Eon System Overview
This article covers Eon’s backup process. You’ll be introduced to the main steps Eon takes to back up your resources, and you’ll see how Eon handles your data in each step.
This article is written to give a high-level understanding of how Eon backs up your data. In each step along the way, we link to related content so you can find out more when you’re ready.
How Eon automatically backs up your resources
When you first open an Eon account, you’re asked to grant certain permissions to Eon. We provide a CloudFormation template that installs the IAM policies that give Eon the needed access to your account.
After you grant the permissions, Eon can run the first discovery, and the initial list of resources start showing up in your Eon inventory.
Discover resources
During discovery, Eon searches your cloud account for new or updated resources that may need to be backed up. The list of resources and their metadata, such as resource name, tags, and whether there are existing snapshots, are reported to Eon. The resources and their metadata are displayed in your inventory in Eon, giving you an overview of your resource statuses at a glance.
This is a good start, but more information is needed to determine what needs to be backed up. Eon has to dig deeper into your resources to report on more detailed data, which it does during resource classification, next.
Keeping your data secure
Discovery is carried out over a series of API requests to your cloud account, and only metadata is reported to Eon. Actual resource data isn’t read or transferred to Eon’s account during discovery.
See also
Classify resources
After discovery, Eon classifies your resources based on the data they contain. Classification is a process where Eon requests snapshot copies of all the new and previously discovered resources, and sends them for scanning in a dedicated, isolated scanning account.
During resource classification, Eon looks for:
- The apps that are installed on a virtual machine.
- Environment—for example, production or non-production.
- Data classes—for example, personally identifiable information (PII) or protected health information (PHI).
Eon also scans for information about files and databases, and makes them available for you to explore. More on that in Beyond snapshots, below.
The resource classifications are indexed and added to your inventory, giving a complete view of Eon’s findings for each resource.
Keeping your data secure
- Eon uses TLS 1.2 or higher encryption during transfer.
- Your data in the scanning account is secured in a closed, single-tenant VPC.
Apply backup policies
After your resource data is analyzed and classified, Eon now has enough information to apply the right backup policies to your resources. A backup policy is a configuration that uses a set of conditions and then, based on those conditions, sends your snapshots to vaults. More on vaults in Save snapshots to vaults, below.
Backup policies are made up of two parts: conditions and rules.
Eon doesn’t back up your data until you have an active backup policy.
New accounts don’t come with any active backup policies. So if you’re opening an account, Eon discovers and classifies your resources, but nothing is backed up until you create your first policy.
Conditions
Conditions set which resources to back up. You have complete flexibility with how you set the policy conditions, and you can set multiple and-or logic groups to target the resources you want, while minimizing false positives.
As an example, a backup policy could be set to back up resources with these conditions:
- Environment is production, and
- resource type is EC2, and
- the list of data classes contains PII, and
- the source region is
us-west-1.
In addition to the logical conditions, you can also manually assign resources or exclude resources, which can be useful for fine-tuning your backup policy.
Rules
Rules set backup frequency, retention period, and vault. A backup policy typically has multiple rules, and you can set your rules to any combination of backup frequency, retention, and vault.
For example, a single backup policy could contain all three of these rules:
- Send daily snapshots to vault A, and retain for 30 days.
- Send daily snapshots to vault B, and retain for 60 days.
- Take monthly snapshots to vault B, and retain for 180 days.
Once Eon determines that a policy applies to a resource, the next step on the journey is to back up the resources to your vaults.
Save snapshots to vaults
Now the resources arrive where they were meant to be—safe in your vaults.
When a resource is backed up to a vault for the first time, a full snapshot is encrypted and sent to the vault. All future snapshots in the vault are incremental, so the amount of storage and costs to you are minimized.
A snapshot in your vault is retained for the time period that was set in the backup policy at the moment it was backed up, even if the policy is later updated to use a shorter retention period.
You can also create an on-demand snapshot and send it to any vault at any time.
Keeping your data secure
- Eon uses TLS 1.2 or higher encryption during transfer.
- Each vault is a separate S3 bucket in a dedicated, single-tenant vault account. Eon secures your AWS vault with S3 server side encryption.
Beyond snapshots: Monitoring, exploring, and restoring
After the snapshots are stored in your vaults, Eon allows you to monitor your backup posture in real time, explore supported resources, and restore your data on demand.
Monitor your backup posture
The first thing you see when you log into your account is your dashboard, with your backup posture taking center stage. To determine your backup posture, Eon compares your backup policies, your resource metadata and data classifications, and your controls.
Controls are configurations you set to reflect compliance with standards, regulations, and your company’s data handling practices. Think of controls as a set of catch-all requirements your backup policies need to meet. If your backup policies don’t meet the rules set in your controls, Eon reports it as a violation.
As an example, a control could have this configuration:
- Apply to any production resource with protected health information (PHI) data.
- Back up to a vault in a different region from the source, and retain for at least 90 days.
- Back up to a vault in a different cloud from the source, and retain for at least 30 days.
- Back up to a vault in the EU only.
Explore resources
You can use your inventory to filter for resources and see their snapshot history. You can also explore certain resources from the Search page.
Exploration is supported for databases and resources with file systems:
- For databases, you can see table names and column names, and you can find specific records with a SQL query.
- For file systems, you can see file paths and folder contents.
Restore a resource or granular data
Any restore starts with you deciding on the level of granularity you want to restore. The available options depend on the snapshot’s resource type. For example:
- For EC2, you can restore the instance, volume, folder, or file.
- For RDS, Aurora, and EC2-hosted RDBMS, you can restore the instance or individual records based on a SQL query.
- For S3, you can restore a bucket, object, or file.
Once you know the resource and granularity you want to restore, you can move on to actually restoring the data. You can restore the data to the subnet, availability zone, VPC, or account you choose. The restore destination is always in your own cloud account, so you’ll need to give Eon the necessary permissions. Eon runs a restore job and, when the job is done, the restored resource or data is available in your cloud account.