Amazon S3

Store backups in AWS S3 with support for storage classes, lifecycle policies, and multi-region durability.

Configuration

Credential Profile required

Amazon S3 requires a Credential Profile of type ACCESS_KEY. Create one in Vault → Credentials before saving the destination.

Field	Description	Default	Required
Name	Friendly name for this destination	-	✅
Region	AWS region (e.g. us-east-1, eu-central-1)	us-east-1	✅
Bucket	S3 bucket name	-	✅
Login	ACCESS_KEY credential profile (Access Key ID + Secret Access Key)	-	✅
Folder	Folder path within the bucket. The folder button beside it browses the bucket once the connection and its login are filled in	-	❌
Parts at once	Upload parts sent simultaneously (details)	8	❌
Max part size (MB)	Upper bound on the size of each upload part	8	❌
Storage class	S3 storage class for uploaded objects	STANDARD	❌

Storage Classes

Class	Use Case
STANDARD	Frequent access (default)
STANDARD_IA	Infrequent access, lower cost
GLACIER	Long-term archive (retrieval in minutes to hours)
DEEP_ARCHIVE	Cheapest storage, retrieval in 12+ hours

Glacier and Deep Archive restrict direct access

Objects stored in GLACIER or DEEP_ARCHIVE are archived and cannot be downloaded or restored directly. In the Backups page, these objects show an orange Glacier or Deep Archive badge and the Download and Restore buttons are disabled. To access an archived object, you must first initiate a restore via the AWS Console or CLI - once the object is available (minutes to hours for Glacier, up to 12+ hours for Deep Archive), you can download or restore it from DBackup as normal.

Setup Guide

1. Create an S3 bucket in your preferred region via the AWS Console
2. Create an IAM user with programmatic access:
   • Go to IAM Console → Users → Create user
   • Attach the AmazonS3FullAccess policy (or a scoped policy - see below)
   • Create an Access Key (use case: "Application outside AWS") and copy both keys
3. Create an ACCESS_KEY credential profile in Vault → Credentials with the Access Key ID and Secret Access Key (guide)
4. Go to Connections → Destinations → New destination → Amazon S3
5. Enter your Region and Bucket, then pick the credential profile under Login
6. (Optional) Set a Folder in the Location part to organize backups in a subfolder, or pick it with the folder button (📂)
7. (Optional) Select a Storage class for cost optimization
8. Click Test connection to verify the connection

Minimal IAM Policy (recommended)

Instead of AmazonS3FullAccess, scope permissions to a single bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::your-bucket-name",
        "arn:aws:s3:::your-bucket-name/*"
      ]
    }
  ]
}

How It Works

• Backups upload via the AWS SDK as 8 parallel parts by default (details)
• All credentials are stored AES-256-GCM encrypted in the database
• Storage class is set per-object at upload time
• The folder creates a virtual folder structure within your bucket

Troubleshooting

AccessDenied

Access Denied (403)

Solution: Verify the IAM user has s3:PutObject, s3:GetObject, s3:DeleteObject, and s3:ListBucket permissions on the correct bucket ARN.

NoSuchBucket

The specified bucket does not exist

Solution: Check bucket name spelling. S3 bucket names are globally unique and case-sensitive.

InvalidAccessKeyId

The AWS Access Key Id you provided does not exist in our records

Solution: Regenerate the access key in IAM Console. Ensure there are no leading/trailing spaces when pasting.

Slow Uploads / Timeout

Solution: Check the upload speed the run log reports at the end of the upload. If it is well below what the server's link can do, raise Parts at once under Configuration (details). A single connection to S3 often tops out around 5 to 10 MB/s no matter how much bandwidth is available. Also choose a region geographically close to your DBackup server.

Next Steps

• Enable Encryption
• Configure Retention
• Backups