S3

Use an S3 source for backups stored in AWS S3 or a compatible object-storage service.

Required values

Prefer HTTPS. Use HTTP only on a network where you have deliberately accepted that credentials and backup data are not protected in transit.

Addressing style

• Path-style puts the bucket in the request path. It is commonly required by some S3-compatible services.
• Virtual-hosted puts the bucket in the host name. Do not use it with a bucket name containing dots.

Choose the style required by your provider. A correct endpoint with the wrong style can fail during listing or download.

Connect the bucket

1. 1

   Prepare credentials

   Create a least-privilege account that can list the required location and read backup objects. Put AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in a Kubernetes Secret; add AWS_SESSION_TOKEN if the credentials require one.

2. 2

   Register the secret metadata

   Create an S3 secret metadata entry using the exact Kubernetes Secret name. Place that Kubernetes Secret in every selected project worker's job namespace.

3. 3

   Create the source

   Open Sources, choose S3, complete the endpoint, region, bucket, and addressing fields, then select the S3 secret metadata.

4. 4

   Test through a schedule

   Create a schedule with a path inside the bucket and start a manual run. Confirm that file selection identifies the expected object and that the download stage completes.

Schedule paths

An S3 schedule path is a folder in the bucket, as it is for FTP, SFTP, and SMB. Only objects directly in that folder are considered: objects in subfolders are not, and neither are folders whose name merely starts the same way. A path of backups/db therefore never selects backups/db-staging/… or backups/db/archive/…. / is the bucket root.

A path that names an object rather than a folder finds nothing. Use Filename with date variables to select a specific file.

See Schedules for path patterns, date variables, and latest-file selection.