How to use "Restore to Amazon EC2" via AWS PrivateLink / Direct Connect

Prepare the AWS Environment

1. ^{(If using AWS Direct Connect, skip to step 2.)} 
   For AWS PrivateLink, configure a VPN connection to the VPC where you plan to deploy the PrivateLink Endpoint. One of the ways to do this is to create a tunnel on the VM gateway using AWS Client VPN.
   
2. Create Endpoints in VPC:
   1. Create an S3 Interface Endpoint in your VPC. It will be assigned a DNS name that you can see in the AWS Console under VPC - Endpoints when selecting the corresponding Endpoint.
   2. Create an EC2 Endpoint in your VPC.

Prepare the Veeam Backup & Replication Environment

3. Disable automatic updating of the AmazonS3Regions.xml file by creating the following registry value on the Veeam Backup Server.
   ^{This will prevent Veeam Backup & Replication from updating and overwriting the changes you'll make in the next section of this guide. Disabling the automatic updating of the cloud regions files also means that when new regions are launched, they will not appear within the Veeam Backup & Replication console.}
   
   Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\
   Value Name: CloudRegionsDisableUpdate
   Value Type: DWORD (32-Bit) Value
   Value Data: 1
4. Review the scenarios provided below and, based on whether a Helper Appliance will be used or not, establish the necessary settings to disable certificate revocation checks as advised.
   _{Be aware that this setting will disable TLS revocation checks for all interactions with Object Storage, not just for the 'Restore to EC2' function. Given this, it might be prudent to remove this setting once the restore operation is completed, unless there is a specific need to disable this fundamental security feature of TLS certificate verification. Such a need might arise in situations like backing up to S3 via Privatelink or Direct Connect.}
   
   1. If Restoring to Amazon EC2 with a Helper Appliance, create the following registry value on the Veeam Backup Server:
      
      Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\
      Value Name: ObjectStorageTlsRevocationCheck
      Value Type: DWORD (32-Bit) Value
      Value Data: 0
      
      Note: Prior to Veeam Backup & Replication 12, this setting was named S3TLSRevocationCheck.
   2. If Restoring to Amazon EC2 without a Helper Appliance, the setting must be created on both the Veeam Backup Server and the machine that manages the backup repository data.
      
      Note: We strongly advise using a Helper Appliance for Restore to Amazon EC2 over PrivateLink to eliminate the need to configure custom settings on the repository.
      
      • For Windows-based Repositories, create the following registry value on the Windows machine hosting the repository:
        
        Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\
        Value Name: ObjectStorageTlsRevocationCheck
        Value Type: DWORD (32-Bit) Value
        Value Data: 0
        
      • For Linux-based Repositories (including Hardened Linux Repositories), add the following entry to the /etc/VeeamAgentConfig on the Linux machine hosting the repository:
        

        ObjectStorageTlsRevocationCheck=0
        

      • For SMB Share, NFS Share, Deduplicating Devices (Except ExaGridFor ExaGrid devices Veeam operates a VeeamAgent process directly on the storage operating system. Contact Veeam Support for assistance with configuring the appropriate ObjectStorageTlsRevocationCheck settings. Or, use a helper appliance to bypass the need to modify the repository.), and Object Storage Repositories, the setting must be created on the Gateway server assigned within the respective repositories configuration.
        • For Windows-based Gateway servers, create the following registry value:
          
          Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\
          Value Name: ObjectStorageTlsRevocationCheck
          Value Type: DWORD (32-Bit) Value
          Value Data: 0
          
        • For Linux-based Gateway servers, add the following entry to the /etc/VeeamAgentConfig file:
          

          ObjectStorageTlsRevocationCheck=0
          

   Note: Prior to Veeam Backup & Replication 12, this setting was named S3TLSRevocationCheck.
5. Configure the AWS Appliance to use a Private IP by creating the following registry value on the Veeam Backup Server.
   
   Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\
   Value Name: AwsApplianceUsePublicIp
   Value Type: DWORD (32-Bit) Value
   Value Data: 0

Perform the Restore

With Veeam Backup & Replication now modified to force it to connect to the specified Endpoints, proceed with performing a Restore to Amazon EC2.

Restore notes:

• When specifying the "Data center region:" select the one that matches the Region you modified in the AmazonS3Regions.xml.
• Enable the "Use the proxy appliance" option.
• If the Veeam Backup server's public internet access is restricted or blocked, when you click 'OK' after you click 'Customize' on the Proxy Appliance step, you may see a warning about "The operation has timed out." Select 'Yes' and proceed.