Creating Image-Level Backups
The process of creating an image-level backup of an EC2 instance with encrypted EBS volumes differs depending on whether a worker instance processing EBS volume data is launched in the same AWS account or not:
- Creating the image-level backup in the same AWS account where the worker instance is launched.
- Creating the image-level backup in an AWS account that is different from the AWS account where the worker instance is launched.
Creating Image-Level Backup in Same AWS Account
If a worker instance is launched in the same AWS account where the processed EC2 instance resides, Veeam Backup for AWS performs the following steps:
- Creates an encrypted cloud-native snapshot of the EC2 instance.
- Creates encrypted EBS volumes from the snapshot, and then attaches them to the worker instance to read and further transfer EBS volume data to an S3 repository.
To access the data, Veeam Backup for AWS uses an IAM role specified to launch worker instances. To learn how to specify this IAM role, see Configuring Worker Instance Settings. The IAM role must have permissions to access CMKs with which EBS volumes of the EC2 instance are encrypted (source CMKs).
Creating Cross-Account Image-Level Backup
If a worker instance is launched in an AWS account different from the AWS account where the processed EC2 instance resides, Veeam Backup for AWS performs the following steps:
- Creates an encrypted cloud-native snapshot of the EC2 instance.
- Shares the created snapshot with the AWS account where the worker instance is launched.
To share the encrypted snapshot, Veeam Backup for AWS uses an IAM role specified in the backup policy settings for creating cloud-native snapshots. To learn how to specify this IAM role, see Creating EC2 Backup Policies. The IAM role must have permissions to access CMKs with which EBS volumes of the EC2 instance are encrypted (source CMKs).
Important |
If EBS volumes of the EC2 instance are encrypted with the default key for EBS encryption (aws/ebs alias), Veeam Backup for AWS will not be able to share the snapshot with another AWS account and the backup process will fail. For more information, see this Veeam KB article. |
- Creates encrypted EBS volumes from the shared encrypted snapshot, and then attaches them to the worker instance to read and further transfer EBS volume data to an S3 repository.
Note that according to AWS requirements, EBS volumes created from encrypted snapshots must also be encrypted. Thus, Veeam Backup for AWS encrypts re-created EBS volumes with the default encryption key specified for the AWS Region where the worker instance is launched.
To access the data, Veeam Backup for AWS uses an IAM role specified to launch worker instances. To learn how to specify this IAM role, see Configuring Worker Instance Settings. The IAM role must have permissions to access the following CMKs:
- The CMKs with which EBS volumes of the EC2 instance are encrypted (source CMKs).
- The default encryption key specified for the AWS Region where the worker instance is launched.
