Veeam Backup for AWS Recovery/Migration Procedure

Challenge

This document explains how to recover or migrate Veeam Backup for AWS data to a new instance.

A Veeam Backup for AWS instance may fail or get corrupt and requires the data volume to be moved to a new instance since it contains information about restore points, repositories, policies. Additionally, this procedure can be used when migrating between editions (for example from FREE to BYOL or MMS). 

Solution

To perform a migration to a new instance, deploy a new Veeam Backup for AWS instance via the AWS marketplace using Cloud Formation as explained in the user guide on installing Veeam Backup for AWS.  

Before beginning, make sure that both Veeam Backup for AWS instances are in the same AWS region and availability zone.

To perform the migration, do the following:

1.   Detach volume 2 from the new Veeam Backup for AWS instance. By default, this is ‘/dev/sdb’. This can be done via the EBS ID link. On the volume page, select "Detach Volume" from the Actions menu.
    2.   Repeat the first step for the old Veeam Backup for AWS instance. This will free up the data disk so it can be attached to the new instance.
3.   Within the Instance overview, copy the instance ID from the new Veeam Backup for AWS instance. 4.   Within the Volume overview, select the data volume from the old Veeam Backup for AWS instance and select “Attach volume” from the actions dropdown.  5.   Within the “Attach volume” window, fill in the instance id from the new Veeam Backup for AWS instance and device name. 6.   The new Veeam Backup for AWS instance is now ready and can be started.
7.   Once the new Veeam Backup for AWS instance is started, you must go through the initial setup to configure the instance and create the initial user. Afterward, you will see all your backup policies, repositories, restore points... User accounts are not migrated so they will have to be recreated.
8. Go to "Cloud Formation service" in the region where our server is deployed.
9. Select appropriate Stack from the list by clicking its name in the Stack Name column.
10. Got to "Resources" tab.
11. Find out Logical ID ‘VeeamImpersonationRole’.
12. Go to the role description by clicking it's name in the Physical ID column.
13. Copy Role ARN by clicking Copy to clipboard on order to add it to the trusted list for recently added role.
14. Go to the Roles tab in IAM service.
15. Find our recently added role.
16. Select it by clicking its name in the Role Name column.
17. Go to the Trust relationship tab.
18. Click Edit trust relationship.
19. Add the following JSON text:

{
    "Version": "2012-10-17",
    "Statement": [
    {
        "Effect": "Allow",
        "Principal": 
    {
        "AWS": "ARN of the role from step 13"
    },
        "Action": "sts:AssumeRole"
    }
  ]
}