12
edits
Backing up Object Store: Difference between revisions
Jump to navigation
Jump to search
m
Confirm policy applied section added.
m (Slight re-wording of first para. Minor spelling corrections.) |
m (Confirm policy applied section added.) |
||
| Line 18: | Line 18: | ||
Please follow this procedure to request backups of your buckets. | Please follow this procedure to request backups of your buckets. | ||
== | ==Email the list of buckets== | ||
Send a list of buckets to | Send a list of buckets to backup to [mailto:juno@calculquebec.ca sd4h support] with the name and ID of the project where the buckets live. | ||
==Give us permission== | ==Give us permission== | ||
An iam policy statement must be applied to '''all the buckets''' you want to backup so the TSM robot user in charge of the backup can access them. This can be done with the [https://awscli.amazonaws.com/v2/documentation/api/latest/index.html aws cli]. | |||
First, ensure that <code>my-bucket</code> currently has no policy. Check bucket <code>my-bucket</code> using profile <code>my-profile</code> (as defined in ~/.aws/config and ~/.aws/credentials files): | |||
<pre>$aws s3api get-bucket-policy --profile c3g-data-repos --bucket my-bucket | |||
<pre>$aws s3api --profile | |||
An error occurred (NoSuchBucketPolicy) when calling the GetBucketPolicy operation: The bucket policy does not exist | An error occurred (NoSuchBucketPolicy) when calling the GetBucketPolicy operation: The bucket policy does not exist | ||
</pre> | </pre> | ||
If that command returns something, | If that command returns something, the new policy statements must be added to the existing policy (which is not covered here). | ||
The following policy.json needs to be applied. | |||
<div class="filename">'''File :''' policy.json </div> | <div class="filename">'''File :''' policy.json </div> | ||
<syntaxhighlight lang=json file=my-policy.json> | <syntaxhighlight lang="json" file="my-policy.json"> | ||
{ | { | ||
"Statement": [ | "Statement": [ | ||
| Line 51: | Line 49: | ||
"Resource": [ | "Resource": [ | ||
"arn:aws:s3:::my-bucket/*", | "arn:aws:s3:::my-bucket/*", | ||
"arn:aws:s3:::my- | "arn:aws:s3:::my-bucket" | ||
] | ] | ||
} | } | ||
| Line 58: | Line 56: | ||
</syntaxhighlight> | </syntaxhighlight> | ||
Load the policy onto the bucket <code>my-bucket</code> using the profile <code>my-profile</code> | |||
<pre> | <pre> | ||
$aws s3api | $aws s3api put-bucket-policy --policy file://my-policy.json --profile my-profile --bucket my-bucket | ||
</pre> | </pre> | ||
== Confirm policy applied == | |||
As we did before, request the bucket's IAM policy, ensuring that the contents of policy.json are listed. | |||
$aws s3api get-bucket-policy --profile c3g-data-repos --bucket my-bucket | |||
=Restore Procedure= | =Restore Procedure= | ||