About Restore Templates

Who can use this feature

Anyone with these permissions: View restore templates

With a restore template, restoring a resource comes down to picking a snapshot. The template saves your restore choices ahead of time, such as network settings you know work, so you don’t spend time on each setting during a restore or restore again after choosing the wrong subnet or bucket. For each resource you’d need back quickly, a template means:

You don’t need to decide restore settings during active incidents: The template supplies the destination and every setting for the resource type.
Settings are pre-validated: Eon validates the template against its destination account, so a missing subnet or bucket is surfaced on the Restore templates page before the incident, not partway through a restore.
You can restore multiple resources in one action: A bulk restore recovers many EC2 instances and S3 buckets together using your restore templates.

This article explains what a restore template saves and how Eon validates it, so you can decide which resources to prepare with one before an incident.

A restore template is a saved set of restore settings. Each template names a destination restore account and region, plus the settings for its resource type. You can attach a template to all the resources it should restore. A resource has at most one attached template, which Eon uses by default when you restore that resource on its own or in a bulk restore.

The destination must be a connected restore account. To learn how restore accounts work, see About Restore Accounts.

You manage templates on the Restore templates page, where they’re grouped under EC2 Instance and S3 Bucket.

What a template saves

Each resource type saves the settings its restore needs. The destination restore account and region apply to both types.

EC2 instance templates

Setting	What it sets
Region	The AWS region the instance is restored to.
VPC and Subnet	The subnet the restored instance launches in.
Instance type	The instance type of the restored instance. With Use the source instance type turned on, each instance is restored with the type recorded in its own snapshot instead, and the subnet’s availability zone must offer that type.
Security groups	One or more security groups to associate with the restored instance, in the subnet’s VPC.
Encrypt restored instance	The KMS key that encrypts the restored volumes: a customer-managed key, or the AWS-managed `aws/ebs` key.
Naming	The name of the restored instance. Placeholders fill in a different name for each instance, as listed in Restore Template Placeholders.
Keep original tags	Whether the restored instance keeps the tags it had when the snapshot was taken.
Start instance after restore	Whether Eon starts the instance once it’s restored.

S3 bucket templates

Setting	What it sets
Target region	The AWS region of the destination bucket.
Target bucket ID	An existing bucket in the destination restore account and region that receives the restored objects.
Prefix template	The prefix the objects are restored under. Placeholders fill in a different prefix for each bucket, as listed in Restore Template Placeholders.
Encrypt temporary restore secrets	A customer-managed KMS key that encrypts the temporary secrets that the restore uses. It doesn’t encrypt the restored objects, which use the destination bucket’s default encryption.

Template validation

A template saves IDs from your restore account, such as a subnet or a bucket, and those resources can change or disappear after you save the template. So Eon validates the template against its destination account each time you restore from it, and each time the Restore templates page shows it. The page shows the result next to the template’s name, as Valid or Needs attention. Check the Restore templates page regularly, before you need a template.

Template type	What Eon validates
EC2 instance	The subnet exists in the destination account and region. Each security group exists and is in the subnet’s VPC. The instance type, or each instance’s own type when the template uses the source instance type, is offered in the subnet’s availability zone. The KMS key, if set, is in the destination account and region and can encrypt the restored volumes.
S3 bucket	The bucket name is valid. The bucket exists in the destination account. The bucket’s region matches the template’s region. The KMS key, if set, is a customer-managed key in the destination account and region.

When validation fails, the console lists each failing setting with the reason and a suggested fix. A template that isn’t valid can’t start a restore.

Additional information

Restore templates:

Restoring from templates:

Bulk Restore Resources

Restore accounts:

About Restore Accounts