[{"data":1,"prerenderedAt":10},["ShallowReactive",2],{"public:public\u002Fcontent\u002Fdocs\u002Fwasabi":3},{"slug":4,"title":5,"description":6,"draft":7,"updated":8,"html":9},"wasabi","Wasabi","Write pg_dump backups to a Wasabi bucket and give Verestore a sub-user with a read-only, prefix-scoped policy.",false,null,"\u003Ch1>Wasabi\u003C\u002Fh1>\n\u003Cblockquote>\n\u003Cp>Verified against the provider's documentation, not against a live account.\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>A provider snapshot disappears with the account that holds it; a dump in a bucket you control is the copy that survives, and Verestore proves it restores.\u003C\u002Fp>\n\u003Ch2>1. Write dumps to Wasabi\u003C\u002Fh2>\n\u003Cp>Use the regional endpoint \u003Ccode>https:\u002F\u002Fs3.<region>.wasabisys.com\u003C\u002Fcode>, for example \u003Ccode>https:\u002F\u002Fs3.eu-central-1.wasabisys.com\u003C\u002Fcode>. With a separate read-write key for your backup job:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-sh\">pg_dump --format=custom --no-owner "$DATABASE_URL" \\\n  | aws --endpoint-url https:\u002F\u002Fs3.eu-central-1.wasabisys.com --region eu-central-1 \\\n      s3 cp - "s3:\u002F\u002Facme-backups\u002Forders\u002Forders-$(date -u +%Y-%m-%dT%H-%M).dump"\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>If a recent AWS CLI rejects the upload with a checksum or header error, set \u003Ccode>AWS_REQUEST_CHECKSUM_CALCULATION=when_required\u003C\u002Fcode> for the backup job.\u003C\u002Fp>\n\u003Cp>Verestore accepts \u003Ccode>pg_dump\u003C\u002Fcode> custom format (\u003Ccode>-Fc\u003C\u002Fcode>) or plain SQL, optionally gzipped. The format is detected from the content, not the file extension.\u003C\u002Fp>\n\u003Ch2>2. Create a read-only policy\u003C\u002Fh2>\n\u003Cp>Wasabi supports AWS-compatible IAM policies. In the Wasabi console, create a policy named \u003Ccode>verestore-read\u003C\u002Fcode> with:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-json\">{\n  "Version": "2012-10-17",\n  "Statement": [\n    {\n      "Sid": "ListOnlyThePrefix",\n      "Effect": "Allow",\n      "Action": "s3:ListBucket",\n      "Resource": "arn:aws:s3:::acme-backups",\n      "Condition": { "StringLike": { "s3:prefix": ["orders\u002F*"] } }\n    },\n    {\n      "Sid": "ReadOnlyThePrefix",\n      "Effect": "Allow",\n      "Action": "s3:GetObject",\n      "Resource": "arn:aws:s3:::acme-backups\u002Forders\u002F*"\n    }\n  ]\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch2>3. Create a sub-user for Verestore\u003C\u002Fh2>\n\u003Col>\n\u003Cli>Create a user named \u003Ccode>verestore-reader\u003C\u002Fcode> with \u003Cstrong>programmatic\u003C\u002Fstrong> (API key) access only, no console access.\u003C\u002Fli>\n\u003Cli>Attach the \u003Ccode>verestore-read\u003C\u002Fcode> policy and no other policy or group.\u003C\u002Fli>\n\u003Cli>Create an access key for the user and copy the access key and secret key. The secret is shown once.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>Verestore only lists objects under the prefix (\u003Ccode>ListObjectsV2\u003C\u002Fcode>) and reads \u003Ccode>orders\u002F*\u003C\u002Fcode>, pinned to the listed ETag. It never writes or deletes.\u003C\u002Fp>\n\u003Ch2>4. Add the target in Verestore\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>S3 endpoint: \u003Ccode>https:\u002F\u002Fs3.eu-central-1.wasabisys.com\u003C\u002Fcode> (your bucket's region, in the \u003Ccode>s3.<region>\u003C\u002Fcode> form)\u003C\u002Fli>\n\u003Cli>Region: \u003Ccode>eu-central-1\u003C\u002Fcode> (or leave it empty: it is filled from the endpoint)\u003C\u002Fli>\n\u003Cli>Bucket: \u003Ccode>acme-backups\u003C\u002Fcode>\u003C\u002Fli>\n\u003Cli>Prefix: \u003Ccode>orders\u002F\u003C\u002Fcode>\u003C\u002Fli>\n\u003Cli>Access key ID and secret access key: from the sub-user's key\u003C\u002Fli>\n\u003C\u002Ful>\n",1794290783591]