Operations
5 min read
Checking Backup Status
Run footprint-dr status [--sandbox/--live] to check the current status of your Vault Disaster Recovery backups.
Example Output
Once the initial backup is complete, the expected lag should be at most several minutes.
Inspecting Unencrypted Metadata
Using one of the standard AWS CLI login methods, log in to an AWS role that has s3:ListBucket and s3:GetObject access on the backup bucket.
To inspect the list of vaults in your backup bucket, run footprint-dr list-vaults [--sandbox/--live].
Example Output1$ footprint-dr list-vaults --live 2fp_id_4acxG4NxFTlGaE6b2WyDIc 3fp_id_WFVkUyTeuWNy0GlrOPdPBO 4fp_id_rwSYNkPIrDFogXYjCJ1KrQ 5...
To list all records, run footprint-dr list-records [--sandbox/--live].
Example Output1$ footprint-dr list-records --live 2{"fp_id": "fp_id_rwSYNkPIrDFogXYjCJ1KrQ", "version": 2, "fields": ["id.first_name", "id.last_name", "id.phone_number"]} 3{"fp_id": "fp_id_4acxG4NxFTlGaE6b2WyDIc", "version": 1, "fields": ["id.first_name", "id.last_name", "id.phone_number"]} 4{"fp_id": "fp_id_WFVkUyTeuWNy0GlrOPdPBO", "version": 4, "fields": ["id.first_name", "id.last_name", "id.phone_number"]} 5...
For manual pagination on either command, use the --fp-id-gt and --limit flags. Pass --sandbox to either command to inspect the sandbox dataset.
To locate the bucket and namespace where the encrypted data is stored, by default these commands use the Footprint API. To bypass this dependency on the Footprint API, provide the --bucket and --namespace flags using the values from enrollment or from footprint-dr status.
Testing Recovery Flow
Using one of the standard AWS CLI login methods, log in to an AWS role that has s3:ListBucket and s3:GetObject access to the backup bucket.
Prepare a line-separated JSON file records.jsonl that specifies which records you would like to decrypt for the test. For example:
jsonl1{"fp_id": "fp_id_rwSYNkPIrDFogXYjCJ1KrQ", "version": 2, "fields": ["id.first_name", "id.last_name", "id.phone_number"]} 2{"fp_id": "fp_id_4acxG4NxFTlGaE6b2WyDIc", "version": 1, "fields": ["id.first_name", "id.last_name", "id.phone_number"]} 3{"fp_id": "fp_id_WFVkUyTeuWNy0GlrOPdPBO", "version": 4, "fields": ["id.first_name", "id.last_name", "id.phone_number"]}
For testing, decrypt just enough records to gain confidence that the backup recovery mechanism is functional. The output of footprint-dr list-records --live --sample --limit 50 will likely suffice.
Using one of the standard AWS CLI login methods, log in to an AWS role that has s3:ListBucket and s3:GetObject access on the backup bucket.
Ensure you are logged in to the footprint-dr CLI with an API key that has an appropriate Decrypt Data scope.
Plug in your YubiKey and create an age identity file on disk that points to the YubiKey slot you used during enrollment. If you don’t remember the slot number, run age-plugin-yubikey --list.
bash1age-plugin-yubikey --identity --slot 1 > org-identity.txt
Run footprint decrypt to test recovery of the desired records, like the following.
bash1footprint-dr decrypt \ 2 --live \ 3 --records records.jsonl \ 4 --org-identity org-identity.txt \ 5 --output-dir /tmp/decrypt-output
Tap your YubiKey when prompted. This fetches the encrypted records from S3, fetches the wrapped record keys from Footprint’s testing API, unwraps each record key using your YubiKey, and decrypts the records using those record keys.
Full Recovery Flow
In the catastrophic event a full recovery is needed, Footprint or the pre-arranged escrow will transfer the recovery payload to you, a file like acme-inc-wrapped-recovery-key.age. Take care to prevent leakage.
Prepare a line-separated JSON file records.jsonl that specifies what records you would like to decrypt. For example:
jsonl1{"fp_id": "fp_id_rwSYNkPIrDFogXYjCJ1KrQ", "version": 2, "fields": ["id.first_name", "id.last_name", "id.phone_number"]} 2{"fp_id": "fp_id_4acxG4NxFTlGaE6b2WyDIc", "version": 1, "fields": ["id.first_name", "id.last_name", "id.phone_number"]} 3{"fp_id": "fp_id_WFVkUyTeuWNy0GlrOPdPBO", "version": 4, "fields": ["id.first_name", "id.last_name", "id.phone_number"]}
Using one of the standard AWS CLI login methods, log in to an AWS role that has s3:ListBucket and s3:GetObject access on the backup bucket.
Plug in your YubiKey and create an age identity file on disk that points to the YubiKey slot you used during enrollment. If you don’t remember the slot number, run age-plugin-yubikey --list.
Then run a footprint-dr decrypt command providing the --wrapped-recovery-key flag. For example, to decrypt all records with no dependency on the Footprint API, run a command like the following:
bash1footprint-dr decrypt \ 2 --live \ 3 --all \ 4 --wrapped-recovery-key acme-inc-wrapped-recovery-key.age \ 5 --org-identity org-identity.txt \ 6 --bucket acme-inc-footprint-encrypted-data \ 7 --namespace a39evoii5rgqhdz4jansho3tten4z0oz \ 8 --output-dir /tmp/pii
Tap your YubiKey when prompted. This unwraps the recovery private key using your YubiKey, fetches the encrypted records from S3, and decrypts the records using the recovery private key. Rather than decrypting all records with the --all flag, customers with many records may prefer to batch or even parallelize the decryptions using multiple invocations with the --records flag using record batches from footprint-dr list-records.
To maximize download and decryption speed, you can adjust the --concurrency-limit flag on footprint-dr decrypt . The default is 2 * number of CPUs. Adjust according to the measured download speed in the output. Setting too high of a concurrency limit may be detrimental to performance or yield open file limit errors.