What Are EBS Direct APIs?

Amazon introduced EBS direct APIs in 2019 to give developers and backup vendors programmatic access to EBS snapshot data. Before these APIs existed, the only way to read data from a snapshot was to restore it to a new volume, attach that volume to an EC2 instance, and then read the blocks through the operating system.

EBS direct APIs change the model entirely. Instead of mounting volumes, you make HTTPS requests to retrieve snapshot metadata and block-level data. Three APIs form the foundation of this capability: ListSnapshotBlocks returns all block indexes and tokens for a snapshot, ListChangedBlocks compares two snapshots and returns only blocks that differ (enabling changed-block tracking), and GetSnapshotBlock retrieves the actual 512 KiB block data. Together, these APIs enable a fundamentally different backup architecture where your application communicates directly with the EBS snapshot service.

• ListSnapshotBlocks: Returns a list of all block indexes and block tokens for a given snapshot. Each EBS snapshot is divided into 512 KiB blocks, and this API tells you which blocks contain data.
• ListChangedBlocks: Compares two snapshots and returns only the blocks that differ between them. This is the core of changed-block tracking (CBT) for EBS — enabling true incremental backups without reading the entire volume.
• GetSnapshotBlock: Retrieves the actual data for a specific block, identified by its block index and block token. You call this API repeatedly to download the blocks you need.
• Concurrent request scaling: AWS allows up to 1,000 concurrent GetSnapshotBlock requests per account by default, making large-scale EBS backup feasible without temporary infrastructure. For more details, see thedocumentazione relativa alle API dirette di EBS. You can also integrate these APIs into serverless workflows usingAWS Lambda.

How Clumio by Commvault Uses EBS Direct APIs

Clumio integrates EBS direct APIs into its SaaS-based data protection platform, minimazing the need for you to manage backup infrastructure or write custom scripts. When you connect your AWS account to Clumio, the platform automatically discovers your EBS volumes and applies protection policies based on your configuration.

After the initial full backup, every subsequent backup job calls ListChangedBlocks to identify only the blocks that changed since the previous snapshot. Clumio then calls GetSnapshotBlock for just those blocks, transferring a fraction of the data compared to a full read. The data path from EBS snapshot to Clumio vault uses the direct APIs exclusively — no temporary volumes, no intermediate storage.

• Policy-driven scheduling:Define backup frequency, retention periods, and recoveryobiettiviwithout touching individual volumes. Clumio’s scheduler initiates EBS snapshots according to your policies, then uses the direct APIs to retrieve snapshot data.
• Incremental detection viaListChangedBlocks:After theinitialfull backup, everysubsequentjobtransfersonly changed blocks, reducing both backup time and data transfer costs.
• Protectedtransfer to an air-gapped vault: Clumiostores backup data in an isolated environment outside your AWS account, with immutable retention policies and encryption at rest, protecting against ransomware and account compromise.
• No temporary EC2 instances: Clumio’sarchitecture handlesAPI calls from its managed infrastructure, scaling automatically with your data volume. You pay forClumio’sservice and AWS API calls, but not for EC2 hours or EBS volume attachments during backup.
• Multi-workload coverage:Use the same policies and console to protect
• Amazon EC2 and EBS,Amazon RDSdatabases,Amazon S3buckets, andDynamoDBtables. The platform deploys usingAWS CloudFormationtemplates,establishingthe necessary IAM roles and permissions.

Configuration and Setup

Deploying Clumio for EBS backup requires IAM permissions, optional VPC endpoint configuration, and a CloudFormation stack that establishes the connection between your AWS account and Clumio’s service.

Clumio’s CloudFormation template creates an IAM role with the required permissions — including ec2:CreateSnapshot, ec2:DescribeSnapshots, ebs:ListSnapshotBlocks, ebs:ListChangedBlocks, and ebs:GetSnapshotBlock — scoped to the resources you want to protect. You can deploy the same template to multiple accounts usingAWS CloudFormation StackSets, whichtypically deploy each stack instance in two to three minutes,for centralized management. After deployment, you configure protection policies in the Clumio console defining which EBS volumes to protect, how frequently to back up, and how long to retain data.

• IAM permissions for EBS direct API calls: The required permissions include ec2:CreateSnapshot, ec2:DescribeSnapshots, ebs:ListSnapshotBlocks, ebs:ListChangedBlocks, and ebs:GetSnapshotBlock. You can review and customize the role before deployment.
• VPC endpoint configuration: Optional but recommended for organizations with strict network security requirements. Creating a VPC endpoint for the EBS direct APIs (service name: com.amazonaws.region.ebs) keeps all API traffic within the AWS network.
• CloudFormation deployment: The template provisions an IAM role, optional SNS topics for event notifications, and the cross-account trust relationship that allows Clumio to assume the role.
• Auto Scaling Group awareness: Configuregruppo di auto-scaling EC2awareness so Clumio automatically protects new volumes as instances scale out.

Integration Ecosystem

• AWS CloudFormation (Deployment):Automates IAM role creation, SNS topics, and cross-account trust setup forClumio— enabling infrastructure-as-code deployment across multiple AWS accounts.
• AWS Lambda (Orchestration):Provides serverlessrisorse di calcolofor custom EBS direct API workflows, allowing event-driven backup triggers without persistent infrastructure.
• Amazon RDS (Workload): Clumioextends the same policy-driven backup model to Amazon RDS databases, offering unified data protection across compute and database services. 

Before and After: Workflow Architecture

• Traditional Workflow (Before EBS Direct APIs): First, you create a snapshot of the EBS volume using ec2:CreateSnapshot. Next, you launch a temporary EC2 instance in the same availability zone, create a new EBS volume from the snapshot, and attach and mount the volume through the operating system. Then, a backup agent reads all blocks from the mounted volume — even unchanged data — and transfers the data to your backup repository. Finally, you detach, delete, and terminate the temporary volume and EC2 instance. This workflow has obvious problems: EC2 instance costs, EBS volume costs, startup latency, and the inefficiency of reading unchanged blocks.
• Direct API Workflow (After EBS Direct APIs): First, you create a snapshot of the EBS volume, just as before. Next, ListChangedBlocks compares the new snapshot with the previous one, returning only the block indexes that differ. Then, GetSnapshotBlock retrieves the 512 KiB block data for each changed block directly over HTTPS. Finally, you transfer the changed blocks to your backup vault — data transfer volume is a fraction of the full volume size. No EC2 instance. No temporary volume. No operating system mount. No reading unchanged data. — For a 1 TB EBS volume with 5% daily change rate, the traditional workflow reads 1 TB every backup. The direct API workflow reads approximately 50 GB — a substantial difference that compounds monthly.

Before: EBS volume to snapshot to temporary EC2 instance to backup repository.

Figure 1: EBS backup workflow before EBS direct APIs showing elimination of temporary EC2 instances

After: EBS volume to snapshot to direct API calls to backup vault.

Figure 2: EBS backup workflow after EBS direct APIs showing elimination of temporary EC2 instances

Outcome Summary / Value Recap

By integrating EBS direct APIs, Clumio can help reduce cost and improve performance for Amazon EBS backup. Removing temporary EC2 instances and reading only changed blocks may lower backup costs and speed up incremental backups. Clumio customers may achieve up to 30% lower backup TCO on average.EsploraRecupero di RansomwareeOperational Recoveryto learn how Clumio helps you recover from real-world incidents.