Your AWS landscape.
One blueprint for recovery.

The access and encryption foundations of recovery.

Discover who can act, what is encrypted and which sensitive dependencies the recovered workload needs. Readiness checks focus on destination permissions, key access and valid certificates.

• 

  IAM

  Map roles, policies, trust relationships and workload permissions. Plan destination identities and the access needed for recovery.

• 

  KMS

  Identify encryption keys, policies, grants and encrypted dependencies. Check that the chosen destination key design permits restores and application access.

• 

  Secrets Manager

  Discover secret metadata, rotation settings and references without retrieving secret values. Plan the authorised replica or value-protection path separately.

• 

  ACM

  Record certificate names, validation and workload bindings. Plan a valid destination certificate and map its new ARN into recovered services.

The paths that make the recovered workload reachable.

Map the network as a connected system: addressing, traffic controls, routes, attachments, entry points and private access. Plan target identities and connectivity before rebuilding dependent services.

• 

  VPC

  Map address ranges, tenancy, DNS settings and connected resources. Define the destination network and dependency order.

• 

  Subnets

  Inventory CIDRs, Availability Zones and network associations. Map placement to destination Availability Zones and connectivity needs.

• 

  Routing

  Capture route tables, routes and associations. Check every destination next hop and the reachability required by recovered workloads.

• 

  DHCP

  Capture DHCP option sets and VPC associations. Plan the destination DNS and domain settings used by workloads.

• 

  IGW

  Identify Internet Gateway attachments and dependent routes. Plan the approved public connectivity of the recovery VPC.

• 

  NAT

  Map NAT gateways, subnet placement, addresses and route dependencies. Plan outbound reachability, capacity and destination availability.

• 

  EIP

  Record Elastic IP allocations and associations. Plan destination addresses and downstream allow-list updates rather than assuming the source IP transfers.

• 

  NACL

  Capture ordered inbound and outbound rules and subnet associations. Map destination CIDRs, return paths and change-approval requirements.

• 

  SG

  Capture security group rules, references and attachments. Map target group identities and review access changes before reconciliation.

• 

  Endpoints

  Map VPC endpoints, service names, policies, subnets and security groups. Check private access to required services in the destination.

• 

  Peering

  Identify peering connections and dependent routes. Plan destination connections, permissions and non-overlapping network ranges.

• 

  VPN

  Map VPN connections, gateways, tunnels and routing dependencies. Plan partner coordination, destination endpoints and connectivity checks.

• 

  TGW

  Capture Transit Gateway attachments, route tables, propagation and associations. Plan destination transit connectivity and sharing dependencies.

• 

  ENI

  Map network interfaces, addresses, attachments and security groups. Plan interfaces in the correct destination subnet and workload context.

• 

  ALB

  Map Application Load Balancer listeners, rules, target groups, health checks and certificates. Plan target registration and application entry checks.

• 

  NLB

  Map Network Load Balancer listeners, target groups, addresses and health checks. Plan destination reachability and endpoint changes.

• 

  GWLB

  Map Gateway Load Balancer target groups, appliance dependencies and endpoint connectivity. Plan the recovered inspection path.

• 

  VPC Lattice

  Map service networks, services, listeners, associations and access policies. Plan how recovered applications connect and authenticate.

The runtimes, images and launch settings behind the application.

Identify how workloads start and which images, roles, secrets, network paths and persistent data they require. The recovery plan combines infrastructure reconstruction with separate protection of application artefacts and state.

• 

  EC2

  Inventory instance configuration, images, user data, placement, roles and attached storage. Define destination mappings and launch prerequisites.

• 

  Launch templates

  Capture launch template versions and references to images, networking, roles and storage. Select the approved recovery version and destination mappings.

• 

  EBS

  Map volumes, attachments, encryption and snapshot protection. Plan the approved restore point, destination key access and workload attachment.

• 

  Auto Scaling

  Capture group capacity, scaling policies, launch configuration references and load balancer attachments. Plan recovery capacity and health behaviour.

• 

  ECR

  Map repositories, image dependencies and destination controls. Plan one-time backfill for existing images and native replication for future eligible pushes.

• 

  ECS

  Map clusters, task definitions, services, capacity providers and their dependencies. Plan approved images, roles, secrets, networking and health checks.

• 

  Fargate

  Capture the ECS or EKS configuration that uses Fargate. Check destination placement, networking, permissions and supported runtime requirements.

• 

  EKS

  Map cluster configuration, compute profiles and access dependencies. Plan Kubernetes workload configuration and persistent data alongside the control plane.

• 

  Lambda

  Map function configuration, package or image references, roles, layers and triggers. Plan deployment artefacts, event bindings and runtime checks.

The objects, files and protected restore points behind the service.

Assess configuration and data protection separately. Identify supported replication, backup or restore paths, destination access and evidence that the chosen recovery point is usable.

• 

  S3

  Map buckets, policies, encryption, versioning and protection settings. Plan object protection, including existing-object backfill where required.

• 

  EFS

  Map file systems, mount targets, access points, policies and protection settings. Plan data recovery and destination mount access.

• 

  FSx

  Identify file-system type, network placement, identity dependencies and protection settings. Select a recovery path supported for that FSx configuration.

• 

  AWS Backup

  Map backup plans, vaults, selections, retention and copy settings. Check protected resources, restore-point access and destination permissions.

The state that needs a deliberate recovery point.

Map database configuration and application connections alongside the available protection paths. Plan destination permissions, restore-point selection, endpoint updates and application/data validation.

• 

  RDS

  Map instance settings, subnet groups, parameter groups, encryption and backup configuration. Plan a service-appropriate replica, snapshot or point-in-time restore path.

• 

  Aurora

  Map cluster topology, parameters, networking, encryption and protection settings. Plan an appropriate cluster restore or replication path and application endpoint updates.

• 

  DynamoDB

  Map tables, indexes, streams, encryption and protection settings. Assess applicable replication or restore options and destination application dependencies.

• 

  Redshift

  Map clusters or serverless configurations, access, networking and snapshot settings. Plan data restoration and client connectivity for the chosen deployment.

The pipelines that turn recovered data into useful outputs.

Map job definitions, stream configuration and their upstream and downstream dependencies. Plan artefact availability, delivery targets and how interrupted work is resumed or replayed.

• 

  EMR

  Capture analytics runtime configuration and its storage, identity and network dependencies. Plan reproducible jobs, artefacts and access to recovered data.

• 

  Glue

  Map jobs, crawlers, connections, catalogue dependencies and permissions. Plan scripts, data locations and destination configuration.

• 

  Kinesis

  Map stream configuration, encryption, retention and producer/consumer dependencies. Define destination streams and application replay or continuity requirements.

• 

  Firehose

  Map delivery streams, transformations, destinations and IAM dependencies. Plan target delivery settings and the handling of interrupted ingestion.

The events and messages connecting the application.

Inventory queues, topics, rules, subscriptions and sending configuration. Define the application-specific treatment of backlog, replay, delivery and destination endpoint changes.

• 

  SQS

  Map queue attributes, encryption, policies, dead-letter queues and consumers. Plan destination queues and an application-specific backlog or replay approach.

• 

  SNS

  Map topics, policies, encryption and subscriptions. Plan destination endpoints and any confirmation or application changes needed for delivery.

• 

  EventBridge

  Map event buses, rules, targets and access policies. Plan destination bindings and assess any configured archive and replay requirements.

• 

  SES

  Map verified identities, configuration sets and sending dependencies. Check destination-region verification, permissions and sending readiness.

The public entry points and their security protections.

Map front doors to their origins, integrations, certificates and protections. Plan how the recovered application is exposed, checked and promoted through an approved change.

• 

  API Gateway

  Map APIs, stages, integrations, authorisers and domain bindings. Plan destination backends, certificates and access checks.

• 

  CloudFront

  Map distributions, origins, behaviours and security attachments. Plan origin changes, approved deployment and cache behaviour during recovery.

• 

  WAF

  Map web ACLs, rules and resource associations. Plan protections in the correct scope and destination, and validate application access.

• 

  Shield

  Identify applicable protection configuration and protected resources. Check recovery resource enrolment and operational response dependencies.

The coordination layer for recovery and resource access.

Identify configured routing controls and supported resource-sharing relationships. Check destination prerequisites and approval gates before planning any traffic action.

• 

  ARC

  Map the configured recovery control plane and workload associations. For routing controls, assess readiness, safety rules and approved traffic actions; ARC does not rebuild workloads.

• 

  RAM

  Map resource shares, principals and permissions. Check whether supported destination resources can be shared and whether acceptance is required; a share is not a replicated resource.

The evidence and operational access needed during recovery.

Map health signals, logs and operational configuration. Plan the visibility required to diagnose the recovered service and show whether its readiness and validation gates have passed.

• 

  CloudWatch

  Map alarms, dashboards, metrics and notification dependencies. Plan evidence and health signals for the recovered workload.

• 

  Logs

  Map log groups, retention, encryption and subscriptions. Plan destination collection and the observability needed to diagnose recovery.

• 

  SSM

  Map relevant Systems Manager configuration, documents, parameters and managed-node dependencies. Plan destination operations and approved access paths.

The account and Region boundaries of recovery assurance.

Assess the landing zone, organisation policies, posture services and audit coverage. Central administration still needs explicit verification in each destination account and Region.

• 

  Control Tower

  Assess landing-zone configuration, account enrolment and applicable controls. Plan the recovery account baseline and verify its coverage.

• 

  Organizations

  Map account structure, organisational units, policies and trusted service access. Identify governance dependencies for destination accounts.

• 

  Config

  Assess configuration recorders, rules, aggregators and regional coverage. Plan the evidence needed to compare source and recovery environments.

• 

  Security Hub

  Assess central administration, enabled standards and account/Region coverage. Plan destination posture visibility and finding workflows.

• 

  GuardDuty

  Assess detector configuration, protection features and delegated administration. Check the accounts and Regions covered by the recovery design.

• 

  CloudTrail

  Map trails or event data stores, selectors, storage and encryption. Plan audit visibility and the events required by change reconciliation.

The delivery chain behind a reproducible recovery release.

Map the code, build, artefact and deployment dependencies that produce the application. Plan approved release inputs, destination bindings and the gates needed to deliver them safely.

• 

  CodeBuild

  Map build projects, environments, source connections, roles and artefact dependencies. Plan destination build prerequisites and controlled credentials.

• 

  CodePipeline

  Map stages, actions, source dependencies and artefact stores. Plan destination bindings, approval stages and release orchestration.

• 

  CodeDeploy

  Map applications, deployment groups, target bindings and rollback settings. Plan destination release targets and health criteria.

• 

  CodeCommit

  Inventory repository references, permissions and pipeline dependencies. Plan an approved code availability and destination access path.