> This page is for Data Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# RDS: Restore an Instance

This article explains how to restore an Amazon RDS instance from your Eon snapshots.
For RDS for PostgreSQL and Aurora PostgreSQL, you can also mask sensitive data during the restore.
See [About Data Masking][about-data-masking].

> **Note**
>
> During the restore process, Eon may provision a larger, IO-optimized instance to speed up data replay.
> After the restore completes, the instance class is automatically modified back to the original size.

You can restore RDS instances and Aurora clusters even if they're not managed by an Eon backup policy.
As long as continuous backups are enabled, Eon can automatically discover recovery points and restore to any point in time within the continuous backup retention window.

## Restore an RDS instance

#### Before you start

Before you restore an RDS instance, make sure:

To mask sensitive data in the restored database, also make sure Eon has classified the resource recently.
Masking uses the resource's latest [classification results][Resource Classifications].
A [classification policy][About Classification Policies] keeps these results current.

[Resource Classifications]: /data-protection/backup-and-protection/backup-management/classifications/resource-classifications#data-classes

[About Classification Policies]: /data-protection/backup-and-protection/backup-configuration/classification-policies/about-classification-policies

#### Find the snapshot you want to restore

1. In your

   inventory

   , select the RDS resource you want to restore.
   The Resource Details panel opens.

2. Click the **Eon snapshots** tab.
   You'll see a calendar view with colored dots on the days when snapshots were taken.
   There can be more than one snapshot per day.

   When you click a day, a list of Eon snapshots taken that day is displayed below the calendar.

3. When you find the snapshot you want to restore, click **Restore**.
   The Restore RDS panel opens.

#### Choose the restore account

In the Restore RDS wizard, you're taken through a two-step process.
The first step is to choose a restore account.

Choose the cloud account you want to restore the instance in, and then click **Next**.

#### Choose how to set the master password

Because AWS doesn't provide access to database passwords in backup data, the original master password can't be restored.
You must choose how to set the master password for the restored instance.

Eon provides three options:

1. **Reset the password in AWS after restore**: The instance is restored without a master password set by Eon.
   After the restore completes, you reset the password manually in the AWS console.
   To reset the password, modify the database instance in AWS and set a new master password — for more information, see [Modifying an Amazon RDS DB instance] in the AWS documentation.

2. **Auto-manage password in Secrets Manager**: Eon configures the restored instance to manage its master password through AWS Secrets Manager.
   To use this option, turn off **I'll reset the master password in AWS after restore**, select **Auto-manage password in Secrets Manager**, and optionally specify a KMS key ARN for encrypting the secret.
   If you don't specify a KMS key, AWS uses the default `aws/secretsmanager` key.

3. **Enter password manually**: You provide a custom master password during the restore operation, and Eon sets it on the restored instance.
   To use this option, turn off **I'll reset the master password in AWS after restore**, select **Enter password manually**, and enter your password in the **Master password** field.

Choose your preferred password management option, then click **Next**.

[Modifying an Amazon RDS DB instance]: https\://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview\.DBInstance.Modifying.html

#### Set the restored instance details

In the *Configuration* step, you'll set the restored instance details.

1. Give a **Database name** for the new instance.
   This doesn't have to match the original database name, so you can choose any name to identify the new instance.

2. Choose a **Region** to deploy the restored instance to.

3. Choose an **RDS subnet group** to deploy the restored instance to.

4. Choose a **Security group** to attach to the restored instance.

5. In *Encrypt this resource*, select a KMS key that grants access to `EonRestoreAccountRole`.
   You can either select a key from the **Encryption key** list or enter a **Key ARN**.

6. (PostgreSQL only) To replace sensitive values in the restored database, turn **Keep sensitive data unchanged** off, and then choose a **Replacement method**: **Use fake data** or **Mask with asterisks \*\*\***.
   Data masking is available for snapshots stored in Eon vaults only.
   For what each method writes, see [About Data Masking][about-data-masking].

7. If you want to retain the tags that were present when the snapshot was taken, turn **Keep original tags** on.
   Otherwise, turn **Keep original tags** off.

   In both cases, the new instance is tagged with `eon:restore=true`.
   Tags with the `eon:` prefix aren't included in the original tags because Eon uses this prefix for internal operations.

8. Click **Restore** to start the asynchronous restore job.

[about-data-masking]: /data-protection/backup-and-protection/backup-management/classifications/about-data-masking

#### Monitor the restore job

You can see your list of restore jobs on the

Restore jobs tab

in the Jobs page.

After the job is completed, the status changes to **SUCCESS**, and you can work with the restored instance as normal.
The new instance retains the original database engine, version, and size.

Public access to the new instance is off by default, regardless of what the original public access settings were.
You can enable access by [connecting an EC2 instance to the RDS database][connect-ec2-to-rds] and configuring the security group to allow access through these ports:

* For MySQL: Port 3306.

* For PostgreSQL: Port 5432.

[connect-ec2-to-rds]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/tutorial-connect-ec2-instance-to-rds-database.html