[{"data":1,"prerenderedAt":10},["ShallowReactive",2],{"public:public\u002Fcontent\u002Fdocs\u002Fscaleway":3},{"slug":4,"title":5,"description":6,"draft":7,"updated":8,"html":9},"scaleway","Scaleway","Read-only Object Storage access for Verestore with an IAM application, a project-scoped policy and a bucket policy.",false,null,"\u003Ch1>Scaleway (Managed Database for PostgreSQL or self-managed)\u003C\u002Fh1>\n\u003Ch2>1. Write dumps to Object Storage\u003C\u002Fh2>\n\u003Cp>Managed Database backups stay inside Scaleway's service, so keep a logical backup in a bucket you own:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-sh\">pg_dump --format=custom --no-owner "$DATABASE_URL" \\\n  | aws --endpoint-url https:\u002F\u002Fs3.fr-par.scw.cloud s3 cp - "s3:\u002F\u002Facme-backups\u002Forders\u002Forders-$(date -u +%Y-%m-%dT%H-%M).dump"\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch2>2. Create an IAM application for Verestore\u003C\u002Fh2>\n\u003Col>\n\u003Cli>\u003Cstrong>IAM → Applications → Create application\u003C\u002Fstrong>, for example \u003Ccode>verestore-reader\u003C\u002Fcode>.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>IAM → Policies → Create policy\u003C\u002Fstrong> for that application, scoped to the bucket's \u003Cstrong>project\u003C\u002Fstrong>, with the permission sets \u003Ccode>ObjectStorageBucketsRead\u003C\u002Fcode> and \u003Ccode>ObjectStorageObjectsRead\u003C\u002Fcode>.\u003C\u002Fli>\n\u003Cli>Create an \u003Cstrong>API key\u003C\u002Fstrong> for the application. Its access key and secret key are what you give Verestore.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2>3. Limit it to the prefix with a bucket policy\u003C\u002Fh2>\n\u003Cp>IAM permission sets apply to the whole project. This bucket policy narrows the application to reading one prefix:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-json\">{\n  "Version": "2023-04-17",\n  "Id": "verestore-read-only",\n  "Statement": [\n    {\n      "Sid": "VerestoreReadPrefix",\n      "Effect": "Allow",\n      "Principal": { "SCW": "application_id:YOUR-APPLICATION-ID" },\n      "Action": ["s3:GetObject"],\n      "Resource": ["acme-backups\u002Forders\u002F*"]\n    },\n    {\n      "Sid": "VerestoreList",\n      "Effect": "Allow",\n      "Principal": { "SCW": "application_id:YOUR-APPLICATION-ID" },\n      "Action": ["s3:ListBucket"],\n      "Resource": ["acme-backups"]\n    }\n  ]\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>A bucket policy replaces the default access for everyone, so add statements for your own users and applications before applying it. Listing reveals object \u003Cstrong>names\u003C\u002Fstrong> in the whole bucket, never their content; for strict scoping, use a dedicated bucket per database.\u003C\u002Fp>\n\u003Cp>Add the target with endpoint \u003Ccode>https:\u002F\u002Fs3.fr-par.scw.cloud\u003C\u002Fcode> (or your region), region \u003Ccode>fr-par\u003C\u002Fcode>, the bucket and prefix \u003Ccode>orders\u002F\u003C\u002Fcode>.\u003C\u002Fp>\n",1794290783591]