Data Backup

Use Cases

In the event of a hard drive failure or device theft, you can retrieve the latest data snapshot to minimize downtime and get employees back online quickly.
If data is encrypted by ransomware or files are maliciously deleted, clean data can be restored from previous backups, mitigating business impact.
When provisioning new devices or during employee transitions, critical data can be seamlessly transferred to the new hardware.

To back up business data, users must first configure a storage repository. Currently supported repositories include AWS S3, with Google Drive support coming soon. Follow the instructions below to configure your storage repository and initiate data backup.

Backup via AWS S3 Storage

AWS Configuration for CyStack Endpoint

Prerequisites: Ensure you have an account with appropriate permissions for IAM and S3 services. Generate a security key and run the following command to configure AWS CLI credentials, enabling the CLI to interact with AWS services:
```
aws configure
```
Replace the placeholders [USER_NAME], [REGION], [ACCOUNT_ID], [BUCKET_NAME], [ROLE_NAME], and [POLICY_NAME] with your actual values.

1. User

Create a new user:

aws iam create-user --user-name [USER_NAME]

Create an access key for the user:

aws iam create-access-key --user-name [USER_NAME]

{
    "AccessKey": {
        "AccessKeyId": "AKIA...",
        "SecretAccessKey": "wJalrX...",
        ...
    }
}

Verify user information:

aws iam get-user --user-name [USER_NAME]

Save the user arn from the output:

{
    "User": {
        "Path": "/",
        "UserName": "[USER_NAME]",
        "UserId": "AIA...",
        "Arn": "arn:aws:iam::[ACCOUNT_ID]:user/[USER_NAME]",
        "CreateDate": "2025-04-22T04:30:31Z"
    }
}

2. Bucket

Create a new bucket:

aws s3 mb s3://[BUCKET_NAME]

Enable versioning:

aws s3api put-bucket-versioning --bucket [BUCKET_NAME] --versioning-configuration Status=Enabled

The AWS value is the user ARN value in the previous section.

{
    "Version": "2012-10-17",
    "Id": "Policy1745394942216",
    "Statement": [
        {
            "Sid": "Stmt1745394940328",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::[ACCOUNT_ID]:user/[USER_NAME]"
            },
            "Action": [
                "s3:ListBucket",
                "s3:ListBucketVersions"
            ],
            "Resource": "arn:aws:s3:::[USER_NAME]"
        }
    ]
}

Attach the policy to the bucket:

aws s3api put-bucket-policy --bucket [BUCKET_NAME] --policy file://bucket-policy.json --region [REGION]

3. Create Necessary Roles

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::[ACCOUNT_ID]:user/[USER_NAME]"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

Windows
Linux & macOS

aws iam create-role ^
    --role-name [ROLE_NAME] ^
    --assume-role-policy-document file://trust-policy.json

aws iam create-role \
    --role-name [ROLE_NAME] \
    --assume-role-policy-document file://trust-policy.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectAttributes",
                "s3:GetObjectVersion",
                "s3:PutObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::[BUCKET_NAME]",
                "arn:aws:s3:::[BUCKET_NAME]/*"
            ]
        }
    ]
}

Create and attach the policy:

Windows
Linux & macOS

aws iam create-policy ^
    --policy-name [POLICY_NAME] ^
    --policy-document file://generic-backup-policy.json

aws iam attach-role-policy ^
    --role-name [ROLE_NAME] ^
    --policy-arn arn:aws:iam::[ACCOUNT_ID]:policy/[POLICY_NAME]

aws iam create-policy \
    --policy-name [POLICY_NAME] \
    --policy-document file://generic-backup-policy.json

aws iam attach-role-policy \
    --role-name [ROLE_NAME] \
    --policy-arn arn:aws:iam::[ACCOUNT_ID]:policy/[POLICY_NAME]

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::[ACCOUNT_ID]:role/[ROLE_NAME]"
        }
    ]
}

Windows
Linux & macOS

aws iam put-user-policy ^
    --user-name [USER_NAME] ^
    --policy-name STSPolicy ^
    --policy-document file://central-server-policy.json

aws iam put-user-policy \
    --user-name [USER_NAME] \
    --policy-name STSPolicy \
    --policy-document file://central-server-policy.json

4. Configure Connection from CyStack Endpoint to Storage Repository

Data within the enterprise drives on selected devices will be automatically backed up every 6 hours. The backup process supports the following file types: .doc, .docx, .odt, .ott, .pages, .xls, .xlsx, .csv, .ods, .numbers, .pdf, .ppt, .pptx, .odp, .key

Data Recovery

In the event of device failure or data loss due to ransomware, business users can request the Workspace Owner or Administrator to restore their data. The Owner or Administrator should follow these steps to initiate recovery:

Overview

Asset & Device Management

Access Control & Identity Management

Data Protection

Policy Management

Activity History Management

Backup via AWS S3 Storage

AWS Configuration for CyStack Endpoint

1. User

2. Bucket

3. Create Necessary Roles

4. Configure Connection from CyStack Endpoint to Storage Repository

Data Recovery

Overview

Asset & Device Management

Access Control & Identity Management

Data Protection

Policy Management

Activity History Management

​Backup via AWS S3 Storage

​AWS Configuration for CyStack Endpoint

​1. User

​2. Bucket

​3. Create Necessary Roles

​4. Configure Connection from CyStack Endpoint to Storage Repository

​Data Recovery

Backup via AWS S3 Storage

AWS Configuration for CyStack Endpoint

1. User

2. Bucket

3. Create Necessary Roles

4. Configure Connection from CyStack Endpoint to Storage Repository

Data Recovery