> For the complete documentation index, see [llms.txt](https://docs.cloudback.it/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloudback.it/supported-storages/amazon-s3-bucket-via-assume-role.md). # Amazon S3 Bucket via AssumeRole ## About Amazon S3 Bucket Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. This means customers of all sizes and industries can use it to store and protect any amount of data for a range of use cases, such as data lakes, websites, mobile applications, backup and restore, archive, enterprise applications, IoT devices, and big data analytics. With the AssumeRole option, Cloudback accesses the bucket through an IAM Role in your own AWS account instead of a long-lived access key. Before each storage operation Cloudback assumes that role and receives temporary credentials, protected by an External ID that guards against the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html). ## Required permissions * **s3:PutObject** - required, for backup archive upload to Amazon S3 bucket * **s3:ListBucket** - required, so that a missing backup archive is reported as not found rather than access denied * **s3:GetObject** - optional, for backup restore and instant download from Amazon S3 bucket * **s3:DeleteObject** - optional, for retention policy, automatic removal of outdated backups from Amazon S3 bucket * **s3:GetBucketLocation** - optional, required to automatically determine the region of the bucket * **s3:PutObjectRetention** - optional, required for the [S3 Object Lock](/security-and-compliance/amazon-s3-object-lock.md) header `x-amz-object-lock-mode` * **s3:PutObjectLegalHold** - optional, required for the [S3 Object Lock](/security-and-compliance/amazon-s3-object-lock.md) header `x-amz-object-lock-legal-hold` * **s3:PutObjectTagging** - optional, required for the [S3 Object Tagging](/supported-storages/amazon-s3-object-tagging.md) header `x-amz-tagging` ## Set up Amazon S3 Bucket AssumeRole as a customer managed storage To set up Amazon S3 Bucket AssumeRole as a storage for your backups, follow the steps below. ### Create a new Amazon S3 AssumeRole storage * Open the [Cloudback Dashboard](https://app.cloudback.it/) * Navigate to the `Storages` page by clicking on the `Storages` link in the left-side navigation pane * Click on the `Add a new storage` button: ![Add new storage](/files/kmIGJhB6FbT1QZGI7Sru) * Type a storage name in the `Storage name` field. Use a name that will help you identify this storage in the future. * Select `Amazon S3 AssumeRole` from a Storage Provider dropdown: ![Amazon S3 AssumeRole storage settings](/files/6qFP5ADmtTX3davH7LRz) ### Set up storage settings Choose the settings for the storage: * **Deduplication type** - enable or disable data deduplication. For more details, please refer to the [Deduplication](/managing-backups/data-deduplication.md) documentation * **Archive type** - enable or disable archive password protection. For more details, please refer to the [Password-Protected Archives](/security-and-compliance/password-protected-archives.md) documentation * **Archive name pattern** - configure the archive name pattern, which is used to generate the name of the backup archive. For more details, please refer to the [Archive Name Pattern](/managing-backups/archive-name-pattern.md) documentation ### Create an IAM Role Cloudback accesses your Amazon S3 bucket by assuming an IAM Role in your AWS account. Create a role with the `Custom trust policy` role type and paste its ARN in the `Step 1` field on the Cloudback site. You can find more information on how to create a role in the [AWS IAM documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-custom.html). ### Choose an External ID Type a unique External ID in the `Step 2` field. Cloudback places this value in the trust policy generated in the `Step 5` field and sends it with every request to assume the role. ### Create Amazon S3 Bucket To upload backups to Amazon S3 Bucket, you need to create a bucket. You can skip this step if you already have a bucket. You can find more information on how to create a bucket in the [Amazon S3 documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/GetStartedWithS3.html#creating-bucket). Cloudback needs the ARN of the bucket to access it. To find the ARN, click on the name of your bucket in the S3 console and open the `Properties` tab. Copy the ARN and paste it in the `Step 3` field on the Cloudback site. ### Apply the permissions policy After you type a bucket ARN in the `Step 3` field, Cloudback will generate a permissions policy for you. The generated policy document is available in the `Step 4` field. You need to [create an IAM policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html) from it and [attach it](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) to your role to allow Cloudback to access the bucket. ### Apply the trust policy After you type an External ID in the `Step 2` field, Cloudback will generate a trust policy for you. The generated policy document is available in the `Step 5` field. You need to [apply this policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_update-role-trust-policy.html) to the trust relationship of your role to allow Cloudback to assume it. ### Provide the AWS Region (Optional) In the `Step 6` field, you can provide the AWS Region of the bucket. If you don't provide the region, Cloudback will try to determine it automatically using the `s3:GetBucketLocation` permission. ### Provide additional HTTP headers (Optional) In the `Step 7` field you can provide additional HTTP headers to be used when uploading backups to the Amazon S3 bucket. The headers can be used to set the [S3 Object Lock](/security-and-compliance/amazon-s3-object-lock.md) or [S3 Object Tagging](/supported-storages/amazon-s3-object-tagging.md) headers. ### Save storage Click on `Save` button to save the new storage. You can also use a `Test` button to check if the storage is configured correctly. After saving the storage, you can use it for storing backups of your repositories. All storage settings can be changed later in the `Storages` page. To edit the storage settings, click on the `Edit` button next to the storage you want to edit. ## Change the storage for a repository You can change the storage for a particular repository in the [Repository Details](/dashboard/repository-details.md) page. Also, you can assign it to multiple repositories through the [Bulk Operations](/managing-backups/bulk-operations.md). ## Learn More * [Customer Managed Storages](/storage-configuration/customer-managed-storages.md) * [Dashboard Overview](/dashboard/dashboard-overview.md) * [Repository Details](/dashboard/repository-details.md) * [Bulk Operations](/managing-backups/bulk-operations.md) * [Replicating Backups](/storage-configuration/replicating-backups.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.cloudback.it/supported-storages/amazon-s3-bucket-via-assume-role.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.