Problem description
Disaster Recovery (DR) restores for VMware workloads fail with error code DR 65535. This issue typically occurs during incremental DR restore jobs, causing the job to abort when Druva attempts to process the virtual machine disks in the target AWS environment.
Cause
The failure occurs due to an AWS Elastic Block Store (EBS) snapshot lineage constraint:
An initial DR restore completes successfully, creating an unencrypted parent EBS snapshot in the target AWS account.
Subsequently, EBS default encryption is enabled on the target AWS account/region.
A subsequent incremental DR restore triggers and attempts to reference the existing unencrypted snapshot as the parent.
AWS does not allow an unencrypted snapshot to serve as the parent for new incremental snapshots once EBS default encryption is enabled. AWS rejects the API call with a ValidationException, aborting the restore.
Traceback
ValidationException: Un-encrypted snapshot (snap-xxxxxxxxxxxxxxxxx) cannot be specified when EBS default encryption is enabled. Errorstartingsnapshot:%v="operation error EBS: StartSnapshot, https response error StatusCode: 400, RequestID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, ValidationException: Un-encrypted snapshot (snap-xxxxxxxxxxxxxxxxx) cannot be specified when EBS default encryption is enabled." Failed to start EBS Snapshot
Resolution
To resolve the snapshot lineage conflict, reset the DR snapshot chain so a new encrypted baseline snapshot can be established:
Remove the affected VM from the DR Plan:
In the Druva Management Console, navigate to your Disaster Recovery configuration.
Open the DR Plan containing the affected VMware VM and remove the VM from the plan. This detaches the VM from the existing unencrypted EBS snapshot lineage.
Re-add the VM to the DR Plan:
Add the virtual machine back to the DR Plan.
Verify and confirm the target AWS account, region, and storage configuration settings.
Initiate a full baseline DR restore:
Method 1 (Automatic): Trigger a fresh backup job for the virtual machine. Once the backup completes, Druva automatically triggers a new full DR restore job.
Method 2 (Manual): Navigate to Disaster Recovery > Virtual Machines, select the VM, and click Update DR Copy to trigger a full baseline restore from the latest recovery point.
(Note: Because the VM was re-added, Druva creates a new, encrypted full EBS snapshot adhering to the target account's default EBS encryption rules.)
Verification
Open the Druva Console and navigate to Disaster Recovery > Jobs. Verify that the baseline DR restore job status shows Successful.
Log in to the target AWS Management Console and open EC2 > Snapshots.
Locate the snapshot generated by the restore job and verify under the Encryption column that the snapshot is marked as Encrypted with your default KMS key.
Allow the next scheduled incremental backup and DR restore cycle to complete, confirming that subsequent incremental restore jobs succeed.