Amazon S3 Bucket via AssumeRole

Configure an Amazon S3 Bucket via IAM AssumeRole for your backups in Cloudback, granting access through temporary credentials instead of long-lived access keys.

About Amazon S3 Bucket

Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. This means customers of all sizes and industries can use it to store and protect any amount of data for a range of use cases, such as data lakes, websites, mobile applications, backup and restore, archive, enterprise applications, IoT devices, and big data analytics.

With the AssumeRole option, Cloudback accesses the bucket through an IAM Role in your own AWS account instead of a long-lived access key. Before each storage operation Cloudback assumes that role and receives temporary credentials, protected by an External ID that guards against the confused deputy problem.

Required permissions

s3:PutObject - required, for backup archive upload to Amazon S3 bucket
s3:ListBucket - required, so that a missing backup archive is reported as not found rather than access denied
s3:GetObject - optional, for backup restore and instant download from Amazon S3 bucket
s3:DeleteObject - optional, for retention policy, automatic removal of outdated backups from Amazon S3 bucket
s3:GetBucketLocation - optional, required to automatically determine the region of the bucket
s3:PutObjectRetention - optional, required for the S3 Object Lock header x-amz-object-lock-mode
s3:PutObjectLegalHold - optional, required for the S3 Object Lock header x-amz-object-lock-legal-hold
s3:PutObjectTagging - optional, required for the S3 Object Tagging header x-amz-tagging
kms:GenerateDataKey - required for a bucket encrypted with a customer managed KMS key, for backup archive upload
kms:Decrypt - required for a bucket encrypted with a customer managed KMS key, for backup restore and instant download

Set up Amazon S3 Bucket AssumeRole as a customer managed storage

To set up Amazon S3 Bucket AssumeRole as a storage for your backups, follow the steps below.

Create a new Amazon S3 AssumeRole storage

Open the Cloudback Dashboard
Navigate to the Storages page by clicking on the Storages link in the left-side navigation pane
Click on the Add a new storage button:

Type a storage name in the Storage name field. Use a name that will help you identify this storage in the future.
Select Amazon S3 AssumeRole from a Storage Provider dropdown:

Set up storage settings

Choose the settings for the storage:

Deduplication type - enable or disable data deduplication. For more details, please refer to the Deduplication documentation
Archive type - enable or disable archive password protection. For more details, please refer to the Password-Protected Archives documentation
Archive name pattern - configure the archive name pattern, which is used to generate the name of the backup archive. For more details, please refer to the Archive Name Pattern documentation

Create Amazon S3 Bucket

To upload backups to Amazon S3 Bucket, you need to create a bucket. You can skip this step if you already have a bucket. You can find more information on how to create a bucket in the Amazon S3 documentation.

Cloudback needs the ARN of the bucket to access it. To find the ARN, click on the name of your bucket in the S3 console and open the Properties tab. Copy the ARN and paste it in the Step 1 field on the Cloudback site.

Provide the KMS key ARN (Optional)

If your bucket is encrypted with a customer managed KMS key, tick the My bucket is encrypted with a customer managed KMS key checkbox in the Step 2 field and paste the ARN of that key. To find the key ARN, click on the name of your bucket in the S3 console, open the Properties tab and look at the Default encryption section.

Leave the checkbox unchecked if your bucket uses default encryption. Cloudback needs no KMS permissions in that case.

Apply the permissions policy

After you type a bucket ARN in the Step 1 field, Cloudback will generate a permissions policy for you. The generated policy document is available in the Step 2 field. You need to create an IAM policy from it and attach it to your role to allow Cloudback to access the bucket.

If you provided a KMS key ARN, the generated policy also grants the KMS permissions on that key.

Choose an External ID

Type a unique External ID in the Step 3 field. Cloudback places this value in the trust policy generated in the same field and sends it with every request to assume the role.

Create an IAM Role

Cloudback accesses your Amazon S3 bucket by assuming an IAM Role in your AWS account. After you type an External ID, Cloudback will generate a trust policy for you in the Step 3 field. Create a role with the Custom trust policy role type, paste the generated trust policy into it, then attach the permissions policy from the Step 2 field. You can find more information on how to create a role in the AWS IAM documentation.

Copy the ARN of the role you created and paste it in the Step 3 field on the Cloudback site.

Provide the AWS Region (Optional)

In the Step 4 field, you can provide the AWS Region of the bucket. If you don't provide the region, Cloudback will try to determine it automatically using the s3:GetBucketLocation permission.

Provide additional HTTP headers (Optional)

In the Step 5 field you can provide additional HTTP headers to be used when uploading backups to the Amazon S3 bucket. The headers can be used to set the S3 Object Lock or S3 Object Tagging headers.

Save storage

Click on Save button to save the new storage. You can also use a Test button to check if the storage is configured correctly. After saving the storage, you can use it for storing backups of your repositories.

All storage settings can be changed later in the Storages page. To edit the storage settings, click on the Edit button next to the storage you want to edit.

Change the storage for a repository

You can change the storage for a particular repository in the Repository Details page. Also, you can assign it to multiple repositories through the Bulk Operations.