Provider guide

Back Up a Mac to Amazon S3

Amazon S3 is the reference object storage service behind the S3 API. Azivault can use an S3 bucket as an encrypted offsite backup destination.

When this setup makes sense

Users who already use AWS or want a mature object storage service with region choice, IAM controls, and lifecycle policies.

What to enter in Azivault

In Azivault, choose Create New Plan, select the source folder, then go to Storage. Set Destination type to S3 compatible.

• Bucket name: the bucket dedicated to the Azivault repository.
• Region: Use the AWS region where the bucket is created. Region and endpoint must match the bucket.
• Custom endpoint: Use the S3 endpoint for the bucket region, such as s3.us-east-1.amazonaws.com or the endpoint listed by AWS for your chosen region.
• Use path-style requests: Azivault turns this on by default when a custom endpoint is present, unless you manually change the toggle.
• Access key ID and secret access key: Use an IAM access key with least-privilege permissions for the backup bucket rather than broad account credentials.
• Session token: optional. Use it only if the provider issued one for the credentials.

Setup checklist

1. Create a private S3 bucket in the AWS region you want.
2. Create an IAM policy and access key limited to the bucket Azivault will use.
3. Enter the bucket, region, endpoint if needed, access key ID, and secret access key in Azivault.
4. Consider lifecycle policies only after you understand how they affect repository retention and restore windows.
5. Click Test in Azivault and wait for a healthy result before adding the plan.
6. Finish the schedule and recovery password steps, then add the plan.

What the storage test verifies

Azivault's S3 test is a real read/write check. It writes a small object under .azivault-health-check/, confirms the object exists, lists that prefix, reads the object back, and deletes it. If the test fails, review the bucket, region, endpoint URL, credentials, path-style setting, and network access.

Restore and disaster recovery

Existing backups remain restorable even if a subscription expires, but you still need the repository data, provider access, and the Azivault recovery password or synced Keychain key. For S3-compatible storage, plan how you would hydrate or copy the remote repository objects to a local folder, then import that repository folder into Azivault for restore browsing.

Amazon S3 backup risks

• Object lock support: Amazon S3 Object Lock can protect object versions with retention periods or legal holds, and requires versioning. Governance mode is easier to administer; compliance mode can prevent deletion even by the account root user until retention expires.
• Lifecycle rules: S3 lifecycle rules can expire objects, remove noncurrent versions, abort multipart uploads, or transition objects to colder storage. For backup repositories, avoid transitions or expirations that make recent restore points unavailable or slow to retrieve.
• Egress costs: AWS data transfer, request, retrieval, and storage-class fees vary by region and class. A full restore from Standard, Glacier, or another class can have very different cost and timing behavior.
• Regional durability: S3 is designed for high durability within a region, but one bucket in one region is still one regional dependency. Use cross-region replication or a second provider if your recovery plan needs regional independence.
• Access key scope: Use a least-privilege IAM user or role policy limited to the bucket and required S3 actions. Avoid long-lived administrator keys in backup configurations.
• Restore gotchas: The bucket region, endpoint, IAM policy, storage class, KMS settings, and recovery password all matter during recovery. If objects have transitioned to archival classes, restore them inside S3 before importing the repository locally.

Provider notes

• Avoid storage classes or lifecycle transitions that make recent backup objects unavailable for immediate restore.
• AWS account recovery and IAM key rotation are part of the backup plan.

Provider details can change. Check AWS S3 endpoint docs before creating a production backup plan.

See also S3-compatible backup for macOS, offsite backup for macOS, and how to restore files from an Azivault backup.

FAQs

Can Azivault back up to Amazon S3?

Yes. Azivault can use Amazon S3 as an S3-compatible backup destination with the bucket, region, endpoint, and access credentials described on this page.

Are files encrypted before they reach the provider?

Yes. Azivault encrypts repository contents locally before repository objects are written to folder or S3-compatible destinations.

What does Azivault's S3 test button check?

For S3-compatible destinations, Azivault writes a small health-check object, confirms it exists, lists the health-check prefix, reads it back, and deletes it.

How do I recover if the original Mac is gone?

Keep the provider account, storage credentials, and Azivault recovery password available. For remote S3-compatible repositories, hydrate or copy the repository objects to a local repository folder before importing it into Azivault.