Restore a Compute Engine instance from a backup vault

Preview

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

This page helps you to restore a Compute Engine instance from a backup vault in the Google Cloud console.

Before you begin

Grant the following roles for the backup vault service agent of the vault in the target project where restore is being performed.

• Compute instance admin (v1) (roles/compute.instanceAdmin.v1)
• Service Account User (roles/iam.serviceAccountUser)

Grant the following role for the backup vault service agent of the vault in the VPC host project if you are using Shared VPC.

• Compute Network User (roles/compute.networkUser)

Grant the following roles for the user who performs the restore in the backup vault project.

• Backup and DR Restore User (roles/backupdr.restoreUser) for both backup vault and target project.
• Compute Viewer (roles/compute.viewer) for only the target.

These predefined roles contain the permissions required to access the backup vault in the Compute Engine project. For specific permissions, see the following list.

• backupdr.bvbackups.restore
• backupdr.compute.restoreFromBackupVault
• backupdr.backupVaults.get
• backupdr.backupVaults.list
• backupdr.bvbackups.list
• backupdr.bvdataSources.get
• backupdr.bvdataSources.list
• backupdr.bvbackups.get

For more information about granting roles, see Manage access to projects, folders, and organizations.

Restore a Compute Engine instance

Use the following instructions to restore a VM instance.

Console

1. In the Google Cloud console, go to the Vaulted Resources page. All Compute Engine instances with vaulted backups are listed here.
2. Click the action icon to select the Restore action. The Restore page displays where you select the following restore options:
   • Select a Resource name.
   • Select a Backup creation time.
   • Select the Project name into which you want to restore the VM.
3. Click Proceed.
   • The next page Create a new VM instance from a backup appears, where the VM properties are pre-populated based on the source VM properties. You can modify the properties to create a new VM, for example, change the selection for Region or Machine Type.

4. Click Create to create a new VM from the selected backup.

   Note: You can view and monitor the restore jobs in the Backup and DR > Jobs page.

gcloud

1. If not already granted, add the roles compute.instanceAdmin.v1 and serviceAccountUser role to the backup vault service account in the recovery project where the VM is being recovered.

   gcloud alpha projects add-iam-policy-binding --member=MEMBER
   --role=ROLE
   Replace the following:

   • MEMBER: the name of service account user you want assigned to the service account role.
   • ROLE: the service account role.

2. To get the backup vault service account, use the following command.

   gcloud alpha backup-dr backup-vaults describe BACKUPVAULT_NAME --location=LOCATION \

   Replace the following:

   • LOCATION: the location of the backup vault.

Example: Restore a VM in the same project as the workload project with backup ID:

gcloud alpha backup-dr backups restore compute test-backup-id
    --project=PROJECT \ --location=LOCATION \
    --backup-vault=BACKUPVAULT_NAME \ --data-source=DATA_SOURCE\
    --name=NAME \ --target-zone=TARGET_ZONE \
    --target-project=TARGET_PROJECT \

Example: Restore a VM in the same project as the workload project with backup full resource UR

gcloud alpha backup-dr backups restore compute projects/test-project-id/locations/us-central1/
     backupVaults/test-vault/dataSources/test-ds/backups/test-backup-id
    --name=NAME \ --target-zone=TARGET_ZONE \
    --target-project=TARGET_PROJECT \

Example: Restore a VM instance with custom service-account and network configuration.

gcloud alpha backup-dr backups restore compute test-backup-id \
    --project=PROJECT \ --location=LOCATION \
    --backup-vault=BACKUPVAULT_NAME \ --data-source=DATA_SOURCE\
    --name=NAME \ --target-zone=TARGET_ZONE \
    --target-project=TARGET_PROJECT \
    --network-interface network=NETWORK \ --subnet=SUBNET \ --service-account=SERVICE_ACCOUNT \
    --scopes=SCOPE \

Replace the following:

• PROJECT: the name of the backup vault project.
• LOCATION: the location of the backup vault.
• BACKUP-VAULT: the backup vault name you want to restore data from.
• DATA-SOURCE: the data source name you want to restore data from.
• NAME: the name of the restored VM.
• TARGET-ZONE: the region the VM is restored in.
• TARGET-PROJECT: the project the VM is restored in.
• NETWORK: the network URI of the VM.
• SUBNET: the subnet URI of the VM.
• SERVICE ACCOUNT: the service account of the restored VM.
• SCOPES: the authorization scope of the service account.

To override other VM properties, see Overview of Backup and DR Service Google Cloud CLI commands.

The Backup and DR Compute Engine guide

• Create and manage a backup plan for vaulted backups
• Check for the cloud credentials
• Discover and protect Compute Engine instances
• Mount backup images of Compute Engine Persistent Disk
• Restore a Compute Engine instance
• Import Persistent Disk snapshot images