Step 3. Choose Restore Mode

At the Restore Mode step of the wizard, do the following:

Choose whether you want to restore the selected EC2 instance to the original or to a new location.

Note

If you choose to restore to the original location, consider the following:

An IAM role that will be used to perform the restore operation must belong to an AWS account where the selected restore point was created.
The source EC2 instance will be automatically powered off and removed from AWS after the restore process completes successfully.
If private IP addresses that were assigned to the source EC2 instance are in use by the source or any other EC2 instance, the restored EC2 instance will be assigned new private IP addresses.

Click Pick an IAM identity to use to select an IAM identity whose permissions will be used to perform the restore operation:

To specify an IAM role, select the IAM role option and choose the necessary IAM role from the IAM role drop-down list.

For an IAM role to be displayed in the list of available roles, it must be added to the backup appliance as described in section Adding IAM Roles.

To specify one-time access keys of an IAM user, select the Temporary access key option, and use the Access key and Secret key fields to provide the access key ID and the secret access key.

For more information on the permissions that the IAM role or IAM user must have to perform the restore operation, see EC2 Restore IAM Permissions.

Note

By default, to perform restore operations, Veeam Backup & Replication uses permissions of either the IAM role that was used to protect the source EC2 instance, or the IAM role that was used to update information on restore points created for the instance while rescanning the AWS infrastructure.

[Applies only if you restore EC2 instances from image-level backups and have chosen the IAM role option] Choose whether you want Veeam Backup & Replication to deploy worker instances processing EC2 instance data in production accounts.

By default, Veeam Backup & Replication launches worker instances in the backup account. However, you may want to instruct Veeam Backup & Replication to launch worker instances in a production account, for example, if the EBS volumes of the restored EC2 instance are encrypted with the default AWS managed key. To do that, click Configure and select an IAM role that will be attached to the worker instances and used by Veeam Backup & Replication to communicate with these instances. The selected IAM role must belong to the same account to which the IAM role specified for the restore operation belongs, and must be assigned permissions listed in section Worker IAM Permissions.

For an IAM role to be displayed in the list of available roles, it must be added to the backup appliance as described in section Adding IAM Roles.

Important

If you instruct Veeam Backup & Replication to deploy worker instances in a production account, you must assign additional permissions to the IAM role that will be used to perform the restore operation. For more information on the required permissions, see EC2 Restore IAM Permissions.