Deploy Proxy EC2 with cryptography

[sarapinho]

Hello

I have VBR making backups of instances in AWS through the agent, these agents also truncate the logs, these backups go directly to S3.

I'm having difficulty enabling the archive in SOBR, when Veeam will deploy the ECS proxy.

Code: Select all

"eventTime": "2024-06-06T21:03:12Z",
    "eventSource": "ec2.amazonaws.com",
    "eventName": "RunInstances",
    "awsRegion": "sa-east-1",
    "sourceIPAddress": "x.x.x.x.x",
    "userAgent": "APN/1.0 Veeam/1.0 Backup/12.0 ClientSync",
    "errorCode": "Client.InvalidParameterValue",
    "errorMessage": "Value () for parameter groupId is invalid. The value cannot be empty",
    "requestParameters": {
        "instancesSet": {
            "items": [
                {
                    "imageId": "ami-xxxxxxx",
                    "minCount": 1,
                    "maxCount": 1,
                    "keyName": "KeyPair_"

Looking at the AWS log, Veeam tries to deploy ECS2 without encryption, is there any way for Veeam to upload this EC2 proxy with encryption or choose an existing encryption?

Case # 07277296

[Mildur]

Hello Amauri

ECS proxy

I assume you mean our Archiver Appliance.

Do you have "Always encrypt new EBS volumes" enabled in AWS?
If I remember correctly, our appliances should support EBS default encryption. But only the helper appliances (archiver, health check) we deploy.
While "Restore to EC2" with EBS encryption enabled is not possible (a limitation from AWS).

Please keep working with our customer support on that error message: "Value () for parameter groupId is invalid. The value cannot be empty".
Unfortunately, investigating it through a forum post is not possible.

Best,
Fabian

[sarapinho]

Hi Mildur,

Sorry for the delay, we are still in analysis with support, but without being able to make much progress.

Do you have "Always encrypt new EBS volumes" enabled in AWS?

Correct, all new EBS volumes must go up with the encrypted disks.

[Mildur]

Hi Amauri

Regarding my other comment, do you use a custom encryption keys for your forced EBS encryption?
If so, please test it with the additional IAM policy:

Code: Select all

"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey",
"kms:CreateGrant"

Best,
Fabian

[sarapinho]

Hi, Mildur

Thanks for the answer, I'll validate it and post it here again.