How SnapshotShield Works

Deploy in 5 minutes via CloudFormation. Your snapshots are restored, tested and cleaned up entirely inside your own AWS account. Based on research*, regular automated backup testing is essential for reliable data protection.

Cross-account CloudFormation deployment
Your data never leaves your AWS account
5-20 min validation Data residency compliant Least-privilege IAM All AWS commercial regions

A two-stage deployment

A small IAM role you control, then a full validation pipeline deployed by SnapshotShield in your account.

Download CloudFormation
Execute it to create an IAM role
Launch deployment from your dashboard
We assume the role and deploy the pipeline
EventBridge + Step Functions validate every tagged snapshot

Stage 1 — IAM role

You stay in control

What you do:

  • • Download a pre-filled CloudFormation template from your dashboard
  • • Execute it in the AWS Console or via the CLI
  • • It creates a single cross-account IAM role with a unique ExternalId
  • • The role only allows actions on resources scoped to snapshotshield* or tagged SnapshotShieldResource
✓ You can revoke access at any time by deleting the stack

Stage 2 — Pipeline deployment

We deploy in your account

What we do:

  • • You click Launch Deployment from your dashboard
  • • We assume the IAM role and deploy the full pipeline via Terraform
  • • EventBridge rule, Step Functions, ARM Lambdas, DynamoDB, S3, SNS, Secrets Manager, IAM — all in your account
  • • Lambda images are pulled from our central ECR over a cross-account read-only permission
🔒 Snapshots, restored databases and reports stay in your account

Why two stages?

Security

A single IAM role with least privilege, scoped by resource prefix and tag conditions, protected by an ExternalId.

Data residency

Validation runs in your VPC, in your region. Reports land in your S3 bucket. Nothing is exfiltrated.

Operational simplicity

No agents to install, no databases to expose. Validations run on every tagged snapshot, automatically.

The validation process

An AWS Step Functions workflow orchestrates everything. From detection to cleanup, in 5 to 20 minutes.

1

Detection

An EventBridge rule reacts to RDS snapshot creation events for instances and clusters carrying the snapshotshield tag, then starts the Step Functions workflow.

  • • Real-time, no polling
  • • Manual, automated, or AWS Backup snapshots
  • • Untagged resources are ignored
2

Ephemeral infrastructure

A dedicated VPC, two private subnets, three security groups, a DB subnet group and VPC endpoints (SSM, Secrets Manager, S3) are created on the fly. You can also pin validation to an existing VPC.

  • • Network-isolated, no internet egress
  • • Tagged for protection and traceability
  • • Per-validation isolation
3

Restore

The snapshot is restored into a temporary RDS instance or Aurora cluster. Aurora Serverless v2 is used by default to scale ACUs only during the test window.

  • • Auto-detects instance vs cluster snapshots
  • • MySQL, PostgreSQL, Aurora MySQL, Aurora PostgreSQL
  • • Master password rotated through Secrets Manager
4

Integrity tests

A short-lived inspector Lambda is launched inside the VPC. It connects to the restored database, lists schemas and tables, counts rows, and runs sample queries.

  • • Schema and row-count validation
  • • Optional comparison with the source database
  • • Custom SQL checks supported
5

Report & alert

A detailed report is generated in three formats and dropped on your S3 bucket. An SNS notification is published with the validation outcome.

  • • JSON, HTML, CSV
  • • SNS to email, Slack, Lambda, webhook…
  • • Status and history persisted in DynamoDB
6

Cleanup

All temporary resources are deleted in dependency order: inspector Lambda, IAM role, RDS, subnet group, VPC endpoints, security groups, subnets, VPC.

  • • Strict dependency ordering with retries
  • • Hourly safety net deletes any orphan
  • • Zero footprint after each validation

Why Backup Testing is Critical

Understanding the importance of regular backup validation based on industry research

Industry Reality Check

Multiple comprehensive studies reveal critical gaps in backup testing:

46%

have never undertaken a test restore*

23%

of enterprises never test their backups* at all

78%

of organizations have lost data over the last year*, despite 73% having a backup solution in place

77%

who test backups encounter failures* during restoration attempts

Additional finding: Among organizations that suffered data loss, only 42% successfully restored all their data*.

The Problem with Untested Backups

False Security

Having backups doesn't guarantee they work when you need them most

Silent Failures

Backup corruption or incomplete data often goes undetected

Extended Downtime

Discovering backup issues during disasters leads to prolonged recovery

Compliance Violations

Many regulations require documented backup testing procedures

Benefits of Regular Testing

Predictable Recovery

Know your exact Recovery Time and Recovery Point Objectives

Early Problem Detection

Identify and fix backup issues before they become critical

Compliance Confidence

Maintain audit trails and documentation for regulatory requirements

Business Continuity

Minimize downtime and ensure reliable disaster recovery

The Solution: Automated Testing

Research* shows that automation is key to reliable backup testing. Manual processes are prone to human error and often skipped due to time constraints. Only about half of enterprises test their disaster recovery plans annually*.

100%
Consistent testing with automation
5-20min
Validation time vs hours manually
24/7
Continuous monitoring and alerts

Built on AWS managed services

No bespoke runtime, no agents. Just managed services orchestrated by Step Functions.

EventBridge

Tag-filtered RDS event triggers and an hourly safety scheduler.

Step Functions

Orchestrates the full workflow with built-in retries, waits, and error handling.

Lambda (ARM/Graviton)

Container-based Lambdas on Graviton — efficient and cost-optimized.

RDS & Aurora Serverless v2

Restore in instance or cluster mode. Serverless v2 by default for per-second billing.

DynamoDB

Tracks every validation with TTL retention and a status index.

S3

Encrypted, versioned bucket for JSON, HTML and CSV reports.

SNS

Notifications routable to email, Slack, webhooks or downstream Lambdas.

Secrets Manager & SSM

Database credentials and runtime configuration, all in your account.

Getting Started

Connect an AWS account and tag your databases. We do the rest.

1. Deploy the IAM role

Download the pre-filled CloudFormation template from your dashboard and execute it.

2. Launch the pipeline

Click Launch Deployment. We assume the role and provision the pipeline in your account.

3. Tag your databases

Add the snapshotshield tag on the RDS instances or clusters you want monitored. Every new snapshot is validated automatically.

What you need

An AWS account
In any commercial AWS region with RDS or Aurora
CloudFormation rights
To execute the IAM role template
A SnapshotShield account
Sign up to access the dashboard

Ready to validate your snapshots?

Deploy in 5 minutes. Validate every snapshot automatically. Sleep better.

Data never leaves your AWS account • CloudFormation deployment • Developer plan includes 14-day free trial