Contents

• LAG Vaults
• Backup and Elastio Protection Workflow
• Key Considerations

LAG Vaults

Elastio enables organizations to inspect backups stored in Logically Air-Gapped Vaults, offering a centralized approach for protecting backups from multiple workload accounts in a single location. 

By sharing the Logically Air-Gapped Vault with a Recovery Account using AWS Resource Access Manager (RAM), organizations can incorporate Elastio into the Restore Test process, ensuring that recovery points are clean and safe before restoration.

Backup and Elastio Protection Workflow

1. Backup Creation and Vault Transfer
   • AWS Backup creates a recovery point in a Local Vault for an Amazon EC2 instance in the AWS account.
   • The recovery point is copied from the Local Vault to the Logically Air-Gapped Vault.
2. Vault Sharing for Restore Testing
   • The Logically Air-Gapped Vault is shared with the Recovery Account using AWS Resource Access Manager (RAM).
   • Detailed instructions are available in the AWS blog on logically air-gapped vaults.
      
3. Restore Testing with Elastio 
   • Perform a restore in the Recovery Account via AWS Backup Restore Testing.
   • An Amazon EventBridge event is triggered when the restore completes.
   • A Lambda function checks if the recovery point is tagged with "elastio=scan":
     • If tagged, the Lambda function triggers Elastio inspection.
     • Results are sent back to AWS Backup Restore Testing.

Steps to Protect Backups in Logically Air-Gapped Vaults

Step 1: Deploy Elastio in the Recovery Account

Deploy Elastio in the Recovery Account using a CloudFormation template.

Step 2: Add Metadata Tags to Recovery Points

Deploy a CloudFormation template in workload accounts to tag AWS Backup Recovery Points. This step is critical for protecting EC2 recovery points since AWS Backup does not transfer volume metadata to the Logically Air-Gapped Vault. Adding tags enables easier correlation of volumes within the Elastio Console.

Steps:

1. Navigate to CloudFormation in AWS and click “Create Stack with new resources.”

   

2. Choose “Upload a template file”, upload the YAML file, and click Next.

   

3. Name the stack and click Next, leaving everything else as default.
   
4. Click Next.
   
   
5. Acknowledge the terms and click “Submit.”
    

Step 3: Add Action Tags to AWS Backup Plans

Add the tag "elastio=scan" to the Backup Plan in the source account to enable automatic protection of recovery points created under this plan.

• Steps:
  1. Go to AWS Backup Console and click “Create backup plan.”
     
     
      
  2. Set the plan details and add "elastio=scan" under “Tags added to the recovery points - optional.”
     
     
      
  3. Click “Create Plan.”

Once created, all recovery points associated with this plan will be automatically protected by Elastio.

Step 4: Enable Restore Testing Integration

Deploy a CloudFormation template in the Recovery Account to integrate Elastio into the AWS Backup Restore Testing process.

• Steps:
  1. Navigate to CloudFormation in AWS and click “Create Stack with new resources.”
     
     
      
  2. Step 1: Choose “Amazon S3 URL”, paste the link, and click Next.
     
     
      
  3. Step 2: Name the stack and click Next, leaving everything else as default.
     
     
      
  4. Step 3: Click Next.
     
     
      
  5. Step 4: Acknowledge the terms and click “Submit.”

Step 5: Add Restore-Test Tags to Backup Plans

Add the tag "elastio=scan" to the Backup Plan in the source account to enable Elastio as part of Restore Testing.

• Steps:
  1. Go to AWS Backup Console and click “Create backup plan.”
     
     
      
  2. Set the plan details and add "elastio=scan" under “Tags added to the recovery points - optional.”
     
     
      
  3. Click “Create Plan.”

All recovery points associated with this plan will automatically trigger Elastio inspections during Restore Testing.

Key Considerations

• Automated Protection: Elastio inspects all recovery points for EC2 and EBS created by AWS Backup. For S3 and EFS, Elastio inspects data for ransomware, insider threats and malware behavior during the Restore Test process, as the data is being restored. This proactive approach eliminates the need to wait for the restore to complete before starting a scan, reducing Restore Test times and associated costs.
• Tagging for Automation: Proper tagging of recovery points ensures seamless integration with Elastio and simplifies recovery workflows.