如何在Terraform中为多可用区RDS Aurora Postgres集群实现跨区域自动备份复制？

核心结论 #

可以通过RDS原生的aws_db_instance_automated_backups_replication资源实现跨区域自动备份复制，但针对Aurora集群的架构特性，需要注意故障切换后的行为；同时也有更可靠的低成本替代方案可选。

1. 使用aws_db_instance_automated_backups_replication的注意事项 #

这个资源原本为单RDS实例设计，但Aurora的writer实例本质是RDS实例，因此可以将source_db_instance_arn指向集群的writer实例ARN。但存在关键限制：

• Aurora的自动备份是集群级的，但aws_db_instance_automated_backups_replication绑定的是单个实例ARN。当集群因AZ故障切换到新的writer实例时，原有的复制关联会因源ARN失效而停止工作。

应对故障切换的优化方案

为避免硬编码writer实例ARN导致的复制中断，可通过Terraform数据源动态获取当前的writer实例：

# 动态获取当前集群的writer实例ARN
data "aws_rds_cluster_instance" "current_writer" {
  cluster_identifier = module.rds_aurora.cluster_id
  filter {
    name   = "is-writer"
    values = ["true"]
  }
}

# 配置跨区域自动备份复制
resource "aws_db_instance_automated_backups_replication" "cross_region" {
  source_db_instance_arn = data.aws_rds_cluster_instance.current_writer.arn
  target_region          = "us-west-2" # 替换为你的目标区域
  retention_period       = 35 # 最大支持35天，按需调整
  kms_key_id             = aws_kms_key.cross_region_backup.arn # 若使用加密备份，需指定目标区域的KMS密钥
}

• 注意：该方案需要定期执行terraform apply（或通过EventBridge等工具自动化触发）来同步新的writer实例ARN，否则故障切换后复制会中断一段时间，适合对RTO要求不高的场景。

2. 更可靠的低成本灾备方案（集群级快照复制） #

如果担心实例切换导致的复制中断，可采用EventBridge + Lambda触发Aurora集群自动快照的跨区域复制，完全基于RDS原生功能，成本极低：

• 原理：当Aurora自动创建集群快照时，EventBridge捕获事件并触发Lambda函数，调用RDS API将快照复制到目标区域。
• 优势：基于集群级快照，不受writer实例切换影响，无需绑定单个实例ARN。

Terraform配置示例

# 创建EventBridge规则，捕获自动快照创建事件
resource "aws_cloudwatch_event_rule" "aurora_snapshot_copy_trigger" {
  name        = "aurora-cluster-auto-snapshot-copy"
  description = "Trigger cross-region copy when Aurora automated cluster snapshot is created"

  event_pattern = jsonencode({
    source = ["aws.rds"]
    detail-type = ["RDS DB Cluster Snapshot Event"]
    detail = {
      EventCategories = ["creation"]
      SourceType = ["automated"]
      DBClusterIdentifier = [module.rds_aurora.cluster_id]
    }
  })
}

# 为Lambda配置IAM权限，允许复制RDS快照
resource "aws_iam_role" "snapshot_copy_lambda_role" {
  name = "aurora-snapshot-copy-lambda-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "lambda.amazonaws.com"
      }
    }]
  })
}

resource "aws_iam_policy" "snapshot_copy_policy" {
  name        = "aurora-snapshot-copy-policy"
  description = "Allow copying RDS cluster snapshots to target region"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = [
        "rds:CopyDBClusterSnapshot",
        "rds:DescribeDBClusterSnapshots"
      ]
      Effect = "Allow"
      Resource = "*"
    }]
  })
}

resource "aws_iam_role_policy_attachment" "snapshot_copy_attach" {
  role       = aws_iam_role.snapshot_copy_lambda_role.name
  policy_arn = aws_iam_policy.snapshot_copy_policy.arn
}

# 创建Lambda函数（此处省略函数代码，核心逻辑是调用CopyDBClusterSnapshot API）
resource "aws_lambda_function" "snapshot_copy" {
  filename      = "snapshot-copy.zip"
  function_name = "aurora-cross-region-snapshot-copy"
  role          = aws_iam_role.snapshot_copy_lambda_role.arn
  handler       = "index.handler"
  runtime       = "python3.11"
  # 其他配置省略
}

# 将EventBridge规则与Lambda绑定
resource "aws_cloudwatch_event_target" "lambda_target" {
  rule      = aws_cloudwatch_event_rule.aurora_snapshot_copy_trigger.name
  target_id = "lambda"
  arn       = aws_lambda_function.snapshot_copy.arn
}

# 允许EventBridge调用Lambda
resource "aws_lambda_permission" "allow_eventbridge" {
  statement_id  = "AllowExecutionFromEventBridge"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.snapshot_copy.function_name
  principal     = "events.amazonaws.com"
  source_arn    = aws_cloudwatch_event_rule.aurora_snapshot_copy_trigger.arn
}

• Lambda函数核心逻辑示例（Python）：

  import boto3
  
  def handler(event, context):
    rds = boto3.client('rds')
    snapshot_arn = event['detail']['SourceArn']
    target_region = 'us-west-2' # 替换为目标区域
    # 解析快照名称，生成目标快照名称
    snapshot_name = snapshot_arn.split(':')[-1]
    target_snapshot_name = f"{snapshot_name}-cross-region"
    
    rds.copy_db_cluster_snapshot(
      SourceDBClusterSnapshotIdentifier=snapshot_arn,
      TargetDBClusterSnapshotIdentifier=target_snapshot_name,
      TargetRegion=target_region
    )
  

3. 方案对比 #

内容的提问来源于stack exchange，提问作者s3-m-bocian