How do I use AWS Backup to perform an S3 restore job?

Resolution

Prerequisite: Verify that your AWS Identity and Access Management (IAM) role has the required permissions.

Important:

• You must activate access control lists (ACLs) in the destination bucket so that the Amazon S3 restore job doesn't fail.
• If Block Public Access is active on the destination bucket, then AWS Backup doesn't restore objects with public ACLs.
• If the destination bucket has an object with the same name or version ID, then AWS Backup skips the objects.

You can use either the AWS Backup console or the AWS Command Line Interface (AWS CLI) to restore your S3 data.

Use the AWS Backup console

Complete the steps in Restore through the AWS Backup console.

Use the AWS CLI

Note: If you receive errors when you run AWS CLI commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Complete the following steps:

1. Run the list-recovery-points-by-backup-vault command to list all recovery points in your backup vault:

   aws backup list-recovery-points-by-backup-vault \
       --backup-vault-name Default \
       --output json \
       --query 'RecoveryPoints[].[BackupVaultName,RecoveryPointArn]'

   Note: Replace backup-vault-name with your backup vault's name.

2. From the command's output, note the RecoveryPointArn of the recovery point that you want to restore. The Amazon Resource Name (ARN) format is arn:aws:backup:region:1234567890:recovery-point:example-bucket-f24fe343.

3. Create a JSON file that includes the following metadata:
   DestinationBucketName: The destination bucket for your restore.
   (Only object-level retore) ItemsToRestore: A list of up to five paths of individual objects to restore.
   NewBucket: A Boolean value that specifies whether to create a new bucket.
   Encrypted: A Boolean value that specifies whether to encrypt the restored data.
   CreationToken: An idempotency token.
   EncryptionType: The type of encryption for your restored objects. You can specify the same encryption as the original object, server-side encryption with Amazon S3 managed keys (SSE-S3), or server-side encryption with AWS Key Management Service (AWS KMS) keys (SSE-KMS).
   (Only for continuous recovery points) RestoreTime: The restore time in the format 2021-11-27T03:30:27Z.
   (Optional) RestoreLatestVersionUpTo: You can specify 1 to restore to the latest object version or n to restore to a positive integer that's greater than 1 or all versions less than n. Or, specify all to restore all versions.
   Example JSON file:

   {
       "DestinationBucketName": "TestBucket",
       "ItemsToRestore": "[\"s3://example-bucket/abc.jpg\",\"s3://example-bucket/abcd.jpeg\",\"s3://example-bucket/bucket.txt\"]",
       "Encrypted": "true",
       "NewBucket": "true",
       "CreationToken": "test",
       "EncryptionType": "SSE_KMS",
       "KMSKey": "arn:aws:kms:us-east-1:1234567890:key/abf95f23-4f2d-4fe9-8177-a311da3179c5"
   }

4. Run the start-restore-job command:

   aws backup start-restore-job \
       --recovery-point-arn "arn:aws:backup:us-east-1:1234567890:recovery-point:example-bucket-f24fe343" \
       --iam-role-arn "arn:aws:iam::1234567890:role/service-role/AWSBackupDefaultServiceRole" \
       --metadata file://s3-restore-metadata.json

   Note: Replace recovery-point-arn with your recovery point's ARN and iam-role-arn with your IAM role's ARN. Also, include your JSON metadata file.
   If you must include the metadata directly in the start-restore-job command instead of the JSON file, then use the following format:

   aws backup start-restore-job \
       --recovery-point-arn "arn:aws:backup:us-east-1:1234567890:recovery-point:example-bucketf24fe343" \
       --iam-role-arn "arn:aws:iam::1234567890:role/service-role/AWSBackupDefaultServiceRole" \
       --metadata '{
           "DestinationBucketName": "TestBucket",
           "ItemsToRestore": "[\"s3://example-1/abc.jpg\",\"s3://example-2/abcd.jpeg\",\"s3://example-3/bucket.txt\"]",
           "Encrypted": "true",
           "NewBucket": "true",
           "CreationToken": "test",
           "EncryptionType": "SSE_KMS",
           "KMSKey": "arn:aws:kms:us-east-1:1234567890:key/abf95f23-4f2d-4fe9-8177-a311da3179c5"
       }'

Related information

How can I restore a previous version of an Amazon S3 object in AWS Backup?

Restore Amazon S3 recovery points through AWS CLI

Restoring a continuous backup

Streamline search and item-level recovery with AWS Backup

Amazon S3 restore considerations