Xopero ONE supports the majority of the most popular cloud service providers compatible with S3:

• Xopero ONE cloud (storage provided by Xopero)

• AWS (Amazon Web Services)

• Wasabi

• Azure Blob Storage

• Backblaze B2

• Google Cloud Storage

• other S3 compliant

Sending backup tasks to S3 cloud storage has a limit (buffer). The default buffer value is 128 MB, which limits both the maximum data size and the minimum internet speed. If your network environment or S3 endpoint has no additional restrictions, the minimum required upload speed is ~0.64 Mbit/s.

Xopero ONE supports S3-type immutable storage as a backup location. This feature is available for some of cloud storages supported by Xopero ONE (AWS, Wasabi, Backblaze B2 and Google Cloud Storage). Datastores of this type allow you to freely save and read data, but modification and deletion are only possible after meeting the bucket’s retention policies.

Advantages:

• Protection against ransomware and other threats (cyberattacks) – files in immutable storage are read-only and immune to loss, accidental deletion, corruption, and other issues that could compromise your data.

• Prevention of accidental file deletion – when access to important or critical data is shared, the risk of deletion or modification increases, which immutable storage feature prevents.

• Preservation of file authenticity – ensures data accuracy by preventing modification or manipulation of uploaded files.

This article outlines the minimum permissions needed to use an AWS S3 bucket as backup storage for Xopero ONE. The policies below enable you to integrate your AWS S3 storage with Xopero ONE.

AWS bucket policy

The bucket that will be used to store the data must have the following policy (JSON) assigned:

{
     "Version": "2012-10-17",
     "Statement": [
          {
               "Effect": "Allow",
               "Principal": {
                    "AWS": "arn:aws:iam::{account}:user/backup-user"
          },
               "Action": [
                    "s3:ListBucket",
                    "s3:GetObject",
                    "s3:PutObject",
                    "s3:DeleteObject"
                
               ],
               "Resource": [
                    "arn:aws:s3:::bucket-name",
                    "arn:aws:s3:::bucket-name/*"
               ]
          }
     ]
}

Support for immutable storage

If you want to use immutable storage, the following permissions are required:

s3:GetBucketObjectLockConfiguration

s3:GetBucketVersioning

It must be added to the Action section, and after the changes, the section should look as shown below:

"Action": [
                    "s3:ListBucket",
                    "s3:GetObject",
                    "s3:PutObject",
                    "s3:DeleteObject",
		    "s3:GetBucketVersioning",
	            "s3:GetBucketObjectLockConfiguration"
               ],

Useful links and items

Application key restrictions

If an app key is restricted to a bucket, the listAllBucketNames permission is required for compatibility with SDKs and integrations. This permission can be enabled during creation in the web UI or via the b2_create_key API call.

As a rule, both writeFiles and deleteFiles permissions must be assigned to any key used for deleting files in the S3 compatible API.

Support for immutable storage

If you want to use immutable storage, the following permissions are required:

s3:GetBucketObjectLockConfiguration

configuration.s3:GetBucketVersioning

It must be added to the Action section, and after the changes, the section should look as shown below:

IAM roles and permission

To use Google Cloud Storage as backup storage in the Xopero ONE service, it is recommended to assign the Storage Admin IAM role (roles/storage.admin – full control of buckets and objects) to the GCS user, or create a service account with the minimal permission set:

1. storage.objects.list

2. storage.objects.get

3. storage.objects.create

4. storage.objects.delete

If you want to use immutable storage, the following permissions are required:

It must be added to the Action section, and after the changes, the section should look as shown below:

IAM policy configuration

To increase security and eliminate the use of tokens, you can disable access/secret keys for your AWS buckets and use integration via IAM rules. This approach, however, has specific requirements—integrating a bucket using IAM rules involves creating an IAM policy accessible to Amazon EC2 and designating an EC2 instance that can communicate directly with the bucket.

Since the Xopero machine template is not available in EC2, you must create an instance using a supported operating system and install the Xopero worker on it.

Steps for an AWS administrator:

1. Create an IAM role accessible to EC2.

2. Add a policy to the created role.

3. Assign the role to the selected EC2 instance.

4. Install the backup worker on the EC2 instance.

In the Xopero ONE Management Service (XMS) admin panel, enable the Use Amazon IAM toggle and specify your EC2 worker in the Default worker section at the bottom.

Integration methods

After creating the storage account and a blob container, you can integrate them using one of two methods— access keys or a shared access signature (SAS):

1. Access keys provide full administrative access to your storage account, allowing any operation. They are suitable for scenarios requiring complete control but must be handled carefully due to their high level of access.

2. A shared access signature (SAS) offers more granular control, allowing access to specific resources for a limited time with restricted permissions. This method is ideal for scenarios where you need to grant a temporary access to clients or applications without exposing primary keys, enhancing security and flexibility in managing storage resources.

Minimal required permissions to configure Azure Blob Storage for use with:

1. Allowed services:

• Blob

1. Allowed resource types:

• Container

• Objects

1. Allowed permissions:

• Read

• Write

• Delete

1. Allowed permissions for replication:

• Read

• Write

• Delete

1. Login to the Azure portal as an administrator.

2. Select the storage account and click Shared Access Signature in the Settings tab.

3. Select the permissions described in the section of this article.

1. For setting up the blob storage, you will need the connection string:

1. Login to the Azure portal as an administrator.

2. Select the storage account.

3. Go to Access keys under the Security + networking menu section.

1. For setting up the blob storage, you will need the connection string:

This article lists the minimal permissions required for a Wasabi bucket to be used as backup storage in Xopero ONE. The policies below allow you to add your Wasabi storage to the Xopero ONE platform, store backup data, and restore it when needed.

Wasabi bucket policy

Access keys are generated for each Wasabi user account. You can view the list of access keys by logging in to your Wasabi account and navigating to the Access Keys tab.

To create a new user account or edit an existing one, go to the Users tab. In the Policies section, select WasabiReadOnlyAccess and WasabiWriteOnlyAccess, according to your needs.

If you want to use immutable storage, the following permissions are required:

It must be added to the Action section, and after the changes, the section should look as shown below:

arn:aws:iam::100000176259:user/xone-storage - Wasabi user

arn:aws:s3:::xopero-test - Wasabi bucket