How to keep a copy of your cloud server backups on a Synology or QNAP NAS

Make a read-only key for the NAS

The NAS only reads. Give it its own key that can list the bucket and download from it, and cannot write or delete. If the NAS is ever compromised, your cloud backups stay safe.

On AWS, create an IAM user with this policy, replacing the bucket name:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::my-backup-bucket"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::my-backup-bucket/*"
    }
  ]
}

• Backblaze B2: an application key limited to the bucket, with Read Only access.
• Cloudflare R2: an API token with Object Read only permission, limited to the bucket.
• Wasabi, DigitalOcean Spaces and others: a key or policy limited to reading the one bucket, as each provider's guide in this library shows.

Synology: a Cloud Sync task that only downloads

1. Install Cloud Sync from Package Center, open it and click + (or Create).
2. Choose S3 Storage, not one of the named providers, and click Next.
3. Enter your provider's S3 endpoint as the server address (for example s3.us-east-1.amazonaws.com or s3.us-west-004.backblazeb2.com), the read-only access key and secret key, and pick the bucket. Set a remote path if your backups sit under a prefix.
4. Name the task, pick an empty shared folder on the NAS as the local path, and set the sync direction to Download remote changes only.
5. Leave data encryption off: that setting encrypts what Cloud Sync uploads, and this task uploads nothing.
6. Set a schedule, or leave it running continuously, and click Apply.

QNAP: an active sync job in HBS 3

1. Open Hybrid Backup Sync 3, go to Storage Spaces and create one of type Amazon S3 and S3 compatible, with your provider, endpoint, region, signature version and the read-only key.
2. Go to Sync and create an Active Sync Job: it pulls from a remote source to the NAS.
3. Pick the storage space and the bucket (or prefix) as the source, and an empty shared folder on the NAS as the destination.
4. Choose the action: Mirror or Copy (see below). Never Move, which deletes the backups from the bucket once they are copied.
5. Set a schedule, such as daily an hour after your backups run, and create the job.

Mirror or copy: what happens to old backups

Your backup tool deletes old backups from the bucket as its retention runs. What the NAS does next is up to you:

If the NAS keeps everything, it fills up over time. Delete old backups on the NAS yourself, or pick the mirroring behaviour and let the bucket's retention decide.

Check that the copy is complete

Compare the number of files and total size in the bucket with the folder on the NAS. From any computer with the AWS CLI (add --endpoint-url for providers other than AWS):

aws s3 ls s3://my-backup-bucket --recursive --summarize | tail -2

Then look at the folder's properties on the NAS. The counts should match, apart from backups made since the last sync.

Restoring from the NAS copy

The files on the NAS are exactly the files in the bucket: the same archives and database dumps. To restore one, copy it from the NAS share to the server (with scp, or upload it back to the bucket) and restore it the way you would from the cloud. Nothing about the copy ties it to the NAS.

Frequently asked questions

Will downloading backups to my NAS cost money?

Possibly. Most clouds charge for data downloaded from storage (egress). Cloudflare R2 charges no egress fees, and Wasabi none within its fair-use policy; on AWS S3 and others, check the price per GB before the first full sync.

Does the NAS need to be on all the time?

No. A scheduled sync catches up on whatever was added since the last time it ran.

Can a UniFi UNAS pull backups like this?

Not by itself: UniFi Drive backs up outwards only. Run rclone on another computer on your network and copy into a UNAS share, as described in the NAS comparison guide.