Customers running earlier versions or relying on AWS default configurations remain vulnerable to overly permissive security group rules, broad endpoint access, and loosely scoped IAM roles.
Gaps that 13.1 closes out-of-the-box.
That's why we're asking: Why should customers upgrade to Veeam Data Platform 13.1 now?
Because 13.1 makes secure-by-design the default.
Tighter network controls, restricted endpoint access, zero-trust policies, and granular least-privilege IAM.
It’s a meaningful security upgrade that reduces exposure without adding unnecessary operational complexity.
The core AWS data protection challenge isn't just "does Veeam support this workload” it's time-to-protected. How long it takes to stand up a secure, compliant, air-gapped-from-the-internet backup environment before you can even start protecting anything.
Cross-team dependencies (network, security, IAM approval, compliance sign-off) are usually where projects stall, not the Veeam install itself.
High-Level Security Enhancements
Veeam Data Platform 13.1 extends the security, cloud protection and operational capabilities around this architecture with several important enhancements:
- Malware detection for cloud backups - Veeam Threat Hunter can now scan backups from Veeam Backup for AWS, Microsoft Azure and Google Cloud.
- SLA-based backup policies for AWS EC2 - simplified policy management, SLA compliance visibility, region-aware scheduling and repository selection.
- Amazon RDS protection - real backup and recovery capabilities for Amazon RDS for SQL Server, including optional immutability, plus support for PostgreSQL 17.
- Enhanced private deployments - private endpoints and external repository integration improve protection for isolated AWS environments without relying on public network connectivity.
- Improved snapshot lifecycle management - custom retention for manual EC2 snapshots and enhanced retention reporting.
- Direct Restore to AWS EC2 enhancements - including static private IP assignment to simplify migrations and recovery scenarios.
- SureBackup Lite for cloud VMs - enabling automated recoverability verification for AWS, Azure and Google Cloud VM backups.
I believe all these new features have had a significant impact on both upgrades and new deployments. With that in mind, I'm sharing my new CloudFormation template.
Continuing with the project below:
This is the new version I am aiming to achieve:
It's already on GitHub (Still under development):
https://github.com/jeanSczepanski/Wizaard/tree/main
Macro-level improvements
Security Group rules made explicit - v1 showed generic SG boxes with no visible rules; v2 shows the actual restriction: EC2 SG egress limited to VPC Endpoints only, Endpoint SG ingress limited to the EC2 SG (SG-to-SG reference, not open CIDR).
IAM Role introduced - v1 had no IAM representation at all. V2 adds a Custom Inline Policy (Least Privilege) block with a sample JSON - S3 access scoped to a specific bucket/prefix, plus KMS permissions (GenerateDataKey, Decrypt) for SSE-KMS.
S3 bucket (repository) security addressed - v1 only showed the S3 Gateway Endpoint as connectivity; v2 adds a dedicated Bucket Security card - Block Public Access, Versioning, SSE-KMS with CMK, bucket policy with aws:SourceVpce, and Object Lock/Immutability recommendation (with a note to remove DeleteObject* from the IAM policy if immutability is enabled).
Monitoring & audit added - v1 had no logging/observability layer; v2 adds CloudTrail, CloudWatch, GuardDuty, and optional Security Hub.
Network isolation made more explicit - v2 labels the subnet "No Internet Route" and adds a closing note confirming all EC2-to-AWS-service traffic stays inside the AWS network via VPC Endpoints - turning "Secure-by-Design" into something the diagram actually demonstrates, not just a badge.
I believe that soon these new features from 13.1 will be paired with automated deployments to further strengthen implementation reliability, project agility, and delivery speed.
The enhancements in Veeam Backup & Replication 13.1 raise the bar for security, performance, scalability, and hybrid cloud protection.
Combined with AWS elasticity and managed services, they enable a more secure, scalable, and efficient approach to data protection.