Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Connecting Yandex Compute Cloud VMs to Cloud Backup

Written by
Updated at July 29, 2026
View in Markdown

To back up your Yandex Compute Cloud instances in Cloud Backup, you need them connected to the service and properly set up.

For more information on connecting a Compute Cloud VM to Cloud Backup, see Managing Yandex Compute Cloud VMs in Cloud Backup.

For the Cloud Backup connection to work correctly, link to the VM a service account with the backup.user role or higher and configure network access.

Tip

You do not have to use a service account when creating a VM using the management console. However, the user creating the VM must have the backup.user role or higher for the folder in which the VM is created.

After connecting to Cloud Backup, associate your VM with a backup policy.

Note

When initiating a backup, make sure the VM is running.

A policy can also be linked to a virtual machine when creating it. A policy is linked asynchronously after you create and initialize a VM, as well as install and configure a Cloud Backup agent. This may take up to 10-15 minutes. For more information on automatic linking of policies to VMs, see Associating a Yandex Cloud Backup policy with a VM automatically.

Supported Cloud Marketplace images with automatic installation of the Cloud Backup agent

The Cloud Backup agent is available for automatic installation on Compute Cloud VMs if you create your VMs using the following Cloud Marketplace images:

Linux-based images

Windows-based images

Note

The OS must be installed from a public image (a Yandex Cloud Marketplace product). You can select the OS directly during VM creation or use an image or disk snapshot of a different VM whose OS was also installed from a public image.

Unaided installation on a supported operating system

You can manually install the Cloud Backup agent on a VM. For more information, see:

For a complete list of supported operating systems, see the backup provider documentation.

If you have issues installing the Cloud Backup agent, contact support.

Updating the operating system kernel

Updating the Linux kernel on a resource connected to Cloud Backup may affect the performance of the Cloud Backup agent: it will not be able to create a backup of the resource or recover it from a backup.

This may affect the agent’s performance, since the SnapAPI module (developed by the backup provider for the agent to work with disks and built by the DKMS framework for a specific Linux kernel) may not update after updating the kernel and may therefore cease to match the kernel version.

To restore the Cloud Backup agent’s performance affected by a Linux kernel update, you need to update the version of the Linux kernel headers DKMS refers to when building the SnapAPI module. Once the kernel header version matches the kernel version, DKMS will rebuild the SnapAPI module for the required Linux kernel version at the next start of the resource.

For information on how to upgrade the Linux kernel header version, see Recovering the Cloud Backup agent after a Linux kernel update.

Service account

Note

You do not have to use a service account when creating a VM using the management console. However, the user creating the VM must have the backup.user role or higher for the folder in which the VM is created.

A service account is a special account the Cloud Backup agent uses to get registered with the Cyberprotect provider.

When creating a Compute Cloud VM you want to configure backups for in Cloud Backup, you need to link to it a service account with the backup.user role or higher.

You can assign the role to an existing service account or create a new service account with the required role.

Network access permissions

For the Cloud Backup agent to be able to exchange data with the backup provider servers, make sure the VM has network access to the IP addresses of the Cloud Backup resources as per the table below:

Port range Protocol Destination name IPv4 CIDR
80 TCP Address range 213.180.193.0/24
80 TCP Address range 213.180.204.0/24
443 TCP Address range 84.47.172.0/24
443 TCP Address range 84.201.181.0/24
443 TCP Address range 178.176.128.0/24
443 TCP Address range 213.180.193.0/24
443 TCP Address range 213.180.204.0/24
7770-7800 TCP Address range 84.47.172.0/24
8443 TCP Address range 84.47.172.0/24
44445 TCP Address range 51.250.1.0/24

Tip

When installing the Cloud Backup agent on your VM, you may need to install some missing software components from the internet. To do this, add the following outgoing traffic rule to the security group:

  • Port range: 0-65535.
  • Protocol: Any.
  • Destination name: Address range.
  • IPv4 CIDR: 0.0.0.0/0.
    Once the Cloud Backup agent is installed, you can delete this rule.

To access the VM over SSH, add the following incoming traffic rule:

  • Port range: 22.
  • Protocol: Any.
  • Destination name: Address range.
  • IPv4 CIDR: 0.0.0.0/0.

To provide network access:

Assign the VM a public IP or use a route table that allows internet access via a NAT gateway or a custom router.

The VM's security group rules must allow access to the specified resources. You can add the rules to an existing security group or create a new group with the rules.

Connection statuses

You can view info on the status of a VM connection to Cloud Backup using the management console, on the VM list page in Compute Cloud. The following statuses are available:

  • Connected: Cloud Backup is connected to the VM, backups are being created as per the specified policies, the Cloud Backup agent is online.
  • No backup policy: Cloud Backup is connected, but no policy has been assigned, no backups are being created.
  • Failed: The agent is offline or failed to register.
  • Not connected: Cloud Backup is not connected to the VM.

You can view the VM connection status and learn more about the VM backup in the backup log.

See also

Previous
Overview
Next
Servers BareMetal