Operations
4 min read
Once enrolled, you run every Vault Disaster Recovery operation from the footprint-dr CLI: checking backup status, listing what is backed up, testing recovery on a few records, and a full offline recovery.
Checking backup status
Run footprint-dr status [--sandbox/--live] to check the current status of your Vault Disaster Recovery backups:
Example Output
After the initial backup completes, expect a lag of at most several minutes.
Inspecting unencrypted metadata
Using one of the standard AWS CLI login methods, log in to an AWS role that has s3:ListBucket and s3:GetObject access on the backup bucket.
To list the vaults in your backup bucket, run footprint-dr list-vaults [--sandbox/--live]:
Example Output1$ footprint-dr list-vaults --live 2fp_id_4acxG4NxFTlGaE6b2WyDIc 3fp_id_WFVkUyTeuWNy0GlrOPdPBO 4fp_id_rwSYNkPIrDFogXYjCJ1KrQ 5...
To list all records, run footprint-dr list-records [--sandbox/--live]:
Example Output1$ footprint-dr list-records --live 2{"fp_id": "fp_id_rwSYNkPIrDFogXYjCJ1KrQ", "version": 2, "fields": ["id.first_name", "id.last_name", "id.phone_number"]} 3{"fp_id": "fp_id_4acxG4NxFTlGaE6b2WyDIc", "version": 1, "fields": ["id.first_name", "id.last_name", "id.phone_number"]} 4{"fp_id": "fp_id_WFVkUyTeuWNy0GlrOPdPBO", "version": 4, "fields": ["id.first_name", "id.last_name", "id.phone_number"]} 5...
For manual pagination on either command, use the --fp-id-gt and --limit flags. Pass --sandbox to either command to inspect the sandbox data set.
By default these commands ask the Footprint API for the bucket and namespace where the encrypted data is stored. To remove that dependency on the Footprint API, pass the --bucket and --namespace flags with the values from enrollment or from footprint-dr status.
Testing recovery flow
Using one of the standard AWS CLI login methods, log in to an AWS role that has s3:ListBucket and s3:GetObject access on the backup bucket.
Prepare a line-separated JSON file records.jsonl that lists the records to decrypt for the test. For example:
jsonl1{"fp_id": "fp_id_rwSYNkPIrDFogXYjCJ1KrQ", "version": 2, "fields": ["id.first_name", "id.last_name", "id.phone_number"]} 2{"fp_id": "fp_id_4acxG4NxFTlGaE6b2WyDIc", "version": 1, "fields": ["id.first_name", "id.last_name", "id.phone_number"]} 3{"fp_id": "fp_id_WFVkUyTeuWNy0GlrOPdPBO", "version": 4, "fields": ["id.first_name", "id.last_name", "id.phone_number"]}
Decrypt only enough records to show that the backup recovery mechanism works; the output of footprint-dr list-records --live --sample --limit 50 is usually enough.
Log in to the footprint-dr CLI with an API key that has the appropriate Decrypt Data scope.
Plug in your YubiKey and create an age identity file on disk that points to the YubiKey slot you used during enrollment. If you don't remember the slot number, run age-plugin-yubikey --list.
bash1age-plugin-yubikey --identity --slot 1 > org-identity.txt
Run footprint-dr decrypt to test recovery of the records in the file:
bash1footprint-dr decrypt \ 2 --live \ 3 --records records.jsonl \ 4 --org-identity org-identity.txt \ 5 --output-dir /tmp/decrypt-output
Tap your YubiKey when prompted. The command fetches the encrypted records from S3 and the wrapped record keys from Footprint's testing API, unwraps each record key with your YubiKey, and decrypts the records with those record keys.
Full recovery flow
In the catastrophic event that a full recovery is needed, Footprint or the pre-arranged escrow transfers the recovery payload to you, a file such as acme-inc-wrapped-recovery-key.age. Take care to prevent it from leaking.
Prepare a line-separated JSON file records.jsonl that lists the records to decrypt. For example:
jsonl1{"fp_id": "fp_id_rwSYNkPIrDFogXYjCJ1KrQ", "version": 2, "fields": ["id.first_name", "id.last_name", "id.phone_number"]} 2{"fp_id": "fp_id_4acxG4NxFTlGaE6b2WyDIc", "version": 1, "fields": ["id.first_name", "id.last_name", "id.phone_number"]} 3{"fp_id": "fp_id_WFVkUyTeuWNy0GlrOPdPBO", "version": 4, "fields": ["id.first_name", "id.last_name", "id.phone_number"]}
Using one of the standard AWS CLI login methods, log in to an AWS role that has s3:ListBucket and s3:GetObject access on the backup bucket.
Plug in your YubiKey and create an age identity file on disk that points to the YubiKey slot you used during enrollment. If you don't remember the slot number, run age-plugin-yubikey --list.
Run footprint-dr decrypt with the --wrapped-recovery-key flag. For example, to decrypt all records with no dependency on the Footprint API:
bash1footprint-dr decrypt \ 2 --live \ 3 --all \ 4 --wrapped-recovery-key acme-inc-wrapped-recovery-key.age \ 5 --org-identity org-identity.txt \ 6 --bucket acme-inc-footprint-encrypted-data \ 7 --namespace a39evoii5rgqhdz4jansho3tten4z0oz \ 8 --output-dir /tmp/pii
Tap your YubiKey when prompted. The command unwraps the recovery private key with your YubiKey, fetches the encrypted records from S3, and decrypts the records with the recovery private key. If you have many records, you can batch or parallelize the decryption instead of passing --all: run several invocations with the --records flag, each with a batch of records from footprint-dr list-records.
To tune download and decryption speed, adjust the --concurrency-limit flag on footprint-dr decrypt. The default is 2 * number of CPUs. Adjust it according to the measured download speed in the output; too high a limit can hurt performance or produce open file limit errors.