> For the complete documentation index, see [llms.txt](https://docs.cloudback.it/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloudback.it/supported-storages/amazon-s3-bucket-via-assume-role.md). # Amazon S3 Bucket via AssumeRole Configure an Amazon S3 Bucket via IAM AssumeRole for your backups in Cloudback, granting access through temporary credentials instead of long-lived access keys. ## About Amazon S3 Bucket Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. This means customers of all sizes and industries can use it to store and protect any amount of data for a range of use cases, such as data lakes, websites, mobile applications, backup and restore, archive, enterprise applications, IoT devices, and big data analytics. With the AssumeRole option, Cloudback accesses the bucket through an IAM Role in your own AWS account instead of a long-lived access key. Before each storage operation Cloudback assumes that role and receives temporary credentials, protected by an External ID that guards against the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html). ## Required permissions * **s3:PutObject** - required, for backup archive upload to Amazon S3 bucket * **s3:ListBucket** - required, so that a missing backup archive is reported as not found rather than access denied * **s3:GetObject** - optional, for backup restore and instant download from Amazon S3 bucket * **s3:DeleteObject** - optional, for retention policy, automatic removal of outdated backups from Amazon S3 bucket * **s3:GetBucketLocation** - optional, required to automatically determine the region of the bucket * **s3:PutObjectRetention** - optional, required for the [S3 Object Lock](/security-and-compliance/amazon-s3-object-lock.md) header `x-amz-object-lock-mode` * **s3:PutObjectLegalHold** - optional, required for the [S3 Object Lock](/security-and-compliance/amazon-s3-object-lock.md) header `x-amz-object-lock-legal-hold` * **s3:PutObjectTagging** - optional, required for the [S3 Object Tagging](/supported-storages/amazon-s3-object-tagging.md) header `x-amz-tagging` * **kms:GenerateDataKey** - required for a bucket encrypted with a customer managed KMS key, for backup archive upload * **kms:Decrypt** - required for a bucket encrypted with a customer managed KMS key, for backup restore and instant download ## Set up Amazon S3 Bucket AssumeRole as a customer managed storage To set up Amazon S3 Bucket AssumeRole as a storage for your backups, follow the steps below. ### Create a new Amazon S3 AssumeRole storage * Open the [Cloudback Dashboard](https://app.cloudback.it/) * Navigate to the `Storages` page by clicking on the `Storages` link in the left-side navigation pane * Click on the `Add a new storage` button: ![Add new storage](https://2781059148-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQEI7SjBF2CddqNXZpCoE%2Fuploads%2Fgit-blob-48c773c5876576956efc547df9c59cfec230772b%2Fcustomer-managed-storages.png?alt=media) * Type a storage name in the `Storage name` field. Use a name that will help you identify this storage in the future. * Select `Amazon S3 AssumeRole` from a Storage Provider dropdown: ![Amazon S3 AssumeRole storage settings](https://2781059148-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQEI7SjBF2CddqNXZpCoE%2Fuploads%2Fgit-blob-ce5df9e806fdb307c76fe2e8d1c8f1553e4a316f%2Fcreate-new-storage-aws-assume-role.png?alt=media) ### Set up storage settings Choose the settings for the storage: * **Deduplication type** - enable or disable data deduplication. For more details, please refer to the [Deduplication](/managing-backups/data-deduplication.md) documentation * **Archive type** - enable or disable archive password protection. For more details, please refer to the [Password-Protected Archives](/security-and-compliance/password-protected-archives.md) documentation * **Archive name pattern** - configure the archive name pattern, which is used to generate the name of the backup archive. For more details, please refer to the [Archive Name Pattern](/managing-backups/archive-name-pattern.md) documentation ### Create Amazon S3 Bucket To upload backups to Amazon S3 Bucket, you need to create a bucket. You can skip this step if you already have a bucket. You can find more information on how to create a bucket in the [Amazon S3 documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/GetStartedWithS3.html#creating-bucket). Cloudback needs the ARN of the bucket to access it. To find the ARN, click on the name of your bucket in the S3 console and open the `Properties` tab. Copy the ARN and paste it in the `Step 1` field on the Cloudback site. ### Provide the KMS key ARN (Optional) If your bucket is encrypted with a customer managed KMS key, tick the `My bucket is encrypted with a customer managed KMS key` checkbox in the `Step 2` field and paste the ARN of that key. To find the key ARN, click on the name of your bucket in the S3 console, open the `Properties` tab and look at the [Default encryption](https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html) section. Leave the checkbox unchecked if your bucket uses default encryption. Cloudback needs no KMS permissions in that case. ### Apply the permissions policy After you type a bucket ARN in the `Step 1` field, Cloudback will generate a permissions policy for you. The generated policy document is available in the `Step 2` field. You need to [create an IAM policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html) from it and [attach it](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) to your role to allow Cloudback to access the bucket. If you provided a KMS key ARN, the generated policy also grants the KMS permissions on that key. ### Choose an External ID Type a unique External ID in the `Step 3` field. Cloudback places this value in the trust policy generated in the same field and sends it with every request to assume the role. ### Create an IAM Role Cloudback accesses your Amazon S3 bucket by assuming an IAM Role in your AWS account. After you type an External ID, Cloudback will generate a trust policy for you in the `Step 3` field. Create a role with the `Custom trust policy` role type, paste the generated trust policy into it, then [attach](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) the permissions policy from the `Step 2` field. You can find more information on how to create a role in the [AWS IAM documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-custom.html). Copy the ARN of the role you created and paste it in the `Step 3` field on the Cloudback site. ### Provide the AWS Region (Optional) In the `Step 4` field, you can provide the AWS Region of the bucket. If you don't provide the region, Cloudback will try to determine it automatically using the `s3:GetBucketLocation` permission. ### Provide additional HTTP headers (Optional) In the `Step 5` field you can provide additional HTTP headers to be used when uploading backups to the Amazon S3 bucket. The headers can be used to set the [S3 Object Lock](/security-and-compliance/amazon-s3-object-lock.md) or [S3 Object Tagging](/supported-storages/amazon-s3-object-tagging.md) headers. ### Save storage Click on `Save` button to save the new storage. You can also use a `Test` button to check if the storage is configured correctly. After saving the storage, you can use it for storing backups of your repositories. All storage settings can be changed later in the `Storages` page. To edit the storage settings, click on the `Edit` button next to the storage you want to edit. ## Change the storage for a repository You can change the storage for a particular repository in the [Repository Details](/dashboard/repository-details.md) page. Also, you can assign it to multiple repositories through the [Bulk Operations](/managing-backups/bulk-operations.md). ## Learn More * [Customer Managed Storages](/storage-configuration/customer-managed-storages.md) * [Dashboard Overview](/dashboard/dashboard-overview.md) * [Repository Details](/dashboard/repository-details.md) * [Bulk Operations](/managing-backups/bulk-operations.md) * [Replicating Backups](/storage-configuration/replicating-backups.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.cloudback.it/supported-storages/amazon-s3-bucket-via-assume-role.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.