Creating Image-Level Backups

The process of creating an image-level backup of an EC2 instance with encrypted EBS volumes differs depending on whether a worker instance processing EBS volume data is launched in the same AWS account or not:

Creating Image-Level Backup in Same AWS Account

If a worker instance is launched in the same AWS account to which the processed EC2 instance belongs, Veeam Backup for AWS performs the following steps:

  1. Creates an encrypted cloud-native snapshot of the EC2 instance.
  2. Creates encrypted EBS volumes from the snapshot, and then attaches them to the worker instance for reading and further transferring EBS volume data to a backup repository.

To access the data, Veeam Backup for AWS uses an IAM role specified to launch worker instances, as described in section Configuring Worker Instance Settings. The IAM role must have permissions to access the KMS keys with which EBS volumes of the EC2 instance are encrypted (source KMS keys).

Creating Image-Level Backups 

Creating Image-Level Backup in Another AWS Account

If a worker instance is launched in an AWS account other than the AWS account to which the processed EC2 instance belongs, Veeam Backup for AWS performs the following steps:

  1. Creates an encrypted cloud-native snapshot of the EC2 instance.
  2. Shares the created snapshot with the AWS account where the worker instance is launched.

To share the encrypted snapshot, Veeam Backup for AWS uses the IAM role specified at the Sources step of the Add Policy wizard, as described in section Creating EC2 Backup Policies. The IAM role must have permissions to access the KMS keys with which EBS volumes of the EC2 instance are encrypted (source KMS keys).

Important

If EBS volumes of the EC2 instance are encrypted with the default key for EBS encryption (aws/ebs alias), Veeam Backup for AWS will not be able to share the snapshot with another AWS account and the backup process will fail to complete successfully. To work around the issue, enable the worker deployment in production accounts functionality, as described in Creating EC2 Backup Policies.

  1. Creates encrypted EBS volumes from the shared encrypted snapshot, and then attaches them to the worker instance for reading and further transferring EBS volume data to a backup repository.

Due to AWS requirements, EBS volumes created from encrypted snapshots must also be encrypted. Thus, Veeam Backup for AWS encrypts re-created EBS volumes with the default encryption key specified for the AWS Region where the worker instance is launched.

To access the data, Veeam Backup for AWS uses an IAM role specified to launch worker instances, as described in section Configuring Worker Instance Settings. The IAM role must have permissions to access the following KMS keys:

  • The KMS keys with which EBS volumes of the EC2 instance are encrypted (source KMS keys).
  • The default encryption key specified for the AWS Region where the worker instance is launched.

Creating Image-Level Backups