Restoring from AWS Backup: EC2, EBS, RDS and S3 runbook

#Find the recovery point

aws backup list-recovery-points-by-resource \
  --resource-arn arn:aws:ec2:ap-south-1:111122223333:instance/i-0abc123 \
  --query "RecoveryPoints[].{arn:RecoveryPointArn,created:CreationDate,status:Status,vault:BackupVaultName}" --output table

Check Status = COMPLETED. Partial or expired points can't be restored.

#Get the restore metadata

Every restore needs resource-specific metadata. Start from what AWS Backup saved:

aws backup get-recovery-point-restore-metadata --backup-vault-name prod-vault \
  --recovery-point-arn <arn> --query RestoreMetadata > meta.json

Edit meta.json to change the subnet, security groups, instance type or DB identifier, so the restore doesn't clash with production.

#Start and track the restore

aws backup start-restore-job --recovery-point-arn <arn> \
  --iam-role-arn arn:aws:iam::111122223333:role/service-role/AWSBackupDefaultServiceRole \
  --metadata file://meta.json --resource-type EC2
aws backup describe-restore-job --restore-job-id <job-id> --query "{status:Status,created:CreatedResourceArn,msg:StatusMessage}"

#Resource notes

EC2

• The restored instance gets a new instance ID and private IP. Update DNS, the load balancer target groups and any allow-lists.
• Don't start it in the same subnet as a running original that has the same hostname or services; isolate it first.

EBS

• Restores to a new volume in the AZ you choose. Attach it to an instance in the same AZ and mount it to copy data.

RDS / Aurora

• Restores create a new DB instance or cluster with a new endpoint. Point the app at it, or rename: rename the old instance first, then rename the restored one to the original identifier.
• Parameter and option groups, security groups and subnet groups must be specified in the metadata, or the defaults are used.

S3

• Restore either the whole bucket or specific prefixes/objects, to the same or a different bucket. Restoring to a new bucket first is safer when you only need a few files.

#Common failures

#Prevent surprises

• Use AWS Backup restore testing to run scheduled, automatic restore validations.
• Enable Vault Lock (compliance mode) on critical vaults for ransomware protection.
• Copy critical backups to a second region and, ideally, a separate backup account.