Evomedia.net

The natural evolution of your business.

Kelly Michels 5 min read AWS

AWS EC2 Recovery

Two-layer backup: EBS AMI + configuration exports.

When an EC2 instance disappears, you need both the disk (data) and the wiring (network, security, IAM). Here's how to back up both with one recoverable image and a set of configuration reference files.

The problem: disk ≠ deployment

EC2 instances seem stable — until they're not. A corrupted volume, a failed host migration, a platform outage, or an accidental termination leaves you staring at a missing instance. You know you should have backed it up, but what exactly does "backed up" mean for an EC2 instance?

A naive answer is "take a disk snapshot." But a disk snapshot only captures the machine — it doesn't capture how the machine was wired:

  • What VPC and subnet was it in?
  • Which security group(s) allowed traffic?
  • What IAM role gave it permissions?
  • Was there an Elastic IP associated?
  • What was the key pair for SSH access?

If your instance disappears and you restore the disk without the wiring, you're launching into a broken network — or you have to guess at all the settings. The real solution is a two-layer backup: one layer for the machine (disk), one layer for the deployment (network, security, IAM).

Two-layer backup strategy

Layer What it captures Restore mechanism Cost
Layer 1: EBS AMI Disk contents (OS, apps, data, configs) Launch a new instance from the AMI EBS snapshot storage (~$0.05/GB/month)
Layer 2: Config JSON VPC, subnet, security groups, IAM role, key pair, Elastic IP, tags, instance type Reference files for manual or scripted recreation Free (local storage)

Layer 1 is the restorable backup. Layer 2 is the reference documentation. Together, they let you recover fully — disk, wiring, and all — in minutes.

Layer 1 — Creating an EBS AMI

An AMI (Amazon Machine Image) is a snapshot of a running instance that you can use to launch a new instance identical to the original. AWS stores the snapshot as an EBS snapshot under the hood, and you can launch from the AMI anytime — even months later.

Creating an AMI is simple: 

aws ec2 create-image \
  --instance-id i-xxxxxxxxxxxxxxxx \
  --name "my-instance-backup-$(date +%Y-%m-%d_%H-%M-%S)" \
  --description "Automated backup of my-instance" \
  --region us-east-1

AWS will output an AMI ID like ami-xxxxxxxxxxxxxxxx. The image creation runs in the background — your instance keeps running, but you have the option to allow it to reboot for a more consistent snapshot (recommended for production).

Once the AMI reaches available status (check the EC2 console or query the API), you can launch a new instance from it at any time: 

aws ec2 run-instances \
  --image-id ami-xxxxxxxxxxxxxxxx \
  --instance-type t3.medium \
  --key-name my-key-pair \
  --security-group-ids sg-12345678 \
  --subnet-id subnet-abcdef12 \
  --iam-instance-profile Name=my-iam-role \
  --region us-east-1

The new instance launches with the exact same disk, apps, and data as the original — and you associate the Elastic IP to get the same public address back.

Cost note: EBS snapshots cost ~$0.05/GB/month in most regions. A 25 GB instance runs about $1.25/month in backup storage. That's cheap insurance against data loss or platform failures.

Layer 2 — Exporting configuration as JSON

The AMI restores the disk, but you still need the deployment context. Export the full configuration of your instance to a set of JSON files that document every setting: 

# Instance config (full details)
aws ec2 describe-instances \
  --instance-ids i-xxxxxxxxxxxxxxxx \
  --region us-east-1 \
  --output json > instance_config.json

# Security group rules
aws ec2 describe-security-groups \
  --group-ids sg-12345678 \
  --region us-east-1 \
  --output json > security_group.json

# EBS volumes
aws ec2 describe-volumes \
  --filters "Attachment.InstanceId=i-xxxxxxxxxxxxxxxx" \
  --region us-east-1 \
  --output json > ebs_volumes.json

# Elastic IP association
aws ec2 describe-addresses \
  --region us-east-1 \
  --output json > elastic_ips.json

# IAM instance profile
aws iam get-instance-profile \
  --instance-profile-name my-iam-role \
  --output json > iam_role.json

# VPC and subnet
aws ec2 describe-vpcs \
  --vpc-ids vpc-12345678 \
  --region us-east-1 \
  --output json > vpc.json

aws ec2 describe-subnets \
  --subnet-ids subnet-abcdef12 \
  --region us-east-1 \
  --output json > subnet.json

Store these files in a safe location (local backup folder, git repo, S3, or all three). When you need to recover, these files become your wiring blueprint — you can reference them to recreate the instance settings, or use them to verify the new instance is correctly configured.

The JSON includes every detail: inbound/outbound rules, volume attachment points, IAM permissions, DNS names, tags, and more. No guessing.

Recovery: restore from backup

If your instance disappears, here's the recovery path:

Step 1 — Launch from AMI

  1. Go to EC2 → AMIs in the AWS console.
  2. Find your backup AMI by name or ID.
  3. Click Launch instance from AMI.
  4. Configure:
    • Instance type: match the original (check instance_config.json for the exact type)
    • VPC / Subnet: same as original (from vpc.json, subnet.json)
    • Security group: same as original (from security_group.json)
    • Key pair: same as original (from instance_config.json)
    • IAM instance profile: same as original (from iam_role.json)
  5. Launch the instance.

Step 2 — Restore the Elastic IP

Once the new instance is running:

  1. Go to EC2 → Elastic IPs.
  2. Find your static IP (from elastic_ips.json).
  3. Click Associate address.
  4. Select the new instance and confirm.

Your instance now has the same public IP as before — DNS records pointing to that IP remain valid, and external systems see no interruption.

That's it

The new instance boots with all your data, apps, and configs intact. You're back online in 5–10 minutes, with no manual rebuild or guessing.

← Back to Blog · Contact