Busca en todas las páginas de la documentación
Protecting DocumentDB is entirely a control-plane job - every call here is on the docdb client, and none of them touch your documents directly. There are three layers. Automated backups give continuous point-in-time recovery. Manual snapshots give durable, named checkpoints you control. Global clusters replicate a cluster across regions for disaster recovery and low-latency reads.
DocumentDB snapshots are taken at the cluster level (they cover the shared storage volume), which is why the calls are ...DBClusterSnapshot, not ...DBSnapshot. This page walks through each layer and the one rule that catches everyone: a restore always creates a new cluster.
Quick-reference recipe card - copy-paste ready.
# --- Python (boto3) ---
import boto3
docdb = boto3.client("docdb", region_name="us-east-1")
# 1. Enable automated backups + PITR (retention > 0).
docdb.modify_db_cluster(
DBClusterIdentifier="app-docdb",
BackupRetentionPeriod=7, PreferredBackupWindow="03:00-04:00",
ApplyImmediately=True,
)
# 2. Take a durable manual snapshot before a risky change.
docdb.create_db_cluster_snapshot(
DBClusterIdentifier="app-docdb",
DBClusterSnapshotIdentifier="app-docdb-pre-release",
)// --- TypeScript (AWS SDK v3) ---
import { DocDBClient, ModifyDBClusterCommand, CreateDBClusterSnapshotCommand } from "@aws-sdk/client-docdb";
const docdb = new DocDBClient({ region: "us-east-1" });
// 1. Enable automated backups + PITR (retention > 0).
await docdb.send(new ModifyDBClusterCommand({
DBClusterIdentifier: "app-docdb",
BackupRetentionPeriod: 7, PreferredBackupWindow: "03:00-04:00",
ApplyImmediately: true,
}));
// 2. Take a durable manual snapshot before a risky change.
await docdb.send(new CreateDBClusterSnapshotCommand({
DBClusterIdentifier: "app-docdb",
DBClusterSnapshotIdentifier: "app-docdb-pre-release",
}));When to reach for this:
Take a manual snapshot, copy it to a second region for DR, then restore it into a new cluster and attach an instance. A restore is not complete until the new cluster has compute.
# --- Python (boto3) ---
import boto3
east = boto3.client("docdb", region_name="us-east-1")
west = boto3.client("docdb", region_name="us-west-2")
# 1. Manual snapshot (persists until you delete it).
east.create_db_cluster_snapshot(
DBClusterIdentifier="app-docdb",
DBClusterSnapshotIdentifier="app-docdb-2026-07-24",
)
# Poll until the snapshot is available (docdb has no snapshot waiter).
import time
while east.describe_db_cluster_snapshots(
DBClusterSnapshotIdentifier="app-docdb-2026-07-24"
)["DBClusterSnapshots"][0]["Status"] != "available":
time.sleep(30)
# 2. Copy cross-region for DR (encrypt with a key in the destination region).
west.copy_db_cluster_snapshot(
SourceDBClusterSnapshotIdentifier=(
"arn:aws:rds:us-east-1:111122223333:cluster-snapshot:app-docdb-2026-07-24"),
TargetDBClusterSnapshotIdentifier="app-docdb-dr",
KmsKeyId="arn:aws:kms:us-west-2:111122223333:key/abcd-1234",
SourceRegion="us-east-1",
)
# 3. Restore creates a NEW cluster; then attach an instance to it.
west.restore_db_cluster_from_snapshot(
DBClusterIdentifier="app-docdb-restored",
SnapshotIdentifier="app-docdb-dr",
Engine="docdb",
)
west.create_db_instance(
DBInstanceIdentifier="app-docdb-restored-1",
DBClusterIdentifier="app-docdb-restored",
Engine="docdb", DBInstanceClass="db.r6g.large",
)
west.get_waiter("db_instance_available").wait(DBInstanceIdentifier="app-docdb-restored-1")
print("restored cluster is connectable")// --- TypeScript (AWS SDK v3) ---
import {
DocDBClient, CreateDBClusterSnapshotCommand, CopyDBClusterSnapshotCommand,
RestoreDBClusterFromSnapshotCommand, CreateDBInstanceCommand,
waitUntilDBInstanceAvailable,
} from "@aws-sdk/client-docdb";
const east = new DocDBClient({ region: "us-east-1" });
const west = new DocDBClient({ region: "us-west-2" });
// 1. Manual snapshot (persists until you delete it).
await east.send(new CreateDBClusterSnapshotCommand({
DBClusterIdentifier: "app-docdb",
DBClusterSnapshotIdentifier: "app-docdb-2026-07-24",
}));
// 2. Copy cross-region for DR (encrypt with a key in the destination region).
await west.send(new CopyDBClusterSnapshotCommand({
SourceDBClusterSnapshotIdentifier:
"arn:aws:rds:us-east-1:111122223333:cluster-snapshot:app-docdb-2026-07-24",
TargetDBClusterSnapshotIdentifier: "app-docdb-dr",
KmsKeyId: "arn:aws:kms:us-west-2:111122223333:key/abcd-1234",
SourceRegion: "us-east-1",
}));
// 3. Restore creates a NEW cluster; then attach an instance to it.
await west.send(new RestoreDBClusterFromSnapshotCommand({
DBClusterIdentifier: "app-docdb-restored",
SnapshotIdentifier: "app-docdb-dr",
Engine: "docdb",
}));
await west.send(new CreateDBInstanceCommand({
DBInstanceIdentifier: "app-docdb-restored-1",
DBClusterIdentifier: "app-docdb-restored",
Engine: "docdb", DBInstanceClass: "db.r6g.large",
}));
await waitUntilDBInstanceAvailable({ client: west, maxWaitTime: 1200 }, { DBInstanceIdentifier: "app-docdb-restored-1" });
console.log("restored cluster is connectable");What this demonstrates:
CreateDBClusterSnapshot), covering the shared storage volume.CopyDBClusterSnapshot with a destination-region KMS key moves DR data across regions.RestoreDBClusterFromSnapshot creates a new cluster - it never overwrites the source.CreateDBInstance before anything can connect to it.Setting BackupRetentionPeriod above 0 turns on automated backups: DocumentDB continuously backs up the cluster and supports point-in-time recovery to any second within the retention window using RestoreDBClusterToPointInTime. Automated backups are tied to the cluster's lifecycle - delete the cluster and they go with it (aside from an optional final snapshot).
A manual snapshot (CreateDBClusterSnapshot) is a durable, named checkpoint that persists until you explicitly delete it. Use it before risky changes and for anything you must retain beyond the automated window. The trade-off is that manual snapshots never expire, so they accumulate storage cost until you prune them.
RestoreDBClusterFromSnapshot and RestoreDBClusterToPointInTime both create a new cluster. There is no in-place restore that rewinds an existing cluster. This is a safety property: your source is never mutated, so you can validate the restored copy before cutting over. It also means a restore is a two-step operation - restore the cluster (storage), then CreateDBInstance to attach compute, because the restored cluster starts with no instances and is not connectable until one is available.
CopyDBClusterSnapshot to a second region gives you a recovery point that survives a regional event. Two details matter: pass a KmsKeyId from the destination region (a snapshot's encryption key is region-scoped), and include SourceRegion so the copy knows where to pull from. The copied snapshot is independent - it remains available even if the source region is unreachable.
A global cluster goes beyond a snapshot copy. CreateGlobalCluster designates a primary cluster as the single write region, and you then add secondary clusters in other regions that receive low-latency storage-level replication and serve read-only traffic. It supports one primary and up to five secondary regions. This is the tool for two goals: disaster recovery with fast cross-region failover (promote a secondary), and read locality (serve reads from the region nearest your users). Reads on a secondary go through a MongoDB driver against that region's reader endpoint; writes must go to the primary region.
# --- Python (boto3) ---
# Promote an existing cluster into the primary of a global cluster.
docdb.create_global_cluster(
GlobalClusterIdentifier="app-docdb-global",
SourceDBClusterIdentifier=(
"arn:aws:rds:us-east-1:111122223333:cluster:app-docdb"),
)
# Then add a secondary cluster in another region attached to this global id,
# and attach instances to it for read serving / failover.// --- TypeScript (AWS SDK v3) ---
import { CreateGlobalClusterCommand } from "@aws-sdk/client-docdb";
// Promote an existing cluster into the primary of a global cluster.
await docdb.send(new CreateGlobalClusterCommand({
GlobalClusterIdentifier: "app-docdb-global",
SourceDBClusterIdentifier: "arn:aws:rds:us-east-1:111122223333:cluster:app-docdb",
}));
// Then add a secondary cluster in another region attached to this global id,
// and attach instances to it for read serving / failover.CreateDBInstance and wait for it before connecting.CreateDBClusterSnapshot, not CreateDBSnapshot.KmsKeyId from the destination region and set SourceRegion.| Alternative | Use When | Don't Use When |
|---|---|---|
| Automated backups + PITR | Everyday recovery within the retention window | You need a checkpoint that outlives the cluster |
| Manual cluster snapshot | Pre-change checkpoint, long-term retention | You want continuous, hands-off protection |
| Cross-region snapshot copy | Regional DR recovery point | You need continuous replication and fast failover |
| Global cluster | Multi-region DR + read locality, fast failover | Single-region workloads that a snapshot copy covers |
| AWS Backup | Central, policy-driven backup across services | A one-off manual snapshot suffices |
Set BackupRetentionPeriod above 0 on the cluster. That enables automated backups and lets you restore to any second in the retention window with RestoreDBClusterToPointInTime, which creates a new cluster.
No. Automated backups are tied to the cluster's lifecycle and are removed with it, aside from an optional final snapshot. For anything you must keep, take a manual cluster snapshot, which persists until you delete it.
By design, so the source is never mutated and you can validate the restored copy before cutting over. Restore to a new identifier, attach an instance, verify, then repoint your application's endpoint.
A restored cluster has storage but no instances. Call CreateDBInstance with the restored cluster id and wait on db_instance_available before connecting a driver to its endpoint.
Copy it to another region with CopyDBClusterSnapshot, passing a KmsKeyId from the destination region and setting SourceRegion. The copy is independent and remains available even if the source region is unreachable.
Continuous, low-latency storage-level replication to secondary regions that serve read-only traffic, plus fast failover by promoting a secondary. A snapshot copy is a point-in-time DR artifact; a global cluster is live multi-region replication.
No. Only the primary region accepts writes. Secondary regions are read-only and are used for local reads and disaster-recovery failover. On failover, you promote a secondary to become the new primary.
Stack versions: This page was written for boto3 1.43.x (Python 3.10+) and the AWS SDK for JavaScript v3 (Node.js 18+).
Revisado por Chris St. John·Última actualización: 24 jul 2026