Set Up an AWS S3 Bucket

BYOVault's Storage tab asks for a bucket name plus an access key pair. Unlike Azure, AWS separates the bucket from the identity that's allowed to write to it — so this involves one extra step: creating a dedicated IAM user.

1. Create the bucket

  1. Go to the S3 console and click Create bucket.
  2. Bucket name: must be globally unique across all of AWS, lowercase, no underscores (e.g. acme-backup-2026). This is the Container / Bucket name field in BYOVault’s form.
  3. Pick a region — anything works, but note it for step 3.
  4. Leave every other setting at its default and click Create bucket.

2. Create a dedicated IAM user

AWS access keys belong to an IAM identity, not to the bucket itself — so BYOVault needs a user whose only job is writing to this one bucket.

  1. Go to the IAM console → Users → Create user.
  2. Name it anything (e.g. byovault-backup). Do not enable console access — this user only ever authenticates via access key, never signs into the AWS console.
  3. On the permissions step, choose Attach policies directly, then click Create policy to scope access to just this bucket rather than granting broad S3 access. Use the JSON editor and paste:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:DeleteObject"],
      "Resource": [
        "arn:aws:s3:::YOUR-BUCKET-NAME",
        "arn:aws:s3:::YOUR-BUCKET-NAME/*"
      ]
    }
  ]
}

Replace YOUR-BUCKET-NAME with the bucket you created in step 1, save the policy, then attach it to the new user.

If you also plan to use a locked retention vault
A retention-vault bucket needs Object Lock enabled at creation time, and the IAM policy needs one additional action: s3:PutBucketObjectLockConfiguration — note the exact name; the similarly-named s3:PutObjectLockConfiguration does not work and fails with an opaque AccessDenied error. See Retention Policy for the full vault provisioning flow.

3. Generate an access key

  1. On the new user’s page, go to the Security credentials tab.
  2. Under Access keys, click Create access key.
  3. Choose Application running outside AWS as the use case.
  4. Copy both the Access key ID and Secret access key — the secret is only ever shown once.

4. Enter it into BYOVault

Back in BYOVault, on the tenant’s Storage tab, select AWS S3 as the provider and fill in the bucket name, region, access key ID, and secret access key from above. See Storage Credentials for exactly how BYOVault stores these once you save them.

PreviousAzure Storage AccountNextYour Own Azure AD App