One of the common queries we get from our AWS customers is something along the lines of ” how to restore an EC2 instance from an AWS Backup with AWS CLI”? We can help you with this!

As a part of our AWS Support Services, we often receive similar requests from our AWS customers.

Today, let’s see the steps followed by our Support Techs to help our customers to restore an AWS EC2 instance from an AWS Backup with AWS Command-Line Interface.

 

Restore an EC2 instance from an AWS Backup with AWS CLI

 
Now, let’s see the steps for restoring EC2 instance from an AWS Backup with AWS CLI:

1. Firstly, list all the recovery points in the vault using the following list-recovery-points-by-backup-vault command. Note the RecoveryPointArn for the recovery point that we want to restore.

aws backup list-recovery-points-by-backup-vault --backup-vault-name Default --output json --query 'RecoveryPoints[].[BackupVaultName,RecoveryPointArn]'

2. To get the metadata of the Amazon EC2 instance, we need to run the get-recovery-point-restore-metadata command.

aws backup get-recovery-point-restore-metadata --backup-vault-name Default --recovery-point-arn arn:aws:ec2:eu-west-1::image/ami-012ab3456789c0123

3. Also copy the output of the above command. For example:

{
"BackupVaultArn": "arn:aws:backup:eu-east-1:987654321013:backup-vault:Default",
"RecoveryPointArn": "arn:aws:ec2:eu-west-1::image/ami-111ab9876c0123",
"RestoreMetadata": {
"CapacityReservationSpecification": "{\"CapacityReservationPreference\":\"open\"}",
"CpuOptions": "{\"CoreCount\":1,\"ThreadsPerCore\":1}",
"CreditSpecification": "{\"CpuCredits\":\"standard\"}",
"DisableApiTermination": "false",
"EbsOptimized": "false",
"HibernationOptions": "{\"Configured\":false}",
"IamInstanceProfileName": "ServerAccess",
"InstanceInitiatedShutdownBehavior": "stop",
"InstanceType": "t2.micro",
"KeyName": "BackupTesting",
"Monitoring": "{\"State\":\"disabled\"}",
"NetworkInterfaces": "[{\"AssociatePublicIpAddress\":true,\"DeleteOnTermination\":true,\"Description\":\"\",\"DeviceIndex\":0,\"Groups\":[\"sg-0babcd1234567890f\"],\"Ipv6AddressCount\":0,\"Ipv6Addresses\":[],\"NetworkInterfaceId\":\"eni-12345678a9b0cd1e2\",\"PrivateIpAddress\":\"192.0.2.206\",\"PrivateIpAddresses\":[{\"Primary\":true,\"PrivateIpAddress\":\"192.0.2.206\"}],\"SecondaryPrivateIpAddressCount\":0,\"SubnetId\":\"subnet-1a2b3c4d\",\"InterfaceType\":\"interface\"}]",
"Placement": "{\"AvailabilityZone\":\"eu-west-1b\",\"GroupName\":\"\",\"Tenancy\":\"default\"}",
"SecurityGroupIds": "[\"sg-0babcd1234567890f\"]",
"SubnetId": "subnet-1a2b3c4d",
"VpcId": "vpc-1a2b3c4d",
"aws:backup:request-id": "c1234567-ee7c-4896-beeb-ee123b456789"
}
}

4. Then edit the command output to keep only the following metadata fields and values:

{
"VpcId": "vpc-1a2b3c4d",
"Monitoring": "{\"State\":\"disabled\"}",
"CapacityReservationSpecification": "{\"CapacityReservationPreference\":\"open\"}",
"InstanceInitiatedShutdownBehavior": "stop",
"DisableApiTermination": "false",
"KeyName": "BackupTesting",
"CreditSpecification": "{\"CpuCredits\":\"standard\"}",
"HibernationOptions": "{\"Configured\":false}",
"EbsOptimized": "false",
"Placement": "{\"AvailabilityZone\":\"eu-east-1b\",\"GroupName\":\"\",\"Tenancy\":\"default\"}",
"aws:backup:request-id": "c1234567-ee7c-4896-beeb-ee123b456789",
"InstanceType": "t2.micro",
"NetworkInterfaces": "[{\"DeleteOnTermination\":true,\"Description\":\"Primary network interface\",\"DeviceIndex\":0,\"Groups\":[\"sg-0babcd1234567890f\"],\"Ipv6AddressCount\":0,\"Ipv6Addresses\":[],\"PrivateIpAddresses\":[{\"Primary\":true,\"PrivateIpAddress\":\"192.0.2.210\"}],\"SecondaryPrivateIpAddressCount\":1,\"SubnetId\":\"subnet-1a2b3c4d\",\"InterfaceType\":\"interface\"}]"
}

5. We must also change the primary private IP address in the metadata output if the original instance is still in use. For that, change the Primary PrivateIpAddress to a different IP address than what was originally returned by the get-recovery-point-restore-metadata command in the NetworkInterfaces metadata field.

6. Then we need to save the metadata into a JSON file. We can name the file ec2-restore-metadata.json.

7. Finally, run the start-restore-job command with –recovery-point-arn set to the RecoveryPointArn and –metadata set to the JSON file.

aws backup start-restore-job --region eu-west-1 --recovery-point-arn "arn:aws:ec2:eu-west-1::image/ami-111ab9876c0123" --iam-role-arn "arn:aws:iam::987654321012:role/service-role/AWSBackupDefaultServiceRole" --metadata file://ec2-restore-metadata.json

OR

Instead of using a JSON file, we can also define the instance metadata as parameters within the start-restore-job command. For example:

aws backup start-restore-job --region eu-west-1 --recovery-point-arn "arn:aws:ec2:eu-west-1::image/ami-111ab9876c0123" --iam-role-arn "arn:aws:iam::987654321013:role/service-role/AWSBackupDefaultServiceRole" --metadata '{"VpcId": "vpc-1a2b3c4d", "Monitoring": "{\"State\":\"disabled\"}", "CapacityReservationSpecification": "{\"CapacityReservationPreference\":\"open\"}", "InstanceInitiatedShutdownBehavior": "stop", "DisableApiTermination": "false", "KeyName": "BackupTesting", "CreditSpecification": "{\"CpuCredits\":\"standard\"}", "HibernationOptions": "{\"Configured\":false}", "EbsOptimized": "false", "Placement": "{\"AvailabilityZone\":\"eu-west-1b\",\"GroupName\":\"\",\"Tenancy\":\"default\"}", "aws:backup:request-id": "c1234567-ee7c-4896-beeb-ee123b456789", "InstanceType": "t2.micro", "NetworkInterfaces": "[{\"DeleteOnTermination\":true,\"Description\":\"Primary network interface\",\"DeviceIndex\":0,\"Groups\":[\"sg-0babcd1234567890f\"],\"Ipv6AddressCount\":0,\"Ipv6Addresses\":[],\"PrivateIpAddresses\":[{\"Primary\":true,\"PrivateIpAddress\":\"172.31.32.210\"}],\"SecondaryPrivateIpAddressCount\":1,\"SubnetId\":\"subnet-1a2b3c4d\",\"InterfaceType\":\"interface\"}]"}'

[Need help with more AWS queries? We’d be happy to assist]
 

Conclusion

 
To conclude, today we discussed the steps followed by our Support Engineers to help our customers to restore an EC2 instance from an AWS Backup with AWS CLI.