AWS S3 Storage Setup

This step-by-step tutorial guides you through setting up Amazon S3 as a storage destination for your FireBackup backups. By the end, you'll have a secure, properly configured S3 bucket ready to store your encrypted Firebase backups.

What You'll Learn

• Create and configure an S3 bucket with proper security settings
• Set up IAM policies with least-privilege access
• Configure lifecycle rules for cost optimization
• Enable cross-region replication for disaster recovery
• Connect S3 to FireBackup

Prerequisites

Before starting, ensure you have:

• An AWS account with administrative access
• AWS CLI installed and configured (optional but recommended)
• Access to FireBackup dashboard as an organization admin

Time Required

Approximately 20-30 minutes

---

Step 1: Create an S3 Bucket

Using AWS Console

1. Navigate to the S3 Console

2. Click Create bucket

3. Configure bucket settings:

   Setting	Value
   Bucket name	your-company-firebackup-prod
   AWS Region	Select closest to your users
   Object Ownership	ACLs disabled (recommended)

4. Block Public Access settings:

   • ✅ Block all public access (keep enabled)

5. Bucket Versioning:

   • Enable versioning (recommended for backup recovery)

6. Default encryption:

   • Server-side encryption: Enable
   • Encryption type: SSE-S3 or SSE-KMS
   • If using SSE-KMS, select or create a KMS key

7. Click Create bucket

Using AWS CLI

# Create the bucket
aws s3api create-bucket \
  --bucket your-company-firebackup-prod \
  --region us-east-1

# For regions other than us-east-1, add location constraint
aws s3api create-bucket \
  --bucket your-company-firebackup-prod \
  --region eu-west-1 \
  --create-bucket-configuration LocationConstraint=eu-west-1

# Enable versioning
aws s3api put-bucket-versioning \
  --bucket your-company-firebackup-prod \
  --versioning-configuration Status=Enabled

# Enable default encryption
aws s3api put-bucket-encryption \
  --bucket your-company-firebackup-prod \
  --server-side-encryption-configuration '{
    "Rules": [{
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "AES256"
      },
      "BucketKeyEnabled": true
    }]
  }'

# Block public access
aws s3api put-public-access-block \
  --bucket your-company-firebackup-prod \
  --public-access-block-configuration '{
    "BlockPublicAcls": true,
    "IgnorePublicAcls": true,
    "BlockPublicPolicy": true,
    "RestrictPublicBuckets": true
  }'

---

Step 2: Create IAM Policy

Create a least-privilege policy that grants only the permissions FireBackup needs.

Create the Policy

1. Navigate to IAM Console → Policies → Create policy

2. Switch to the JSON tab and paste:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "FireBackupListBucket",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": "arn:aws:s3:::your-company-firebackup-prod"
    },
    {
      "Sid": "FireBackupObjectOperations",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:GetObjectVersion"
      ],
      "Resource": "arn:aws:s3:::your-company-firebackup-prod/*"
    },
    {
      "Sid": "FireBackupMultipartUpload",
      "Effect": "Allow",
      "Action": [
        "s3:ListMultipartUploadParts",
        "s3:AbortMultipartUpload"
      ],
      "Resource": "arn:aws:s3:::your-company-firebackup-prod/*"
    }
  ]
}

3. Click Next, name the policy FireBackupS3Access, and create it

Optional: Restrict by Path Prefix

To limit access to a specific folder within the bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "FireBackupListBucket",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::your-company-firebackup-prod",
      "Condition": {
        "StringLike": {
          "s3:prefix": ["backups/*"]
        }
      }
    },
    {
      "Sid": "FireBackupObjectOperations",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::your-company-firebackup-prod/backups/*"
    }
  ]
}

---

Step 3: Create IAM User

Create a dedicated IAM user for FireBackup.

Using AWS Console

1. Navigate to IAM → Users → Create user

2. Enter username: firebackup-service

3. Do NOT select "Provide user access to the AWS Management Console"

4. Click Next

5. Set permissions:

   • Select "Attach policies directly"
   • Search for and select FireBackupS3Access

6. Click Next, then Create user

Generate Access Keys

1. Click on the newly created user

2. Go to Security credentials tab

3. Under Access keys, click Create access key

4. Select "Application running outside AWS"

5. Click Create access key

6. Save the credentials securely!

   • Access key ID: AKIA...
   • Secret access key: Will only be shown once

# Alternatively, using CLI:
aws iam create-user --user-name firebackup-service

aws iam attach-user-policy \
  --user-name firebackup-service \
  --policy-arn arn:aws:iam::YOUR_ACCOUNT_ID:policy/FireBackupS3Access

aws iam create-access-key --user-name firebackup-service

caution

Store your secret access key securely. It cannot be retrieved after initial creation.

---

Step 4: Configure Lifecycle Rules

Set up lifecycle rules to optimize storage costs by automatically transitioning older backups to cheaper storage classes.

Using AWS Console

1. Go to your bucket → Management → Create lifecycle rule

2. Rule name: firebackup-lifecycle

3. Choose rule scope: Apply to all objects in the bucket

4. Lifecycle rule actions:

Transition	Days	Storage Class
Current versions	30	S3 Standard-IA
Current versions	90	S3 Glacier Instant Retrieval
Current versions	365	S3 Glacier Deep Archive

5. Expiration (optional):
   • Delete expired object delete markers
   • Delete incomplete multipart uploads after 7 days

Using AWS CLI

aws s3api put-bucket-lifecycle-configuration \
  --bucket your-company-firebackup-prod \
  --lifecycle-configuration '{
    "Rules": [
      {
        "ID": "firebackup-lifecycle",
        "Status": "Enabled",
        "Filter": {},
        "Transitions": [
          {
            "Days": 30,
            "StorageClass": "STANDARD_IA"
          },
          {
            "Days": 90,
            "StorageClass": "GLACIER_IR"
          },
          {
            "Days": 365,
            "StorageClass": "DEEP_ARCHIVE"
          }
        ],
        "AbortIncompleteMultipartUpload": {
          "DaysAfterInitiation": 7
        }
      }
    ]
  }'

Cost Optimization Example

For 100GB of monthly backups:

Storage Class	Monthly Cost
S3 Standard (< 30 days)	~$2.30
S3 Standard-IA (30-90 days)	~$1.25
Glacier IR (90-365 days)	~$0.40
Deep Archive (> 365 days)	~$0.10

---

Step 5: Enable Cross-Region Replication (Optional)

For disaster recovery, replicate backups to another AWS region.

Create Destination Bucket

1. Create a bucket in a different region (e.g., your-company-firebackup-dr in eu-west-1)

2. Enable versioning on the destination bucket

Create Replication IAM Role

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetReplicationConfiguration",
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::your-company-firebackup-prod"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObjectVersionForReplication",
        "s3:GetObjectVersionAcl",
        "s3:GetObjectVersionTagging"
      ],
      "Resource": "arn:aws:s3:::your-company-firebackup-prod/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ReplicateObject",
        "s3:ReplicateDelete",
        "s3:ReplicateTags"
      ],
      "Resource": "arn:aws:s3:::your-company-firebackup-dr/*"
    }
  ]
}

Configure Replication

aws s3api put-bucket-replication \
  --bucket your-company-firebackup-prod \
  --replication-configuration '{
    "Role": "arn:aws:iam::YOUR_ACCOUNT_ID:role/S3ReplicationRole",
    "Rules": [
      {
        "ID": "ReplicateAllBackups",
        "Status": "Enabled",
        "Priority": 1,
        "Filter": {},
        "Destination": {
          "Bucket": "arn:aws:s3:::your-company-firebackup-dr",
          "StorageClass": "STANDARD_IA"
        },
        "DeleteMarkerReplication": {
          "Status": "Disabled"
        }
      }
    ]
  }'

---

Step 6: Connect to FireBackup

Now connect your S3 bucket to FireBackup.

Using the Dashboard

1. Log in to FireBackup

2. Navigate to Settings → Storage

3. Click Add Storage Destination

4. Select Amazon S3

5. Enter your configuration:

   Field	Value
   Name	Production S3
   Bucket	your-company-firebackup-prod
   Region	us-east-1
   Access Key ID	AKIA...
   Secret Access Key	Your secret key
   Path Prefix	backups/ (optional)

6. Click Test Connection to verify

7. Click Save

Using the API

curl -X POST https://api.firebackup.io/api/v1/storage \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production S3",
    "type": "s3",
    "config": {
      "bucket": "your-company-firebackup-prod",
      "region": "us-east-1",
      "accessKeyId": "AKIA...",
      "secretAccessKey": "your-secret-key",
      "prefix": "backups/"
    }
  }'

---

Step 7: Verify the Setup

Run a test backup to verify everything is working.

1. Go to Projects → Select a project

2. Click Run Backup Now

3. Select your S3 storage destination

4. Monitor the backup progress

5. Once complete, verify the backup in S3:

aws s3 ls s3://your-company-firebackup-prod/backups/ --recursive

Expected output:

2024-01-15 10:30:45    1048576 backups/proj_abc123/2024-01-15/backup_full_1705312245.enc

---

Troubleshooting

Common Issues

"Access Denied" Error

Cause: IAM policy doesn't have required permissions

Solution:

1. Verify the IAM policy is attached to the user
2. Check the bucket name in the policy matches exactly
3. Ensure no S3 bucket policy is blocking access

# Check user's attached policies
aws iam list-attached-user-policies --user-name firebackup-service

# Verify bucket policy isn't blocking
aws s3api get-bucket-policy --bucket your-company-firebackup-prod

"Bucket Not Found" Error

Cause: Incorrect bucket name or region mismatch

Solution:

1. Verify bucket exists in the specified region
2. Check for typos in bucket name

aws s3api head-bucket --bucket your-company-firebackup-prod --region us-east-1

"InvalidAccessKeyId" Error

Cause: Access key is incorrect or has been deactivated

Solution:

1. Verify the access key in IAM console
2. Generate new access keys if needed
3. Update credentials in FireBackup

Large Backup Failures

Cause: Multipart upload timeout or incomplete parts

Solution:

1. Increase timeout settings
2. Check for incomplete multipart uploads:

aws s3api list-multipart-uploads --bucket your-company-firebackup-prod

3. Clean up incomplete uploads:

aws s3api abort-multipart-upload \
  --bucket your-company-firebackup-prod \
  --key "path/to/object" \
  --upload-id "upload-id"

---

Security Best Practices

Enable CloudTrail Logging

Monitor all S3 API calls:

aws cloudtrail create-trail \
  --name firebackup-s3-trail \
  --s3-bucket-name your-cloudtrail-bucket \
  --include-global-service-events

Enable S3 Access Logging

aws s3api put-bucket-logging \
  --bucket your-company-firebackup-prod \
  --bucket-logging-status '{
    "LoggingEnabled": {
      "TargetBucket": "your-logs-bucket",
      "TargetPrefix": "s3-access-logs/"
    }
  }'

Use VPC Endpoints (Enterprise)

For enhanced security, access S3 through a VPC endpoint:

aws ec2 create-vpc-endpoint \
  --vpc-id vpc-xxx \
  --service-name com.amazonaws.us-east-1.s3 \
  --route-table-ids rtb-xxx

---

Next Steps

• Configure backup schedules for automatic backups
• Set up webhooks for backup notifications
• Enable PITR for point-in-time recovery

---

Related

• GCS Setup - Alternative cloud storage
• DO Spaces Setup - DigitalOcean storage
• Storage API Reference - API documentation