Set Up an AWS S3 Bucket

BYOVault's Storage tab asks for a bucket name plus an access key pair. Unlike Azure, AWS separates the bucket from the identity that's allowed to write to it — so this involves one extra step: creating a dedicated IAM user.

1. Create the bucket

  1. Go to the S3 console and click Create bucket.
  2. Bucket name: must be globally unique across all of AWS, lowercase, no underscores (e.g. acme-backup-2026). This is the Container / Bucket name field in BYOVault’s form.
  3. Choose any AWS region; BYOVault does not require a specific region. Note it — you’ll enter it into BYOVault’s form later.
  4. Leave all other settings at their default values and click Create bucket.

2. Create a dedicated IAM user

AWS access keys belong to an IAM identity, not to the bucket itself — so BYOVault needs a user whose only job is writing to this one bucket.

  1. Go to the IAM console → Users → Create user.
  2. Choose any name that identifies its purpose (e.g. byovault-backup). Do not enable console access — this user only ever authenticates via access key, never signs into the AWS console.
  3. On the permissions step, choose Attach policies directly, then click Create policy to scope access to just this bucket rather than granting broad S3 access. Use the JSON editor and paste:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:DeleteObject"],
      "Resource": [
        "arn:aws:s3:::YOUR-BUCKET-NAME",
        "arn:aws:s3:::YOUR-BUCKET-NAME/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "sts:GetFederationToken",
      "Resource": "*"
    }
  ]
}

Replace YOUR-BUCKET-NAME with the bucket you created in step 1, save the policy, then attach it to the new user.

Why sts:GetFederationToken is required

BYOVault mints short-lived, narrowly-scoped temporary credentials (write-only, restricted to one backup job's own folder, a few hours' validity) rather than using this user's permanent access key directly for every upload. This requires sts:GetFederationToken — it can only ever narrow this user's own existing permissions, never grant anything beyond what's already attached above.

If you also plan to use a locked retention vault

A retention-vault bucket requires Object Lock to be enabled. AWS allows enabling Object Lock on an existing bucket via PutBucketObjectLockConfiguration (supported since November 2023), but BYOVault recommends enabling it at bucket creation time for simplicity.

The IAM policy needs one additional action: s3:PutBucketObjectLockConfiguration. Note the exact name — the similarly-named s3:PutObjectLockConfiguration does not work, and fails with an AccessDenied error that does not indicate which permission is missing.

See Retention Policy for the full vault provisioning flow.

3. Generate an access key

  1. On the new user’s page, go to the Security credentials tab.
  2. Under Access keys, click Create access key.
  3. Choose Application running outside AWS as the use case.
  4. Copy both the Access key ID and Secret access key — the secret is only ever shown once.

4. Enter it into BYOVault

Back in BYOVault, on the tenant’s Storage tab, select AWS S3 as the provider and fill in the bucket name, region, access key ID, and secret access key from above. See Storage Credentials for exactly how BYOVault stores these once you save them.

PreviousAzure Storage AccountNextYour Own Azure AD App