> This page is for Data Protection. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.eon.io/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server. # AWS: Restore Server Requirements This article describes the network connectivity requirements for restore servers in AWS restore accounts. By default, Eon runs the restore server using your account's default VPC, subnet, and security group. If these defaults exist and have the required connectivity, no additional configuration is needed. If the default VPC resources have been deleted or have outbound limitations, customize the restore server's network configuration. See [AWS: Customize Restore Server Configuration] for details. [AWS: Customize Restore Server Configuration]: /data-protection/cloud-workloads/aws/restore-accounts/aws-customize-restore-server-configuration ## Network requirements The network requirements depend on the resource you're restoring. ### EC2 and S3 When restoring EC2 instances, Eon creates the restore server in the same availability zone as the restore destination. When restoring S3 buckets, Eon creates the restore server in the same region. | Network resource | Requirements | | ---------------- | ------------------------------------------------------------------ | | Subnet | Outbound communication is open, or [VPC endpoints] are configured. | ### RDS When restoring RDS instances, Eon creates the restore server in the same VPC as the restored instance. The restore server needs to create and populate databases on the restored instance. The restore server and the restored RDS instance each need a security group that allows TCP communication between them on the database port. Eon creates restored databases using standard ports: * MySQL: TCP port 3306. * PostgreSQL: TCP port 5432. * SQL Server: TCP port 1433. | Network resource | Requirements | | ------------------------------------ | ----------------------------------------------------------------------------------- | | VPC DNS resolution | Must be enabled. The restore server resolves database endpoints by hostname. | | VPC DNS hostnames | Must be enabled. | | Subnet | Outbound communication is open, or [VPC endpoints] are configured. | | Security group for restore server | Allows outbound TCP on the database port to the restored instance's security group. | | Security group for restored instance | Allows inbound TCP on the database port from the restore server's security group. | > **Note** > > VPC DNS resolution and DNS hostnames are enabled by default on AWS VPCs. > If you're using a custom VPC, verify that these settings are enabled. ## VPC endpoints for subnets without internet access When a restore server runs in an isolated or private subnet without internet access, it can't reach AWS services over the public internet. VPC endpoints let the restore server communicate with those services through the AWS network, without requiring outbound internet access. If you're using a custom private subnet for the restore server, configure the following VPC endpoints in the VPC where the restore server runs. In the service names below, replace `{region}` with the AWS region of that VPC. This is the restore destination region, which may differ from the vault's region. | AWS service | Service name | Endpoint type | Purpose | | ------------------------------------ | ------------------------------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Amazon S3 | `com.amazonaws.{region}.s3` | Gateway | Reads vault backup data from S3, downloads the agent bootstrap script, and uploads agent logs. | | Amazon DynamoDB | `com.amazonaws.{region}.dynamodb` | Gateway | The restore agent writes command execution results to DynamoDB, which the Eon control plane polls to track progress. | | Amazon ECR (API) | `com.amazonaws.{region}.ecr.api` | Interface | Authenticates with Elastic Container Registry to obtain an authorization token before pulling container images. | | Amazon ECR (Docker registry) | `com.amazonaws.{region}.ecr.dkr` | Interface | Pulls Eon restore workload Docker images from Elastic Container Registry after authentication. | | AWS Security Token Service | `com.amazonaws.{region}.sts` | Interface | Performs cross-account `AssumeRole` calls for S3, Elastic Container Registry, DynamoDB, and resource management. | | Amazon SQS | `com.amazonaws.{region}.sqs` | Interface | Serves as the command channel from the Eon control plane to the restore node. Carries commands and encrypted secrets. | | Amazon S3 Multi-Region Access Points | `com.amazonaws.s3-global.accesspoint` | Interface | Allows the restore server to read vault data when the vault is in a different region. Eon creates the access point automatically. Required only for cross-region restores to private subnets. | For interface endpoints: * Select **Enable private DNS name** so the restore server resolves AWS service host names to private endpoint addresses. * Place the endpoint in the same VPC and subnet as the restore server. * Associate a security group that allows inbound HTTPS (port 443) from the restore server. Gateway endpoints require no security group and route automatically through the associated route table. To create these endpoints, see [Create a VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/create-vpc-endpoint.html) in the AWS documentation. [VPC endpoints]: #vpc-endpoints-for-private-subnets