Skip to content

Improving Amazon EBS Backups Using EBS Direct APIs

EBS direct APIs can help eliminate temporary EC2 instances from your backup workflow and speed up incremental backups by reading only the blocks that changed.

Autor no LinkedIn
Vir Choksi, Gerente Principal de Marketing de Produto da Commvault
Publicado

Pontos principais

As APIs diretas do EBS mudam radicalmente a forma como os backups do Amazon EBS funcionam — veja a seguir os pontos principais.

  • Ganhos de velocidade por meio do rastreamento de blocos alterados: as APIs diretas do EBS minimizam a necessidade de ler volumes inteiros durante as operações de backup. Ao utilizar o ListChangedBlocks para identificar apenas os dados modificados desde o último snapshot, o Clumio transfere uma quantidade muito menor de dados, de modo que os backups incrementais são concluídos mais rapidamente.
  • Economia de custos com a eliminação de infraestrutura temporária: os fluxos de trabalho tradicionais de backup do Amazon EBS exigem a ativação de instâncias temporárias do EC2. As APIs diretas do EBS permitem que você leia blocos de snapshot diretamente por HTTPS. Os clientes da Clumio podem obter uma redução média de mais de 30% no custo total de propriedade (TCO) do backup.
  • Mecânicas de API que simplificam o acesso aos dados: Três APIs principais impulsionam o fluxo de trabalho: a ListSnapshotBlocks identifica todos os blocos em um snapshot, a ListChangedBlocks revela as alterações delta entre os snapshots e a GetSnapshotBlock recupera blocos individuais de 512 KiB.
  • Integração com o Clumio para proteção automatizada: o Clumio da Commvault utiliza APIs diretas do EBS em sua estrutura de backup orientada por políticas, detectando automaticamente volumes do EBS, agendando snapshots e transferindo blocos alterados para um cofre isolado da rede.
  • Não são necessárias instâncias temporárias do EC2: as APIs diretas do EBS se comunicam diretamente com o serviço de snapshots por HTTPS, reduzindo os custos de computação, a latência de inicialização e a complexidade operacional do provisionamento de infraestrutura temporária para tarefas de backup.
  • Paralelismo em escala empresarial: a AWS permite, por padrão, até 1.000 solicitações simultâneas de GetSnapshotBlock por conta, possibilitando backups de EBS em grande escala em centenas de volumes, reduzindo assim os gargalos na infraestrutura.

Você gerencia centenas de volumes do Amazon EBS em várias contas da AWS. Todas as noites, suas tarefas de backup são iniciadas e, todas as manhãs, você verifica os resultados: alguns volumes foram concluídos a tempo, outros ultrapassaram o tempo limite, e sua conta de nuvem não para de subir. O culpado é um fluxo de trabalho de backup que inicia instâncias temporárias do EC2, anexa volumes de snapshot, lê cada bloco — mesmo aqueles que não sofreram alterações — e, em seguida, encerra tudo. É lento, caro e operacionalmente frágil. E se você pudesse ler os dados do snapshot diretamente, sem a infraestrutura temporária? E se sua solução de backup pudesse identificar exatamente quais blocos foram alterados e recuperar apenas esses? É isso que as APIs diretas do EBS tornam possível – e o que a Clumio incorporou à sua plataforma de proteção de dados nativa da nuvem.

As APIs diretas do EBS — especificamente ListSnapshotBlocks, ListChangedBlocks e GetSnapshotBlock — permitem que aplicativos de backup leiam dados de snapshot diretamente por HTTPS, sem a necessidade de montar volumes em instâncias do EC2. O Clumio da Commvault integra essas APIs para realizar backups incrementais orientados por políticas, que transferem apenas os blocos alterados para um cofre isolado, reduzindo tanto o custo quanto a duração do backup.

30%

Up to 30% lower backup TCO (based on average customer experience)

30%

Clumio customers achieve 30%+ lower backup TCO on average, driven by eliminating temporary EC2 instances and transferring only changed blocks instead of full volumes. This is an overall customer backup-TCO average across AWS workloads.

Clumio AWS Cost Optimization, 2025

What Are EBS Direct APIs?

Amazon introduced EBS direct APIs in 2019 to give developers and backup vendors programmatic access to EBS snapshot data. Before these APIs existed, the only way to read data from a snapshot was to restore it to a new volume, attach that volume to an EC2 instance, and then read the blocks through the operating system.

EBS direct APIs change the model entirely. Instead of mounting volumes, you make HTTPS requests to retrieve snapshot metadata and block-level data. Three APIs form the foundation of this capability: ListSnapshotBlocks returns all block indexes and tokens for a snapshot, ListChangedBlocks compares two snapshots and returns only blocks that differ (enabling changed-block tracking), and GetSnapshotBlock retrieves the actual 512 KiB block data. Together, these APIs enable a fundamentally different backup architecture where your application communicates directly with the EBS snapshot service.

  • ListSnapshotBlocks: Returns a list of all block indexes and block tokens for a given snapshot. Each EBS snapshot is divided into 512 KiB blocks, and this API tells you which blocks contain data.
  • ListChangedBlocks: Compares two snapshots and returns only the blocks that differ between them. This is the core of changed-block tracking (CBT) for EBS — enabling true incremental backups without reading the entire volume.
  • GetSnapshotBlock: Retrieves the actual data for a specific block, identified by its block index and block token. You call this API repeatedly to download the blocks you need.
  • Concurrent request scaling: AWS allows up to 1,000 concurrent GetSnapshotBlock requests per account by default, making large-scale EBS backup feasible without temporary infrastructure. For more details, see thedocumentação das APIs diretas do EBS. You can also integrate these APIs into serverless workflows usingdo AWS Lambda.

How Clumio by Commvault Uses EBS Direct APIs

Clumio integrates EBS direct APIs into its SaaS-based data protection platform, minimazing the need for you to manage backup infrastructure or write custom scripts. When you connect your AWS account to Clumio, the platform automatically discovers your EBS volumes and applies protection policies based on your configuration.

After the initial full backup, every subsequent backup job calls ListChangedBlocks to identify only the blocks that changed since the previous snapshot. Clumio then calls GetSnapshotBlock for just those blocks, transferring a fraction of the data compared to a full read. The data path from EBS snapshot to Clumio vault uses the direct APIs exclusively — no temporary volumes, no intermediate storage.

  • Policy-driven scheduling:Define backup frequency, retention periods, and recoveryobjetivoswithout touching individual volumes. Clumio’s scheduler initiates EBS snapshots according to your policies, then uses the direct APIs to retrieve snapshot data.
  • Incremental detection viaListChangedBlocks:After theinitialfull backup, everysubsequentjobtransfersonly changed blocks, reducing both backup time and data transfer costs.
  • Protectedtransfer to an air-gapped vault: Clúmiostores backup data in an isolated environment outside your AWS account, with immutable retention policies and encryption at rest, protecting against ransomware and account compromise.
  • No temporary EC2 instances: Da Clumio’sarchitecture handlesAPI calls from its managed infrastructure, scaling automatically with your data volume. You pay forDa Clumio’sservice and AWS API calls, but not for EC2 hours or EBS volume attachments during backup.
  • Multi-workload coverage:Use the same policies and console to protect
  • Amazon EC2 and EBS,Amazon RDSdatabases,Amazon S3buckets, andDynamoDBtables. The platform deploys usingdo AWS CloudFormationtemplates,establishingthe necessary IAM roles and permissions.

Configuration and Setup

Deploying Clumio for EBS backup requires IAM permissions, optional VPC endpoint configuration, and a CloudFormation stack that establishes the connection between your AWS account and Clumio’s service.

Clumio’s CloudFormation template creates an IAM role with the required permissions — including ec2:CreateSnapshot, ec2:DescribeSnapshots, ebs:ListSnapshotBlocks, ebs:ListChangedBlocks, and ebs:GetSnapshotBlock — scoped to the resources you want to protect. You can deploy the same template to multiple accounts usingdo AWS CloudFormation StackSets, whichtypically deploy each stack instance in two to three minutes,for centralized management. After deployment, you configure protection policies in the Clumio console defining which EBS volumes to protect, how frequently to back up, and how long to retain data.

  • IAM permissions for EBS direct API calls: The required permissions include ec2:CreateSnapshot, ec2:DescribeSnapshots, ebs:ListSnapshotBlocks, ebs:ListChangedBlocks, and ebs:GetSnapshotBlock. You can review and customize the role before deployment.
  • VPC endpoint configuration: Optional but recommended for organizations with strict network security requirements. Creating a VPC endpoint for the EBS direct APIs (service name: com.amazonaws.region.ebs) keeps all API traffic within the AWS network.
  • CloudFormation deployment: The template provisions an IAM role, optional SNS topics for event notifications, and the cross-account trust relationship that allows Clumio to assume the role.
  • Auto Scaling Group awareness: ConfigureGrupo de Autoescalonamento do EC2awareness so Clumio automatically protects new volumes as instances scale out.

Integration Ecosystem

  • AWS CloudFormation (Deployment):Automates IAM role creation, SNS topics, and cross-account trust setup forClúmio— enabling infrastructure-as-code deployment across multiple AWS accounts.
  • AWS Lambda (Orchestration):Provides serverlesscalcularfor custom EBS direct API workflows, allowing event-driven backup triggers without persistent infrastructure.
  • Amazon RDS (Workload): Clúmioextends the same policy-driven backup model to Amazon RDS databases, offering unified data protection across compute and database services. 

Before and After: Workflow Architecture

  • Traditional Workflow (Before EBS Direct APIs): First, you create a snapshot of the EBS volume using ec2:CreateSnapshot. Next, you launch a temporary EC2 instance in the same availability zone, create a new EBS volume from the snapshot, and attach and mount the volume through the operating system. Then, a backup agent reads all blocks from the mounted volume — even unchanged data — and transfers the data to your backup repository. Finally, you detach, delete, and terminate the temporary volume and EC2 instance. This workflow has obvious problems: EC2 instance costs, EBS volume costs, startup latency, and the inefficiency of reading unchanged blocks.
  • Direct API Workflow (After EBS Direct APIs): First, you create a snapshot of the EBS volume, just as before. Next, ListChangedBlocks compares the new snapshot with the previous one, returning only the block indexes that differ. Then, GetSnapshotBlock retrieves the 512 KiB block data for each changed block directly over HTTPS. Finally, you transfer the changed blocks to your backup vault — data transfer volume is a fraction of the full volume size. No EC2 instance. No temporary volume. No operating system mount. No reading unchanged data. — For a 1 TB EBS volume with 5% daily change rate, the traditional workflow reads 1 TB every backup. The direct API workflow reads approximately 50 GB — a substantial difference that compounds monthly.

Before: EBS volume to snapshot to temporary EC2 instance to backup repository.

Figure 1: EBS backup workflow before EBS direct APIs showing elimination of temporary EC2 instances

After: EBS volume to snapshot to direct API calls to backup vault.

Figure 2: EBS backup workflow after EBS direct APIs showing elimination of temporary EC2 instances

 

Outcome Summary / Value Recap

By integrating EBS direct APIs, Clumio can help reduce cost and improve performance for Amazon EBS backup. Removing temporary EC2 instances and reading only changed blocks may lower backup costs and speed up incremental backups. Clumio customers may achieve up to 30% lower backup TCO on average.ExplorarRecuperação de ransomwareeRecuperação Operacionalto learn how Clumio helps you recover from real-world incidents.

Perguntas frequentes

What are EBS direct APIs and how do they improve Amazon EBS backups?

EBS direct APIs are a set of Amazon Web Services APIs that provide programmatic access to EBS snapshot data without requiring you to mount the snapshot to an EC2 instance. Introduced in 2019, these APIs let backup applications read snapshot blocks directly over HTTPS, enabling faster and more cost-effective backup workflows. For full documentation, see theEBS direct API docs.

Which EBS direct APIs are used for backup operations?

Three APIs are essential for backup operations. ListSnapshotBlocks returns the list of all blocks in a snapshot. ListChangedBlocks compares two snapshots and returns only the blocks that differ, enabling incremental backups. GetSnapshotBlock retrieves the actual 512 KiB block data. Together, these APIs support full and incremental backup strategies without temporary infrastructure.

How much faster are EBS backups with direct APIs compared to traditional methods?

EBS direct API-based backups complete faster than traditional mount-and-read workflows because they read only the blocks that changed. ListChangedBlocks identifies the modified blocks since the last snapshot, so Clumio transfers a fraction of the data and avoids the startup latency of provisioning temporary EC2 instances. The relative gain grows for large volumes with low change rates, where reading the full volume on every backup wastes the most time.

How does Clumio’s EBS backup compare to AWS Backup?

AWS Backup provides native snapshot management but does not use EBS direct APIs for data retrieval — it relies on standard snapshot copy operations. Clumio uses direct APIs to perform incremental block-level backups, stores data in an air-gapped vault outside your AWS account, and provides granular recovery options including cross-account and cross-region restore. For organizations requiring ransomware-resistant backup architecture,Clúmiooffers capabilities beyond native AWS services.

Do I need a VPC endpoint for EBS direct APIs?

A VPC endpoint is optional but recommended for organizations with strict network security requirements. Creating an interface endpoint for the EBS service (com.amazonaws.region.ebs) keeps API traffic within the AWS network, avoiding public internet routing. This also simplifies firewall rules and reduces data transfer costs for cross-AZ traffic. Clumio’s managed infrastructure handles API calls, so the endpoint configuration applies to your account’s network policies.

How does Clumio handle EBS backup costs?

Clumio can help reduce EBS backup costs through three mechanisms: eliminating temporary EC2 instances, transferring only changed blocks instead of full volumes, and automating snapshot lifecycle management. Internal benchmarks indicate up to a 30% cost reduction compared to traditional backup workflows. For more details on cost optimization, seeAWS Cost Optimization.

Explore Clumio for Amazon EC2 and EBS

Ready to simplify your Amazon EBS backup strategy while reducing costs and improving recovery speed?

Experimente na AWS Explore Clumio for EC2 and EBS

  • Apoia a preparação para auditorias

  • Cloud

  • Simplifica a conformidade