Amazon S3

1. Set up the storage

1. Sign in to the AWS Management Console and open S3.

2. Create bucket. Pick a globally unique name and a region close to you, and leave Block all public access on - your backups are private.

3. Open IAM > Users > Create user (programmatic access), or create an access key for an existing user.

4. Attach a policy limited to this one bucket. A minimal policy allows s3:ListBucket and s3:ListBucketMultipartUploads on the bucket, and s3:GetObject, s3:PutObject, s3:DeleteObject, s3:AbortMultipartUpload and s3:ListMultipartUploadParts on arn:aws:s3:::YOUR-BUCKET/*.

   The multipart permissions matter more than they look. Backups are uploaded in parts, and a run that is cancelled or interrupted can leave an unfinished upload behind. AWS bills those parts as stored data, and they do not show up when you list the bucket’s contents - so without permission to clear them, they accumulate quietly and the first sign is the bill. As a second line of defence, add an S3 lifecycle rule to delete incomplete multipart uploads after 7 days; that is good practice on any backup bucket regardless of the key’s permissions.

5. Copy the Access key ID and Secret access key - the secret is shown only once.

2. Connect it in Nyx Backup

New backup set > destination Amazon S3, then enter:

• Bucket - the bucket name.
• Region - the bucket’s region (for example us-east-1).
• Access key ID and Secret access key - from step 5.
• Storage class (optional) - leave as the default, or pick a cheaper cold tier. See Cold storage tiers below.

Once Test connection succeeds, set a schedule and retention, save the set, and choose Run now. Nyx Backup encrypts everything on your machine before upload, so this destination only ever holds encrypted blobs. Give each machine its own bucket or folder - see Connecting storage.

Tip: scope the key to just this bucket.

On IAM roles: Nyx Backup authenticates with an access key ID and secret - that is, an IAM user. It does not use IAM roles, instance profiles, or temporary STS credentials, so on an EC2 instance you still create a scoped key rather than attaching a role. Rotate the key by creating a new one, updating the backup set, and deleting the old one.

Cold storage tiers

S3 offers cheaper tiers for data you rarely restore. Set one in the Storage class field:

• Instant-access cold - Standard-IA and Glacier Instant Retrieval. Cheaper to store, read immediately, with a small per-GB retrieval fee and a minimum storage duration. A good default for backups.
• Deep archive - Glacier Flexible Retrieval and Glacier Deep Archive. Cheapest to store, but objects are offline and must be warmed before they can be read. When you restore, Nyx Backup requests the warm-up and waits for it, then downloads - you choose the retrieval speed (Standard, Bulk, or Expedited) and how long the warmed copy stays available. Warming takes minutes to hours depending on the tier and speed, and AWS charges a retrieval fee.

Cold tiers bill a minimum storage duration, so data that changes constantly can cost more than its live size suggests. They suit archives you keep and rarely touch, not fast-churning folders.