S3 Backup Settings

S3 Backup Settings enable ERPNext to automatically upload database and file backups to an Amazon S3-compatible object storage service such as AWS S3 or Hetzner Object Storage. This helps maintain secure off-site backups and provides an additional layer of disaster recovery.

Note: If you are using Frappe Cloud, onsite and offsite backups are automatically created. S3 Backup Settings are mainly intended for self-hosted ERPNext installations.

Prerequisites

Create an Email Account if you want ERPNext to send backup success or failure notifications.
Create an S3-compatible storage bucket (AWS S3, Hetzner Object Storage, MinIO compatible storage, etc.).
Generate an Access Key ID and Secret Access Key with permission to upload files.

Create an Amazon S3 Bucket

Create a new S3 bucket in your AWS account.
Enable Block all public access to ensure backup files remain private.
Optionally enable:
- Bucket Encryption
- Versioning
- Object Lock
These features improve backup security and retention.
Open IAM (Identity and Access Management).
Create a new IAM Policy allowing the following permissions:
- s3:ListBucket
- s3:PutObject
Example IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [{
      "Effect": "Allow",
      "Action": [
          "s3:PutObject",
          "s3:ListBucket"
      ],
      "Resource": [
          "arn:aws:s3:::*/*",
          "arn:aws:s3:::YOUR_TARGET_BUCKET"
      ],
      "Condition": {
          "IpAddress": {
              "aws:SourceIp": "YOUR_SERVER_IP"
          }
      }
  }]
}

Create an IAM User with Programmatic Access.
Attach the IAM policy created above to the user.
Copy the generated Access Key ID and Secret Access Key. These credentials will be required in ERPNext.
Optionally configure S3 Lifecycle Rules to automatically archive or delete older backups.

Create a Hetzner Object Storage Bucket (MinIO)

Create S3 credentials in the Hetzner Cloud Console.
Install the MinIO Client (mc).

Configure MinIO:

mc alias set MY_ALIAS https://nbg1.your-objectstorage.com YOUR_S3_KEY YOUR_S3_SECRET

Create a bucket with Object Lock enabled:

mc mb MY_ALIAS/BUCKET_NAME --with-lock --region nbg1

Configure a default retention period:

mc retention set GOVERNANCE 90d --default MY_ALIAS/BUCKET_NAME

Verify the retention configuration:

mc retention info --json --default MY_ALIAS/BUCKET_NAME

Use the following values in ERPNext:
- Endpoint URL – https://nbg1.your-objectstorage.com/
- Bucket Name – BUCKET_NAME
- Access Key ID – YOUR_S3_KEY
- Secret Access Key – YOUR_S3_SECRET

Configure S3 Backup Settings in ERPNext

Open S3 Backup Settings.
Enable Automatic Backup.
Enter the following details:
- Access Key ID
- Secret Access Key
- Bucket Name
- Endpoint URL (if using S3-compatible storage)
Specify an email address to receive backup notifications.
- Failure notifications are recommended.
- Enable Send Email for Successful Backup if success notifications are also required.
Choose the backup frequency:
- Daily
- Weekly
- Monthly
- None (manual backups only)
Save the configuration.

Restore Files from a Versioned Bucket

If bucket versioning is enabled, previous backup versions can be restored using MinIO.

List Available Versions

mc ls -r --versions MY_ALIAS/BUCKET_NAME/

Download a Specific Backup Version

mc get --vid TARGET_VERSION_ID MY_ALIAS/BUCKET_NAME/20260415_162402/20260415_162402-company_frappe_cloud-database.sql.gz ~/Downloads

Key Features

Automatic scheduled cloud backups.
Supports Amazon S3 and S3-compatible object storage.
Email notifications for backup success or failure.
Manual backup support.
Versioned backup restoration.
Compatible with AWS, Hetzner Object Storage, and other S3 services.

Best Practices

Enable bucket versioning to protect against accidental deletion.
Restrict bucket access using IAM policies and IP restrictions.
Configure lifecycle policies to automatically archive or remove old backups.
Regularly test backup restoration to ensure backups are usable.
Keep access credentials secure and rotate them periodically.

Rating: 0 / 5 (0 votes)