Configuring AWS S3

AWS S3 is the most common storage destination. You'll need a bucket, and either an IAM user with limited permissions or a role VPS Snaps can use with no key at all.

Step 1 — Create a bucket

In the AWS console, go to S3 → Create Bucket. Choose a region close to your servers to minimize transfer costs. Keep 'Block all public access' enabled — backups should never be public.

No key at all: connect with an IAM role

Instead of Steps 2 to 4, you can let VPS Snaps in through a role, so there is no access key to store, rotate or leak. In VPS Snaps → Storage → Add Destination, choose AWS S3, fill in the name, bucket and region, then choose IAM role (no key) and Show the setup commands. Paste them into AWS CloudShell, signed in to the account that owns the bucket: they make an identity provider that trusts VPS Snaps for your workspace only, and a role with the policy below on that one bucket. Paste the role ARN they print and press Connect & test; VPS Snaps writes and deletes a test file before it saves anything. Every backup then gets credentials from AWS that expire within the hour.

Step 2 — Create an IAM user

Go to IAM → Users → Create User. Attach the following inline policy (replace YOUR_BUCKET_NAME). The last two actions clean up after an upload that was cut off: S3 keeps an unfinished upload's parts, billed and hidden from the bucket's file list, until something cancels them. Cancelling removes only those parts, never a finished backup. The last one only reads whether the bucket has Object Lock turned on, so the dashboard can show how long your backups are locked.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads",
        "s3:AbortMultipartUpload",
        "s3:GetBucketObjectLockConfiguration"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR_BUCKET_NAME",
        "arn:aws:s3:::YOUR_BUCKET_NAME/*"
      ]
    }
  ]
}

Step 3 — Generate access keys

In IAM → Users → your user → Security credentials → Create access key. Copy both the Access Key ID and Secret Access Key — the secret is shown only once.

Step 4 — Add to VPS Snaps

In VPS Snaps → Storage → Add Destination, select AWS S3, and fill in: bucket name, region (e.g. us-east-1), access key ID, and secret access key. Leave the endpoint URL blank for standard S3.