Amazon S3 restores

You can restore objects in a protection group using either Global Search or using a specific point-in-time from the calendar view. You can restore all the S3 assets from a protection group or you can select specific objects to restore. You can also choose the account or region, the bucket, and the storage class to restore the objects.

For S3 buckets that have versioning enabled, Clumio Backtrack lets you roll back versioned objects or undo accidental deletions in place, using the bucket's own version history - without copying data outside your AWS account.

You can also directly access point-in-time backup data for purposes of backup validation, granular restore at scale, DR testing and copy data management with Clumio's Instant Access feature.

Restores from a protection group

Restores from a protection group share the same granularity, version handling, and destination options regardless of whether you start from Global Search or from the calendar view.

Granularity. You can choose what to restore, as follows:

• Object-level — Pick one or more individual objects. For each object, you can select which version to restore.

• Prefix-level — Restore all objects under one or more S3 prefixes.

• Bucket-level — Restore the entire contents of one or more buckets.

Version handling. For prefix-level and bucket-level restores, you choose between the following:

• Latest version — Restore only the most recent version of each object as of the backup point.

• All versions — Restore the full version history captured in the backup.

For object-level restores, you select the specific version of each object directly.

Destination. You can restore to the following:

• The same bucket and AWS account as the source.

• A different bucket in the same AWS account.

• A bucket in a different AWS account, in the same region or a different region (cross-account and cross-region restore).

You can also choose the destination storage class, specify a prefix, and add custom tags to the restored objects.

Restore from a protection group using global search

1. From the Clumio navigation pane, go to AWS > Protect > S3 > Protection Groups and click the protection group from which you want to restore objects.

2. On the asset details page, click Search objects across backups. Select a filter from the drop down list. You can use as many of the available filters to find the objects to restore. Click Apply to retrieve a list of objects based on your search.

3. Next, select the latest version of the object or all versions of the object that match your search criteria, to restore. The latest version is displayed by default.

4. View a summary of your selections and then select the options to restore the selected objects.

5. You can specify which account or region, bucket, and storage class to restore the selected objects.

6. You can specify a prefix for the restored objects.

7. You can also choose to add custom tags to the restored objects.

8. Click Restore to restore the objects per your specifications.

Restore from a protection group using point-in-time recovery

1. From the Clumio navigation pane, go to AWS > Protect > S3 > Protection Groups.

2. Click the protection group to restore objects from.

3. On the asset details page, from the calendar, select a date with a complete backup.

   Two options are available: Restore Object and Restore Prefix/Buckets.

   If you choose the option to Restore Object the flow is the same as Restore from a Restore from a Protection group using Global Search above.

   If you choose the option to Restore Prefix/Buckets, you can select up to 50 buckets from the list (if you have that many available) to restore. Or you can click Next and set search criteria to restore all objects that match the selected search criteria.

4. Select the version to restore.

5. You can specify which account or region, bucket, and storage class to restore the selected objects from.

6. You can specify a prefix for the restored objects.

7. You can add custom tags to the restored objects.

8. Click Restore.

Clumio Backtrack

Clumio Backtrack is a recovery option for S3 buckets that have S3 Versioning enabled. Instead of copying data out to the Clumio backup vault, Backtrack operates on the version history that already exists in your bucket: it identifies the object versions or delete markers that correspond to a chosen point in time and applies the rollback in place. As a result, your data does not leave your AWS account, and rollback can be performed at scale without provisioning additional storage on the Clumio side.

Backtrack supports two recovery operations: Version rollback and Undo delete marker. Both are configured against a single bucket, and both can also be scoped to a prefix or to specific objects using the same filters as S3 SecureVault restore.

To use Backtrack, the protection group's assigned policy must include the S3 Backtrack operation. Once enabled, Clumio runs a daily Backtrack sync that indexes the bucket's version history. After the first sync completes, the Backtrack tab on the protection group details page and on the S3 bucket details page shows the bucket's current Backtrack state.

Version rollback

Version rollback restores a bucket, prefix, or selected objects to the state they had at a chosen point in time, by reapplying the matching object versions captured in the bucket's version history. You can roll back in place to the source bucket, or copy to a different destination bucket.

1. From the Clumio navigation pane, go to AWS > Protect > S3 > Protection Groups and click the protection group, or go to AWS > Inventory > S3 buckets and click the bucket.

2. Click the Backtrack tab.

3. Click Backtrack, and then select Version rollback.

4. If you started from a protection group, select the bucket to roll back. If you started from a bucket details page, the bucket is already selected.

5. Select the date and time to roll back to. Optionally, apply filters (for example, prefix, tags, storage class, and size) to narrow the rollback scope. The available filters are the same as for S3 SecureVault restore.

6. Optional. To see up to 100 of the target object versions that will be applied, click Preview.

7. Click Next and configure the rollback options as follows:

8. Destination: The source bucket (in-place) or a different bucket.

9. Storage class for the rolled-back objects.

10. Version. Latest version only or all versions (for prefix or bucket-scoped rollbacks).

11. Prefix for the destination objects.

12. Custom tags to add to the rolled-back objects.

13. Click Copy to start the rollback task. You can view the task on the Tasks page.

Undo delete marker

Undo delete marker reverses accidental or unwanted deletions in a versioned bucket by removing the delete markers introduced after the chosen point in time. The underlying object versions become the current versions of the objects again, restoring access without copying data.

1. From the Clumio navigation pane, go to AWS > Protect > S3 > Protection Groups and click the protection group, or go to AWS > Inventory > S3 buckets and click the bucket.

2. Click the Backtrack tab.

3. Click Backtrack, and then select Undo delete marker.

4. Select the date and time to undo to. Optionally, apply filters (for example, prefix and tags) to narrow the scope.

5. Optional. To see the delete markers that will be undone, click Preview.

6. Click Apply to start the undo task. You can view the task on the Tasks page.

S3 Instant Access (SecureVault Standard tier only)

With Instant Access endpoints, you can directly access backup data without having to perform a full restore. Access can be granted through either an IAM Role or a CloudFront Distribution, effectively proxying requests for efficient data retrieval. Whereas IAM Role access is appropriate for tightly controlled environments, CloudFront Distribution has the additional advantages of caching and reduced latency, for high-performance or geographically distributed access scenarios.

Create an S3 Instant Access endpoint from a scheduled backup

1. From the Clumio navigation pane, go to AWS > Inventory > S3 buckets.

2. Click the S3 bucket to access.

3. On the backup calendar, click a dot.

4. Click Restore, and then select Instant Access.

5. On the Filter objects (optional) screen, you can use filters to restore only some objects. To restore all objects in the bucket, click Skip. To view the first 100 results without filters, click Search.

6. On the Endpoint creation screen, enter a name for the endpoint.

7. For Versions to include, choose to include only the latest version of the objects or all versions.

8. Select a date for the expiration of the endpoint, from 5-30 days.

   Objects in the endpoint are retained until the endpoint expires or is deleted, which might differ from the retention for those objects that's specified in your S3 backup policies.

9. To view the number of objects that will be included in this endpoint and the number of credits per day the endpoint will cost, click Calculate object count and cost.

10. Click Create. You can view the endpoint creation task in on the Tasks page.

Create an S3 Instant Access endpoint from a point-in-time backup (continuous backups only)

If Continuous backup is enabled for an S3 bucket, you can create an Instant Access endpoint from a point-in-time backup.

1. From the Clumio navigation pane, go to AWS > Inventory > S3 buckets.

2. Click the S3 bucket to access.

3. In the upper-right area of the page, click Restore, and then select Instant Access.

4. Select a date. You can use filters to restore only some objects. To restore all objects in the bucket, click Skip. To view the first 100 results without filters, click Search.

5. Click Next.

6. On the Endpoint creation screen, enter a name for the endpoint.

7. For Versions to include, specify whether to include only the latest version of the objects or all versions.

8. Select a date for the expiration of the endpoint, from 5-30 days.

   Objects in the endpoint are retained until the endpoint expires or is deleted, which might differ from the retention for those objects in your S3 backup policies.

9. To view the number of objects and the credit cost per day, click Calculate object count and cost.

10. Click Create. You can view the endpoint creation task in on the Tasks page.

Access an S3 Instant Access endpoint using an IAM role

1. From the Clumio navigation pane, go to AWS > Inventory > S3 buckets.

2. Click the S3 bucket.

3. Under the backup calendar, click the Instant Access tab.

4. Click the Instant Access endpoint.

5. Click Add IAM role.

6. Copy the permissions policy.

7. In the AWS console, attach the policy as a custom inline policy to an IAM role, and then copy the role ARN.

8. Return to Clumio, paste the ARN, and then click Add.

Access an S3 Instant Access endpoint using a CloudFront distribution

1. From the Clumio navigation pane, go to AWS > Inventory > S3 buckets.

2. Under the backup calendar, click the Instant Access tab.

3. Click the Instant Access endpoint.

4. Click Add CloudFront distribution.

5. Copy the CloudFront distribution origin domain, and then click Next.

6. In the AWS console, go to CloudFront.

7. Select an existing CloudFront distribution or create a new one.

8. Paste the CloudFront distribution origin domain copied from Clumio.

9. Select Origin access control settings (recommended).

10. Click Create new OAC.

11. Leave Sign requests (recommended) selected.

12. Click Create.

13. Return to Clumio, paste the ARN, and then click Add.