast-1) → Backup Region (ap-northeast-1)

16.1 Prerequisites

  • ✅ S3 buckets with critical data
  • ✅ Data classification (what to backup)
  • ✅ Cross-region permissions

16.2 Identify Critical Buckets

16.2.1 Data Classification

S3 Console → Review existing buckets:

Critical buckets cần backup:

High Priority:
  vinashoes-product-images: Product catalog images
  vinashoes-artifacts-prod: CI/CD build artifacts
  
Medium Priority:
  vinashoes-cloudtrail-logs: Audit trail logs
  vinashoes-aws-config: Configuration snapshots
  
Low Priority:
  vinashoes-temp-uploads: Temporary files

16.2.2 Backup Strategy Planning

Disaster Recovery Matrix:

Region Strategy:
  Primary: ap-southeast-1 (Singapore)
  Backup: ap-northeast-1 (Tokyo)
  
Replication Rules:
  Product Images: Full replication (business critical)
  CI/CD Artifacts: Selective replication (recent builds only)
  Logs: Archive to Glacier in backup region

16.3 Create Destination Buckets

16.3.1 Product Images Backup Bucket

S3 Console → Create bucket (ap-northeast-1):

  1. Basic Configuration:

    • Bucket name: vinashoes-product-images-backup-apne1
    • Region: Asia Pacific (Tokyo) ap-northeast-1

  2. Settings:

    • ✅ Block public access
    • ✅ Enable versioning (required for CRR)
    • ✅ Server-side encryption (SSE-S3)

  3. Advanced:

    • Object lock: Disabled
    • Tags: Environment=backup, Purpose=disaster-recovery

16.3.2 Artifacts Backup Bucket

S3 Console → Create bucket (ap-northeast-1):

  1. Basic Configuration:

    • Bucket name: vinashoes-artifacts-backup-apne1
    • Region: Asia Pacific (Tokyo) ap-northeast-1

  2. Lifecycle Configuration:

    • Transition to IA after 30 days
    • Transition to Glacier after 90 days
    • Delete after 365 days

16.4 IAM Role for Replication

16.4.1 Create Replication Role

IAM Console → Roles → Create role:

  1. Trusted Entity:

    • AWS service → S3

  2. Permissions Policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObjectVersionForReplication",
        "s3:GetObjectVersionAcl",
        "s3:GetObjectVersionTagging"
      ],
      "Resource": [
        "arn:aws:s3:::vinashoes-product-images/*",
        "arn:aws:s3:::vinashoes-artifacts-prod/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ReplicateObject",
        "s3:ReplicateDelete",
        "s3:ReplicateTags"
      ],
      "Resource": [
        "arn:aws:s3:::vinashoes-product-images-backup-apne1/*",
        "arn:aws:s3:::vinashoes-artifacts-backup-apne1/*"
      ]
    }
  ]
}
  1. Role Name: VinaShoesS3ReplicationRole

16.5 Configure CRR Rules (20 phút)

16.5.1 Product Images Replication

S3 Console → vinashoes-product-images → Management → Replication:

  1. Create Replication Rule:

    • Rule name: ProductImagesBackup
    • Status: Enabled

  2. Rule Scope:

    • ✅ Apply to all objects in bucket

  3. Destination:

    • Bucket: vinashoes-product-images-backup-apne1
    • Storage class: Standard
    • ✅ Replicate existing objects

  4. Additional Options:

    • ✅ Replicate delete markers
    • ✅ Replicate replica modifications
    • Replication time control: Disabled (để save cost)

16.5.2 Artifacts Selective Replication

S3 Console → vinashoes-artifacts-prod → Management → Replication:

  1. Create Replication Rule:

    • Rule name: ArtifactsBackup
    • Status: Enabled

  2. Rule Scope:

    • Prefix: backend/
    • Tags: Environment=prod

  3. Destination:

    • Bucket: vinashoes-artifacts-backup-apne1
    • Storage class: Standard-IA
    • ✅ Change storage class

  4. Additional Options:

    • ❌ Replicate delete markers (keep original for audit)
    • ✅ Replica modification sync

16.6 Test Replication (10 phút)

16.6.1 Upload Test Files

S3 Console → vinashoes-product-images → Upload:

  1. Test Product Image:

    • Upload: test-product-image.jpg
    • Monitor replication status

  2. Check Replication:

    • Navigate to backup bucket
    • Verify file appears within 15 minutes
    • Check metadata và tags

16.6.2 Monitor Replication Metrics

CloudWatch Console → Metrics → S3:

  1. Replication Metrics:

    • ReplicationLatency
    • BytesReplicated
    • ObjectsReplicated

  2. Setup Alerts:

    • Failed replication events
    • High replication latency

CLI Reference:

# Test upload file
aws s3 cp test-image.jpg s3://vinashoes-product-images/

# Check replication status
aws s3api head-object \
  --bucket vinashoes-product-images \
  --key test-image.jpg \
  --query 'ReplicationStatus'

# Verify in destination
aws s3 ls s3://vinashoes-product-images-backup-apne1/

16.7 Disaster Recovery Testing

16.7.1 DR Simulation

Test scenario: Singapore region unavailable

  1. Access Backup Region:

    • Switch console to ap-northeast-1
    • Verify all critical data accessible

  2. Application Failover:

    • Update application config
    • Point to backup S3 endpoints

  3. Data Verification:

    • Compare file counts
    • Verify latest data replicated

16.8 Clean Up Resources

⚠️ Cảnh báo: Việc clean up sẽ xóa vĩnh viễn dữ liệu backup và replication rules. Hãy đảm bảo không còn cần thiết trước khi thực hiện!

CLI Commands for Clean Up

Xóa replication rules:

# Xóa replication rule cho product images
aws s3api delete-bucket-replication \
  --bucket vinashoes-product-images \
  --id ProductImagesBackup

# Xóa replication rule cho artifacts
aws s3api delete-bucket-replication \
  --bucket vinashoes-artifacts-prod \
  --id ArtifactsBackup

Xóa backup buckets:

# Xóa tất cả objects trong backup buckets
aws s3 rm s3://vinashoes-product-images-backup-apne1 --recursive
aws s3 rm s3://vinashoes-artifacts-backup-apne1 --recursive

# Xóa backup buckets
aws s3 rb s3://vinashoes-product-images-backup-apne1
aws s3 rb s3://vinashoes-artifacts-backup-apne1

Xóa IAM role:

# Detach policy và xóa role
aws iam detach-role-policy \
  --role-name VinaShoesS3ReplicationRole \
  --policy-arn arn:aws:iam::aws:policy/service-role/AmazonS3ReplicationRole

aws iam delete-role --role-name VinaShoesS3ReplicationRole

📋 Lưu ý khi clean up:

  • Xóa replication rules trước khi xóa buckets
  • Backup buckets có thể chứa dữ liệu quan trọng - kiểm tra kỹ
  • IAM role có thể được sử dụng cho các replication khác

16.9 Cost Analysis

💰 Phân tích chi phí S3 Cross-Region Replication

Bảng 16.9.1: Chi phí S3 Storage

Storage Class Primary Region (Singapore) Backup Region (Tokyo) Ghi chú
Standard $0.023/GB/tháng $0.025/GB/tháng Hot data
Standard-IA $0.0125/GB/tháng $0.0138/GB/tháng Infrequent access
Glacier $0.004/GB/tháng $0.0044/GB/tháng Archive

Bảng 16.9.2: Chi phí Replication

Component Chi phí Ghi chú
Data Transfer (CRR) $0.02/GB Transfer từ Singapore → Tokyo
Replication Time Control $0.015/GB Nếu enable RTC
Requests $0.005/1,000 requests API calls cho replication
Storage (Backup) Tùy storage class Nhân đôi storage costs

Bảng 16.9.3: Chi phí Setup (ước tính cho 100GB data)

Component Chi phí Ghi chú
Primary Storage (100GB) $2.30/tháng Standard class
Backup Storage (100GB) $2.50/tháng Standard class
Data Transfer (Initial) $2.00 One-time setup
Replication (Ongoing) $0.20/tháng Per GB changes
Tổng cộng ~$7.00/tháng Plus initial $2

Bảng 16.9.4: Usage Scenarios & Cost Optimization

Scenario Estimated Monthly Cost Optimization Tips
Small E-commerce (10GB) $1-2 Use IA cho backup
Medium E-commerce (1TB) $50-100 Selective replication
Large E-commerce (10TB+) $500+ Glacier cho archive
Development/Test $0.50-1 Small test data

Bảng 16.9.5: ROI Analysis (DR Protection)

Metric Without CRR With CRR Savings/Benefit
Data Durability 99.999999999% 99.999999999% Same, but geo-redundant
RTO (Recovery Time) Hours-Days Minutes Faster recovery
Business Impact High Low Reduced downtime costs
Compliance Partial Full Meet DR requirements
Annual Cost $0 $84 Cost of protection vs risk

💡 Cost Optimization Tips:

  • Sử dụng selective replication chỉ cho critical data
  • Chuyển backup sang IA/Glacier sau 30 ngày
  • Monitor replication costs với CloudWatch
  • Consider S3 Batch Replication cho existing data
  • Use lifecycle policies để tự động optimize storage