Step 3. Specify Restore Settings

At the Account step of the wizard, choose whether you want to use an IAM role, an AWS account or one-time access keys of an IAM user to allow Veeam Backup & Replication to perform the restore operation. For information on the permissions that the IAM role or IAM user must have to perform the restore operation, see EC2 Restore IAM Permissions.

Specifying IAM Role

To specify an IAM role to be used for the restore operation, select the IAM role option. By default, Veeam Backup & Replication automatically chooses an IAM role from the same AWS account to which the source EC2 instances belong. You can also choose a role manually — however, keep in mind that the selected role must belong to an AWS account to which you plan to restore EC2 instances. For an IAM role to be displayed in the list of available roles, it must be added to the backup appliance as described in section Adding IAM Roles.

If you select the IAM role option, you can also choose whether you want Veeam Backup & Replication to deploy worker instances in a production account. For more information, see Enabling Worker Deployment in Production Account. 

Specifying AWS Account

To specify an AWS account to be used for the restore operation, select the Organization account option. By default, Veeam Backup & Replication automatically chooses the AWS account to which the source EC2 instances belong and the organization identity that includes the account. You can also choose an account and identity manually:

1. From the Organization drop-down list, choose the necessary organization identity — either an entire AWS Organization or a scope of organizational units.

For an organization or a scope of organizational units to be displayed in the list of available identities, it must be added to Veeam Backup for AWS as described in section Managing AWS Organizations.

2. From the Account drop-down list, choose an account that contains the IAM role whose permissions will be used to perform the restore operation. The role must be specified in the settings of the selected organization identity added to the backup appliance, as described in section Adding AWS Organizations (step 3).

For an AWS account to be displayed in the list of available accounts, it must be created in the the selected organization identity as described in AWS Documentation.

If you select the Organization account option, it is recommended that you instruct Veeam Backup & Replication to deploy worker instances in a production account. Since the Amazon EC2 service limits the maximum number of vCPUs that can be provisioned to worker instances deployed in each AWS account and AWS Region, Veeam Backup for AWS may not be able to deploy worker instances in the backup account in case the service quotas are exceeded. To learn how to deploy worker instances in a production account, see Enabling Worker Deployment in Production Account.

Specifying One-Time Access Keys

To specify one-time access keys to be used for the restore operation, select the Temporary access keys option, and use the Access key and Secret key fields to provide the access key ID and the secret access key. The specified one-time access keys must belong to an AWS account to which you plan to restore EC2 instances.

For more information on the permissions that the IAM role or IAM user must have to perform the restore operation, see EC2 Restore IAM Permissions.