Cloud-based data protection using application programming interface access and selective data restore

A computer-implemented method comprising:

• by a data protection service that executes on one or more cloud computing resources of a public cloud, wherein the one or more cloud computing resources are implemented on one or more hardware processors:
• receiving, from an organization, authorization that permits the data protection service to use an application programming interface supported by the public cloud to access data within a cloud account of the organization in the public cloud;
• using the application programming interface to access the data within the cloud account by way of permissions granted by the organization through an identity and access management role that permits data access;
• using the identity and access management role to:
• take a snapshot of at least one virtual machine that operates in the cloud account, and copy a snapshot data corresponding to the snapshot;
• causing a virtual machine instance to be instantiated in the public cloud, wherein the virtual machine instance is associated with block storage configured in the public cloud;
• by the virtual machine instance in the public cloud, based on instructions loaded thereinto by the data protection service:
• restoring at least some of the snapshot data to the block storage,
• selecting data blocks based on the snapshot data stored in the block storage,
• causing the data blocks that were selected to be stored in object storage in the public cloud, and
• providing one or more object identifiers corresponding to the data blocks stored in the object storage;
• and
• by the data protection service, after providing the one or more object identifiers, deleting the virtual machine instance and the block storage.