Fjall Docs — Deploy Production-Ready AWS Infrastructure in Minutes

Overview

fjall restore restores AWS resources from AWS Backup recovery points. It supports S3 buckets, EBS volumes, RDS databases, and EC2 instances.

Usage

fjall restore [resource] [options]

Arguments

Argument	Description	Required
`resource`	Resource type to restore: `s3`, `ebs`, `rds`, or `ec2`	No (interactive picker if omitted)

Options

Option	Description	Example
`--recovery-point <arn>`	Recovery point ARN (required in non-interactive mode)	`--recovery-point arn:aws:backup:...`
`-n, --name <name>`	Name for the restored resource	`--name restored-db`
`-y, --yes`	Skip the dry-run and start the restore immediately	`-y`
`-v, --verbose`	Enable verbose logging	`-v`
`--non-interactive`	Force plain CLI output (no interactive UI)	`--non-interactive`

Agent flags

These flags shape output for AI-agent and scripted callers.

Flag	Description
`--agent`	Enable agent output mode
`--budget <level>`	Output budget: `minimal`, `compact`, or a token count
`--fields <fields>`	Request additional fields in output
`--full`	Disable content truncation

Resource Types

S3 Bucket

Restore an S3 bucket from backup:

fjall restore s3 --recovery-point arn:aws:backup:ap-southeast-2:123456789:recovery-point:abc-123

EBS Volume

Restore an EBS volume:

fjall restore ebs --recovery-point arn:aws:backup:ap-southeast-2:123456789:recovery-point:abc-123

RDS Database

Restore an RDS instance or Aurora cluster:

fjall restore rds --recovery-point arn:aws:backup:ap-southeast-2:123456789:recovery-point:abc-123

AWS Backup restores run outside CloudFormation, so the restored database keeps the master password from when the snapshot was taken — it is not reset to the current Secrets Manager value. Reconcile credentials before applications connect: reset the database master password to match the secret, or update the secret to the snapshot-era password.

EC2 Instance

Restore an EC2 instance:

fjall restore ec2 --recovery-point arn:aws:backup:ap-southeast-2:123456789:recovery-point:abc-123

Interactive Mode

Run fjall restore with no recovery point to walk through a guided picker chain:

fjall restore

The picker steps through:

Resource category (What type of resource would you like to restore?): Compute or Storage.
Resource type (Select compute resource type: for EC2, or Select storage resource type: for S3, EBS, RDS).
Backup vault (Select backup vault (N available):): each vault shows its recovery-point count.
Resource (Select resource to restore (N available):): shows the backup count and latest backup date.
Recovery point (Select a backup to restore (N available for <resource>):): the most recent backup is labelled (Latest).
Confirmation (Start restore job?): shown after a summary of the restore.

RDS restores additionally prompt for the DB instance name and port before the confirmation step. Once confirmed, the restore job starts and the CLI prints the job ID and a console link to track progress:

Restoring RDS from AWS Backup
  Recovery Point: arn:aws:backup:ap-southeast-2:123456789:recovery-point:abc-123

  Starting restore job...
  Restore job ID: A1B2C3D4-5678-90AB-CDEF-EXAMPLE11111

Restore job started successfully!

Next steps:
  • View progress: https://console.aws.amazon.com/backup/home?region=ap-southeast-2#/jobs

Important (RDS):
  • The restored database keeps the password from when the snapshot was taken — it is NOT reset to the current Secrets Manager value. Reconcile credentials before applications connect (reset the DB master password to match the secret, or update the secret to the snapshot-era password).

Non-Interactive Mode

For CI/CD or scripting, pass every required option and --yes to skip the dry-run:

fjall restore rds \
  --recovery-point arn:aws:backup:ap-southeast-2:123456789:recovery-point:abc-123 \
  --yes \
  --non-interactive

Finding Recovery Points

Find recovery points in:

AWS Console: Backup > Protected resources > select a resource.

AWS CLI:

aws backup list-recovery-points-by-resource \
  --resource-arn arn:aws:rds:ap-southeast-2:123456789:db:myapp-database

Post-Restore Steps

After a restore completes:

Verify the restored resource in the AWS Console.
Update application configuration if the restored resource has a new name or endpoint.
Reconcile database credentials (RDS only) — the restored database keeps the snapshot-era master password, not the current Secrets Manager value.

Importing an existing AWS resource back into a Fjall application (fjall import) is not yet available. Track restored resources manually until import ships.

Troubleshooting

Permission Denied

Error: Access denied

Ensure you have the following permissions:
  - backup:StartRestoreJob
  - iam:PassRole (for the restore role)

Solution: Grant your IAM role the AWS Backup permissions listed in Required Permissions.

Recovery Point Not Found

Error: Recovery point not found

Verify the recovery point ARN is correct

Solution: Confirm the ARN is valid and the recovery point exists:

aws backup describe-recovery-point \
  --backup-vault-name Default \
  --recovery-point-arn arn:aws:backup:...

Restore Failed

If a restore job fails, check the AWS Backup console for details:

Go to AWS Console > Backup > Jobs.
Find the failed job.
Read the status message for the failure reason.

Required Permissions

The restore command requires these IAM permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "backup:StartRestoreJob",
        "backup:DescribeRestoreJob",
        "backup:ListRecoveryPointsByResource"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::*:role/AWSBackupDefaultServiceRole"
    }
  ]
}

Next Steps

fjall list

List the resources defined in an application’s infrastructure.

fjall deploy

Deploy application changes to AWS.

fjall tunnel

Open a secure tunnel to a restored database.

fjall connect

Connect an AWS account before restoring its resources.

Core Commands

Infrastructure Codemods

Management Commands

Authentication

Agent Mode

fjall restore

Overview

Usage

Arguments

Options

Agent flags

Resource Types

S3 Bucket

EBS Volume

RDS Database

EC2 Instance

Interactive Mode

Non-Interactive Mode

Finding Recovery Points

Post-Restore Steps

Troubleshooting

Permission Denied

Recovery Point Not Found

Restore Failed

Required Permissions

Next Steps

fjall list

fjall deploy

fjall tunnel

fjall connect

​Overview

​Usage

​Arguments

​Options

​Agent flags

​Resource Types

​S3 Bucket

​EBS Volume

​RDS Database

​EC2 Instance

​Interactive Mode

​Non-Interactive Mode

​Finding Recovery Points

​Post-Restore Steps

​Troubleshooting

​Permission Denied

​Recovery Point Not Found

​Restore Failed

​Required Permissions

​Next Steps

fjall list

fjall deploy

fjall tunnel

fjall connect

Overview

Usage

Arguments

Options

Agent flags

Resource Types

S3 Bucket

EBS Volume

RDS Database

EC2 Instance

Interactive Mode

Non-Interactive Mode

Finding Recovery Points

Post-Restore Steps

Troubleshooting

Permission Denied

Recovery Point Not Found

Restore Failed

Required Permissions

Next Steps