AWS: Restore Server Requirements

This article describes the network connectivity requirements for restore servers in AWS restore accounts.

By default, Eon runs the restore server using your account’s default VPC, subnet, and security group. If these defaults exist and have the required connectivity, no additional configuration is needed. If the default VPC resources have been deleted or have outbound limitations, customize the restore server’s network configuration. See AWS: Customize Restore Server Configuration for details.

Network requirements

The network requirements depend on the resource you’re restoring.

EC2 and S3

When restoring EC2 instances, Eon creates the restore server in the same availability zone as the restore destination. When restoring S3 buckets, Eon creates the restore server in the same region.

Network resource	Requirements
Subnet	Outbound communication is open, or VPC endpoints are configured.

RDS

When restoring RDS instances, Eon creates the restore server in the same VPC as the restored instance.

The restore server needs to create and populate databases on the restored instance. The restore server and the restored RDS instance each need a security group that allows TCP communication between them on the database port.

Eon creates restored databases using standard ports:

MySQL: TCP port 3306.
PostgreSQL: TCP port 5432.
SQL Server: TCP port 1433.

Network resource	Requirements
VPC DNS resolution	Must be enabled. The restore server resolves database endpoints by hostname.
VPC DNS hostnames	Must be enabled.
Subnet	Outbound communication is open, or VPC endpoints are configured.
Security group for restore server	Allows outbound TCP on the database port to the restored instance’s security group.
Security group for restored instance	Allows inbound TCP on the database port from the restore server’s security group.

VPC DNS resolution and DNS hostnames are enabled by default on AWS VPCs. If you’re using a custom VPC, verify that these settings are enabled.

VPC endpoints for subnets without internet access

When a restore server runs in an isolated or private subnet without internet access, it can’t reach AWS services over the public internet. VPC endpoints let the restore server communicate with those services through the AWS network, without requiring outbound internet access.

If you’re using a custom private subnet for the restore server, configure the following VPC endpoints in the VPC where the restore server runs. In the service names below, replace {region} with the AWS region of that VPC. This is the restore destination region, which may differ from the vault’s region.

AWS service	Service name	Endpoint type	Purpose
Amazon S3	`com.amazonaws.{region}.s3`	Gateway	Reads vault backup data from S3, downloads the agent bootstrap script, and uploads agent logs.
Amazon DynamoDB	`com.amazonaws.{region}.dynamodb`	Gateway	The restore agent writes command execution results to DynamoDB, which the Eon control plane polls to track progress.
Amazon ECR (API)	`com.amazonaws.{region}.ecr.api`	Interface	Authenticates with Elastic Container Registry to obtain an authorization token before pulling container images.
Amazon ECR (Docker registry)	`com.amazonaws.{region}.ecr.dkr`	Interface	Pulls Eon restore workload Docker images from Elastic Container Registry after authentication.
AWS Security Token Service	`com.amazonaws.{region}.sts`	Interface	Performs cross-account `AssumeRole` calls for S3, Elastic Container Registry, DynamoDB, and resource management.
Amazon SQS	`com.amazonaws.{region}.sqs`	Interface	Serves as the command channel from the Eon control plane to the restore node. Carries commands and encrypted secrets.
Amazon S3 Multi-Region Access Points	`com.amazonaws.s3-global.accesspoint`	Interface	Allows the restore server to read vault data when the vault is in a different region. Eon creates the access point automatically. Required only for cross-region restores to private subnets.

For interface endpoints:

Select Enable private DNS name so the restore server resolves AWS service host names to private endpoint addresses.
Place the endpoint in the same VPC and subnet as the restore server.
Associate a security group that allows inbound HTTPS (port 443) from the restore server.

Gateway endpoints require no security group and route automatically through the associated route table.

To create these endpoints, see Create a VPC endpoint in the AWS documentation.