Introduction

During AWS re:Invent 2019, Veeam released “Backup for AWS”, a backup and recovery solution designed, at this time, to protect AWS EC2 instances. In this upcoming (and now here) series of posts, I’ll detail how to deploy and use Veeam Backup for AWS to backup and restore data from your AWS EC2 instances. This series is not intended as a product comparison with other cloud-native backup utilities though

Veeam Backup Server. In this section, we will describe how to design and size the Veeam backup server. Sizing with Veeam is cumulative in respect to configurations, if you want to create an all-in-one appliance (Appliance Model) sum up all the resource requirements (CPU + Memory) to understand what you will need in total, combining roles such as the proxy and repository merits the same. FREE Backup for VMs, Windows, Linux, laptops, NAS and more! Veeam® Backup & Replication™ Community Edition is the must-have FREE backup software to protect virtual, physical and cloud workloads. This free gift from Veeam can protect up to 10 workloads: VMware, Hyper-V, Windows & Linux servers, laptops, NAS and more! Why use Veeam Backup Free Edition? Veeam® Backup™ Free Edition is a powerful, easy-to-use utility that consists of 13 different features, all of which can be utilized to back up and restore your VMware vSphere or Microsoft Hyper-V virtual environment. It provides many of the same backup and recovery features found in Veeam Backup &.

Deploying Veeam Backup for AWS from the AWS Marketplace

The steps below highlight those required to deploy Veeam Backup for AWS using the Veeam provided CloudFormation template PLUS a few notes of my own in regards to setting up the networking

1. Sign in to AWS Marketplace using credentials of an AWS account inwhich you plan to install Veeam Backup for AWS. Enter Veeam in the search bar and select theproduct version you wish to install.

Veeam backup free edition install guide download

2. Open the Veeam Backup for AWS overview page for thenecessary product edition and, click Continue to Subscribe.

3. Accept the licensing terms and then click Continue toConfiguration.

4. On the Configure this software page, specify the installationsettings. At the time of this writing,there was only a single Fulfillment Option and Software Versionavailable (shown below). On the Regiondropdown, select the AWS region in which to install the Veeam Backup for AWSinstance and then click Continue to Launch.

Veeam Backup Free Edition Install Guidelines

5. On the Launch this software page, specify thelaunch Action from the drop-down list. The available options are Copy to Service Catalog and LaunchCloudFormation. In this example, CloudFormationwas selected. When you click Launch,the CloudFormation Create Stack wizard will launch.

6. On the Specify template screen, the template settings arealready configured. Click Next tocontinue.

7. On the Specify stack details page, specify thefollowing:

In the Stack name field, specify a name for the created stack.
In the Instance Configuration section:
- From the Instance type for Veeam Backup for AWS server drop-down list, select the type for the EC2 instance on which Veeam Backup for AWS (VBAWS) will be installed.
  - The recommended instance type is a t2.medium.
- From the Key Pair for Veeam Backup for AWS Server drop-down list, select a key pair that will be used to authenticate against the VBAWS EC2 instance. If necessary, a new key pair can be created.
- Select true if you want to enable an automatic backup for EBS volumes of the Veeam Backup for AWS server.
- Select true if you want to let AWS restart the Veeam Backup for AWS server if any software failure occurs.
- Select true if you want to let AWS restart the Veeam Backup for AWS server if any infrastructure failure occurs.
In the Network Configuration section:
- Select true if you want to create an Elastic IP address for the Veeam Backup for AWS server. For my instance, I set the value to False to see if any problems arise using a dynamic IP. I’ve yet to have any in my environment but you mileage may vary.
- In the Allowed Source IP Addresses for connection to SSH field, specify the IPv4 address range from which the Veeam Backup for AWS server will be accessible over SSH.
- In the Allowed Source IP Addresses for connection to HTTPS field, specify the IPv4 address range from which Veeam Backup for AWS Web UI will be accessible.

Based on the specified IPv4 ranges, AWS CloudFormation will create a security group for Veeam Backup for AWS with inbound rules for SSH and HTTPS traffic using the values you specify. By default, port 22 is open for inbound SSH traffic and port 443 is open for inbound HTTPS traffic.

In the VPC and Subnet configuration section:
- Select the VPC and the Subnet in which the Veeam Backup for AWS server will reside and then click Next.
- A personal tidbit– When I deployed my server, I selected a private subnet. To date, I have experienced no issues in regards to deploying the server on a private subnet. However, I did have problems with file-level restores when worker instances were deployed to private subnets because the FLR restoration browser is only accessible via a public IP/URL/DNS hostname.

8. On the Configure Stack Options screen, specify any relevant Tags, Permissions, or Advanced Options and click Next.

9. At the Review step of the wizard, do the following:

Review the stack settings.
At the bottom of the page, select the I acknowledge that AWS CloudFormation might create IAM resources check box.
Click Create stack.

10. Once the instance is available, notate the instance ID. Launch a web browser and connect to the servers IP address. When prompted:

accept the EULA
enter the instance ID
specify an administrator account/password

11. Once logged into the server, the next steps will be to configure worker instances, add a backup repository, and create a backup policy.

Conclusion

It may seem like a bunch of steps but deploying Veeam Backup for AWS is relatively straightforward. I would just suggest considering/remembering the following:

Prior to deploying the Veeam Backup for AWS server:
- Determine which IPs/subnets should be able to access the server using SSH and HTTPS in order to avoid creating an “Allow All” security group that you’ll promise to change later but maybe forget. Start with least-privilege as opposed to allow all.
- Do you have a tagging strategy? Hopefully you do. Determine the tags relevant to the Veeam backup server itself as well as tags assigned to your EC2 instances. Once you log into the server, you are able to create backup policies based on tags.
To date, I have not experienced any issues in regards to deploying the server on a private subnet. However, worker instances must be deployed to public subnets to support file-level restores.
During the deploying of the server, an IAM role is created that allows the Veeam server permissions to backup all EC2 instances and S3 buckets in the account in which the Veeam server is deployed. You can create and assign a custom IAM role to the Veeam Backup for AWS server if you need to backup instances in other accounts.
Finally, this is just something I’ve been kicking around in my head but for this install, I se