This is an archive version of the document. To get the most up-to-date information, see the current version.Restoring From Image-Level Backups
The process of restoring an EC2 instance with encrypted EBS volumes from an image-level backup differs depending on whether a worker instance is launched in the same AWS account to which you perform restore or not:
- Performing restore from the image-level backup to the AWS account where the worker instance is launched.
- Performing restore from the image-level backup to an AWS account that is different from the AWS account where the worker instance is launched.
Note |
Consider the following:
|
If a worker instance is launched in the same AWS account where the restored EC2 instance will reside, to encrypt EBS volumes of the restored EC2 instance, Veeam Backup for AWS uses an IAM role specified to launch worker instances, as described in section Configuring Worker Instance Settings. The IAM role must have permissions to access to the KMS key with which you want to encrypt EBS volumes of the restored EC2 instance.
Restore to Another AWS Account
- Creates empty EBS volumes in the target AWS Region in the source AWS account and attaches them to the worker instance. To protect data that will be restored to these volumes, Veeam Backup for AWS encrypts the created EBS volumes with the default encryption key specified for the target AWS Region.
To encrypt the volumes, Veeam Backup for AWS uses an IAM role specified to launch worker instances, as described in section Configuring Worker Instance Settings. The IAM role must have permissions to access to the default encryption key specified for the target AWS Region in the source AWS account.
- Restores backed-up data to the empty EBS volumes on the worker instance.
- Creates an encrypted cloud-native snapshot of the EBS volumes with the restored data.
- Shares the created snapshot with the target AWS account.
Important |
According to AWS limitations, snapshots encrypted with the default key for EBS encryption (aws/ebs alias) cannot be shared between AWS accounts. Thus, if the default encryption key specified for the target AWS Region in the source AWS account is the default key for EBS encryption, Veeam Backup for AWS will not be able to share the snapshot and the restore process will fail. For more information, see this Veeam KB article. |
- Creates an EC2 instance in the target AWS Region within the target AWS account.
- Creates encrypted EBS volumes from the shared encrypted snapshot and attaches them to the created EC2 instance.
To create and encrypt EBS volumes, Veeam Backup for AWS uses an IAM role specified for the restore operation, as described in section Performing Entire EC2 Instance Restore. The IAM role must have permissions to access the following KMS keys:
- The default encryption key specified for the target AWS Region in the source AWS account.
- A KMS key with which you want to encrypt EBS volumes of the restored EC2 instance (target KMS key).
