#1 Global Leader in Data Resilience

How to use "Restore to Amazon EC2" via AWS PrivateLink / Direct Connect

KB ID: 4264
Product: Veeam Backup & Replication | 12 | 12.1 | 12.2 | 12.3 | 12.3.1 | 12.3.2
Published: 2022-01-20
Last Modified: 2025-05-05
mailbox
Get weekly article updates
By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

error icon

Oops! Something went wrong.

Please, try again later.

Purpose

This article documents how to configure Veeam Backup & Replication to use AWS PrivateLink or AWS Direct Connect to perform Restore to Amazon EC2. This restore configuration also works when the Veeam Backup server has restricted or no public internet access.

Solution

Prepare the AWS Environment

  1. (If using AWS Direct Connect, skip to step 2.) 
    For AWS PrivateLink, configure a VPN connection to the VPC where you plan to deploy the PrivateLink Endpoint. One of the ways to do this is to create a tunnel on the VM gateway using AWS Client VPN.
  2. Create Endpoints in VPC:
    1. Create an S3 Interface Endpoint in your VPC. It will be assigned a DNS name that you can see in the AWS Console under VPC - Endpoints when selecting the corresponding Endpoint.
    2. Create an EC2 Endpoint in your VPC.

Prepare the Veeam Backup & Replication Environment

  1. Disable automatic updating of the AmazonS3Regions.xml file by creating the following registry value on the Veeam Backup Server.
    This will prevent Veeam Backup & Replication from updating and overwriting the changes you'll make in the next section of this guide. Disabling the automatic updating of the cloud regions files also means that when new regions are launched, they will not appear within the Veeam Backup & Replication console.

    Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\
    Value Name: CloudRegionsDisableUpdate
    Value Type: DWORD (32-Bit) Value
    Value Data: 1
Impact of Disabling CRL (Certificate Revocation List) Checks

Step 4 explains how to configure Veeam Backup & Replication to bypass Certificate Revocation List (CRL) checks, which verify if certificates have been revoked by the issuing Certificate Authority (CA). These checks are vital for ensuring only valid certificates are accepted.

Veeam recommends configuring network infrastructure to allow CRL checks whenever possible. However, if the Veeam Backup & Replication server or components lack internet access, disabling CRL checks may be necessary, as outlined in Step 4.

Note that disabling CRL checks affects all Object Storage interactions, not just 'Restore to EC2'. Consider re-enabling this security feature after completing restore operations unless specific needs, like backing up to S3 via PrivateLink or Direct Connect, require it to remain disabled.

  1. [Optional, Read Note Above] Review the scenarios provided below and, based on whether a Helper Appliance will be used or not, establish the necessary settings to disable certificate revocation checks as advised.
    1. If Restoring to Amazon EC2 with a Helper Appliance, create the following registry values on the Veeam Backup Server:
      • Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\
        Value Name: ObjectStorageTlsRevocationCheck
        Value Type: DWORD (32-Bit) Value
        Value Data: 0
      • Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\
        Value Name: PublicCloudTlsRevocationCheck
        Value Type: DWORD (32-Bit) Value
        Value Data: 0
    2. If Restoring to Amazon EC2 without a Helper Appliance, the setting must be created on both the Veeam Backup Server and the machine that manages the backup repository data.

      Note: We strongly advise using a Helper Appliance for Restore to Amazon EC2 over PrivateLink to eliminate the need to configure custom settings on the repository.
      • For Windows-based Repositories, create the following registry value on the Windows machine hosting the repository:

        Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\
        Value Name: ObjectStorageTlsRevocationCheck
        Value Type: DWORD (32-Bit) Value
        Value Data: 0
      • For Linux-based Repositories (including Hardened Linux Repositories), add the following entry to the /etc/VeeamAgentConfig on the Linux machine hosting the repository:
        ObjectStorageTlsRevocationCheck=0
        
      • For SMB Share, NFS Share, Deduplicating Devices (Except ExaGridFor ExaGrid devices Veeam operates a VeeamAgent process directly on the storage operating system. Contact Veeam Support for assistance with configuring the appropriate ObjectStorageTlsRevocationCheck settings. Or, use a helper appliance to bypass the need to modify the repository.), and Object Storage Repositories, the setting must be created on the Gateway server assigned within the respective repositories configuration.
        • For Windows-based Gateway servers, create the following registry value:

          Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\
          Value Name: ObjectStorageTlsRevocationCheck
          Value Type: DWORD (32-Bit) Value
          Value Data: 0
        • For Linux-based Gateway servers, add the following entry to the /etc/VeeamAgentConfig file:
          ObjectStorageTlsRevocationCheck=0
          
     
  2. Configure the AWS Appliance to use a Private IP by creating the following registry value on the Veeam Backup Server.

    Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\
    Value Name: AwsApplianceUsePublicIp
    Value Type: DWORD (32-Bit) Value
    Value Data: 0

Modify the AmazonS3Regions.xml File

This Affects All Traffic to the Modified Region
The AmazonS3Regions.xml file contains a list of regions and their respective endpoints. Modifying a region's endpoints makes it possible to force Veeam Backup & Replication to connect to a specific endpoint when that region is selected in the UI. This modification will cause all tasks that utilize the region you modify to employ the customized S3 and EC2 endpoints. If you wish to avoid interference, consider altering a region that other tasks or objects in Veeam Backup & Replication are not using. Then, use that altered region exclusively when you want to direct traffic to use the custom endpoints.
  1. On the Veeam Backup Server, edit C:\Program Files\Veeam\Backup and Replication\Backup\AmazonS3Regions.xml
  2. Find the Region section corresponding to your PrivateLink or Direct Connect location.

    Example:
     <Region Id="ap-northeast-1" Name="Asia Pacific (Tokyo)" Type="Global">
    
  3. Within that region's section, find the line <Endpoint Type="s3"> and replace the existing DNS value with the S3 Interface Endpoint DNS created in Prepare the AWS Environment > Step 2.

    Note: For S3, the AWS console will display a DNS value starting with an asterisk. When altering the AmazonS3Regions file, replace that asterisk with the word bucket.

    Example:
    <Endpoint Type="S3">s3-ap-northeast-1.amazonaws.com</Endpoint>
    
    Is changed to:
    <Endpoint Type="S3">bucket.vpce-00000000000000000-00000000.s3.ap-northeast-1.vpce.amazonaws.com</Endpoint>
    
  4. If multiple lines for <Endpoint Type="S3"> are in the Region section you are altering, remove all but the one you changed.

    Example:
    <Region Id="ap-northeast-1" Name="Asia Pacific (Tokyo)" Type="Global">
    <Endpoint Type="S3">bucket.vpce-00000000000000000-00000000.s3.ap-northeast-1.vpce.amazonaws.com</Endpoint>
    <Endpoint Type="S3">s3.dualstack.ap-northeast-1.amazonaws.com</Endpoint>
    
  5. Within the same Region section, find the line <Endpoint Type="EC2"> and replace the existing DNS value with the EC2 Endpoint DNS created in Step 2.

    Example:
    <Endpoint Type="EC2">ec2.ap-northeast-1.amazonaws.com</Endpoint>
    
    Is changed to:
    <Endpoint Type="EC2">vpce-00000000000000000-00000000.ec2.ap-northeast-1.vpce.amazonaws.com</Endpoint>
    
  6. Save the file.
before edits.
Before Modification
After change example
After Modification

Perform the Restore

With Veeam Backup & Replication now modified to force it to connect to the specified Endpoints, proceed with performing a Restore to Amazon EC2.

Restore notes:

  • When specifying the "Data center region:" select the one that matches the Region you modified in the AmazonS3Regions.xml.
  • Enable the "Use the proxy appliance" option.
  • If the Veeam Backup server's public internet access is restricted or blocked, when you click 'OK' after you click 'Customize' on the Proxy Appliance step, you may see a warning about "The operation has timed out." Select 'Yes' and proceed.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

Thank you!

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please, try again later.

You have selected too large block!

Please try select less.

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case

By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.
Verify your email to continue your product download
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

error icon

Oops! Something went wrong.

Please, try again later.