Goal

Configure preferred backup and maintenance windows for an Aurora/RDS instance managed by provider-aws-rds in a way that reflects a local timezone, working around the AWS API's UTC-only requirement.

Environment

Prerequisites

• An Aurora or RDS instance managed by provider-aws-rds.

• If using the AWS Backup Plan approach: provider-aws-backup installed and a Backup Vault already created in the target region.

Steps

The AWS API requires PreferredBackupWindow and PreferredMaintenanceWindow to be expressed in UTC, this is an AWS constraint and not a Crossplane or provider limitation. There is no way to pass a local timezone directly to the Instance or Cluster kind. The recommended workaround is to use an AWS Backup Plan, which does support timezone-aware scheduling via scheduleExpressionTimezone.

Option 1 - AWS Backup Plan (recommended)

Use the backup.aws.upbound.io/v1beta2 Plan kind to define a schedule in your local timezone. The scheduleExpressionTimezone field accepts IANA timezone names and handles DST automatically.

Step 1: Create a Backup Plan manifest

apiVersion: backup.aws.upbound.io/v1beta2
kind: Plan
metadata:
  name: aurora-backup-plan
spec:
  forProvider:
    region: ap-south-1          # set to your target region
    rule:
      - ruleName: aurora-nightly
        targetVaultName: my-vault
        schedule: "cron(0 2 * * ? *)"
        scheduleExpressionTimezone: "Asia/Kolkata"   # 02:00 local time, DST-aware

Replace region, targetVaultName, the cron expression, and scheduleExpressionTimezone with values appropriate for your environment. IANA timezone identifiers (e.g. America/New_York, Europe/Berlin) are accepted.

Step 2: Apply the manifest

kubectl apply -f aurora-backup-plan.yaml

Step 3: Associate your RDS/Aurora resource with the Backup Plan

Create a Selection resource (or use tags) to target your Aurora cluster. Refer to the provider-aws-backup documentation for the Selection kind.

Option 2 - Manual UTC offset on the Instance resource

If you prefer to keep the window on the Instance or Cluster kind directly, calculate the equivalent UTC time for your desired local time and set it in spec.forProvider.backupWindow and spec.forProvider.maintenanceWindow. Remember to adjust for DST changes manually when they occur.

spec:
  forProvider:
    backupWindow: "20:30-21:30"        # e.g. 02:00–03:00 IST = 20:30–21:30 UTC
    maintenanceWindow: "mon:21:00-mon:22:00"

Verify

For the Backup Plan approach, check that the Plan resource is synced and ready:

kubectl get plan.backup.aws.upbound.io aurora-backup-plan -o wide

The READY and SYNCED columns should both show True. You can also confirm the schedule in the AWS Console under AWS Backup → Backup plans, where the next scheduled job time will be shown in your local timezone.

For the UTC offset approach, inspect status.atProvider on the Instance or Cluster resource to confirm AWS has accepted the window:

kubectl get instance.rds.aws.upbound.io <name> -o jsonpath='{.status.atProvider.backupWindow}'

Notes

UTC is enforced by AWS, not Crossplane

The AWS ModifyDBInstance API requires both PreferredBackupWindow and PreferredMaintenanceWindow in UTC. Crossplane passes these values directly to the API and cannot transform them.

DST handling

The Backup Plan's scheduleExpressionTimezone field is DST-aware. The manual UTC offset approach on the Instance kind is not — you must update the offset yourself when clocks change.

Composition-based offset calculation

It is technically possible to handle the UTC conversion inside a Composition using Go templates, but this requires non-trivial string parsing and is not recommended for most use cases. Reach out to support if you need to explore this path.

Related

• provider-aws-rds Instance v1beta2 — Upbound Marketplace

• provider-aws-backup — Upbound Marketplace

• AWS ModifyDBInstance API Reference — documents the UTC requirement for window fields.