[Yandex Cloud documentation](../../index.md) > [Yandex Object Storage](../index.md) > [Tutorials](index.md) > Backups > Backing up to Object Storage with AWS S3 Sync

# Backing up to Yandex Object Storage with AWS S3 Sync

In this tutorial, you will set up backup of local files to [Yandex Object Storage](../index.md) using [AWS S3 Sync](https://docs.aws.amazon.com/cli/latest/reference/s3/sync.html).

AWS S3 Sync is a standard [AWS CLI](../tools/aws-cli.md) command for syncing content between a local folder and a [bucket](../concepts/bucket.md). This is a simple and reliable way to back up your files to S3-compatible cloud object storage.

Features of AWS S3 Sync:

* Requires no additional software other than the AWS CLI.
* Supported on Linux, Windows, and macOS.
* Easy setup and direct access to the S3 API.
* Simple automation with a task scheduler or scripts.

To configure backup with AWS S3 Sync:

1. [Get your cloud ready](#before-begin).
1. [Create a bucket](#create-bucket).
1. [Create a service account](#create-sa).
1. [Create a static access key](#create-static-key).
1. Install the [AWS CLI](#install-aws).
1. [Synchronize the local folder with the bucket](#sync).

If you no longer need the resources you created, [delete them](#clear-out).


## Getting started {#before-you-begin}

Sign up for Yandex Cloud and create a [billing account](../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../billing/quickstart/index.md) and [link](../../billing/operations/pin-cloud.md) a cloud to it.

If you have an active billing account, you can create or select a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).

[Learn more about clouds and folders here](../../resource-manager/concepts/resources-hierarchy.md).


### Required paid resources {#paid-resources}

The bucket support cost includes the fee for bucket data storage and data operations (see [Yandex Object Storage pricing](../pricing.md)).


## Create a bucket {#create-bucket}

{% note info %}

To protect your backups from accidental file deletion, enable [S3 bucket versioning](../operations/buckets/versioning.md). This way, deleted or overwritten files will be saved as previous versions you can [restore](../operations/objects/restore-object-version.md) if needed. For more information about S3 bucket versioning, see [this guide](../concepts/versioning.md).

Without versioning, you will not be able to restore files deleted from S3, even if previously copied.

{% endnote %}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), navigate to the relevant folder.
  1. Navigate to **Object Storage**.
  1. Click **Create bucket**.
  1. Enter a name for the bucket in line with the [naming requirements](../concepts/bucket.md#naming).
  1. In the **Read objects**, **Read object list**, and **Read settings** fields, select `With authorization`.
  1. Click **Create bucket**.

- AWS CLI {#cli}

  1. If you do not have the AWS CLI yet, [install and configure it](../tools/aws-cli.md).
  1. Create a bucket by entering its name consistent with the [naming conventions](../concepts/bucket.md#naming):

      ```bash
      aws --endpoint-url=https://storage.yandexcloud.net \
        s3 mb s3://<bucket_name>
      ```

      Result:

      ```text
      make_bucket: backup-bucket
      ```

- API {#api}

  Use the [create](../api-ref/Bucket/create.md) REST API method for the [Bucket](../api-ref/Bucket/index.md) resource, the [BucketService/Create](../api-ref/grpc/Bucket/create.md) gRPC API call, or the [create](../s3/api-ref/bucket/create.md) S3 API method.

{% endlist %}


## Create a service account {#create-sa}

Create a [service account](../../iam/concepts/users/service-accounts.md) to be used for backups.

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the relevant folder.
  1. Navigate to **Identity and Access Management**.
  1. Click **Create service account**.
  1. In the **Name** field, specify `sa-backup-to-s3`.
  1. Click ![image](../../_assets/console-icons/plus.svg) **Add role** and select [`storage.editor`](../security/index.md#storage-editor).
  1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. Create a service account:

      ```bash
      yc iam service-account create --name sa-backup-to-s3 \
        --folder-name <folder_name>
      ```

      Result:

      ```yaml
      id: ajeab0cnib1p********
      folder_id: b0g12ga82bcv********
      created_at: "2025-10-03T09:44:35.989446Z"
      name: sa-backup-to-s3
      ```

  1. Assign the `storage.editor` [role](../security/index.md#storage-editor) for the folder to the service account:

      ```bash
      yc resource-manager folder add-access-binding <folder_name> \
        --service-account-name sa-backup-to-s3 \
        --role storage.editor \
        --folder-name <folder_name>
      ```

      Result:

      ```text
      effective_deltas:
        - action: ADD
          access_binding:
            role_id: storage.editor
            subject:
              id: ajeab0cnib1p********
              type: serviceAccount
      ```

- API {#api}

  1. Create a service account named `sa-backup-to-s3`. Do it by using the [create](../../iam/api-ref/ServiceAccount/create.md) REST API method for the [ServiceAccount](../../iam/api-ref/ServiceAccount/index.md) resource or the [ServiceAccountService/Create](../../iam/api-ref/grpc/ServiceAccount/create.md) gRPC API call.
  1. Assign the `storage.editor` [role](../security/index.md#storage-editor) for the current folder to the the service account. Do it by using the [setAccessBindings](../../resource-manager/api-ref/Folder/setAccessBindings.md) REST API method for the [Folder](../../resource-manager/api-ref/Folder/index.md) resource or the [FolderService/SetAccessBindings](../../resource-manager/api-ref/grpc/Folder/setAccessBindings.md) gRPC API call.

{% endlist %}

{% note info %}

To work with objects in an [encrypted](../concepts/encryption.md) bucket, a user or [service account](../../iam/concepts/users/service-accounts.md) must have the following [roles for the encryption key](../../kms/operations/key-access.md) in addition to the `storage.configurer` [role](../security/index.md#storage-configurer):

* `kms.keys.encrypter`: To read the key, [encrypt](../../kms/security/index.md#kms-keys-encrypter) and upload objects.
* `kms.keys.decrypter`: To read the key, [decrypt](../../kms/security/index.md#kms-keys-decrypter) and download objects.
* `kms.keys.encrypterDecrypter`: This role includes the `kms.keys.encrypter` and `kms.keys.decrypter` [permissions](../../kms/security/index.md#kms-keys-encrypterDecrypter).

For more information, see [Key Management Service service roles](../../kms/security/index.md#service-roles).

{% endnote %}


## Create a static access key {#create-static-key}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the relevant folder.
  1. Navigate to **Identity and Access Management**.
  1. In the left-hand panel, select ![FaceRobot](../../_assets/console-icons/face-robot.svg) **Service accounts**.
  1. Select the `sa-backup-to-s3` service account.
  1. In the top panel, click ![image](../../_assets/console-icons/plus.svg) **Create new key** and select **Create static access key**.
  1. Enter a description for the key and click **Create**.
  1. Save the ID and secret key for later when you are mounting the bucket.

      {% note alert %}

      After you close this dialog, the key value will no longer be available.

      {% endnote %}

- CLI {#cli}

  1. Run this command:

      ```bash
      yc iam access-key create \
        --service-account-name sa-backup-to-s3
      ```

      Where `--service-account-name` is the name of the service account you are creating the key for.

      Result:

      ```text
      access_key:
        id: aje726ab18go********
        service_account_id: ajecikmc374i********
        created_at: "2024-11-28T14:16:44.936656476Z"
        key_id: YCAJEOmgIxyYa54LY********
      secret: YCMiEYFqczmjJQ2XCHMOenrp1s1-yva1********
      ```

  1. Save the ID (`key_id`) and secret key (`secret`) for later when you are mounting the bucket.

- API {#api}

  To create an access key, use the [create](../../iam/awscompatibility/api-ref/AccessKey/create.md) REST API method for the [AccessKey](../../iam/awscompatibility/api-ref/AccessKey/index.md) resource or the [AccessKeyService/Create](../../iam/awscompatibility/api-ref/grpc/AccessKey/create.md) gRPC API call.

  Save the ID (`key_id`) and secret key (`secret`) for later when you are mounting the bucket.

{% endlist %}


## Install the AWS CLI {#install-aws}

If you do not have the AWS CLI yet, [install and configure it](../tools/aws-cli.md).


## Synchronize the local folder with the bucket {#sync}

To complete the backup setup, configure [manual](#manual-sync) or [automatic](#auto-sync) synchronization of the local folder with the bucket.


### Manual synchronization {#manual-sync}

{% list tabs group=operating_system %}

- Linux {#linux}

  For a one-off synchronization, run this command:
  
  ```bash
  aws s3 sync <local_folder_path> s3://<bucket_name> \
  --endpoint-url=https://storage.yandexcloud.net \
  --delete
  ```
  
  Where:
  
  * `--endpoint-url`: Object Storage endpoint.
  * `--delete`: Flag to delete files from the bucket when they are deleted from the local folder.
  
  This command copies all contents from your local folder to the S3 bucket by moving only new and modified files.

- Windows {#windows}

  For a one-off synchronization, run this command:
  
  ```bash
  aws s3 sync <local_folder_path> s3://<bucket_name> \
  --endpoint-url=https://storage.yandexcloud.net \
  --delete
  ```
  
  Where:
  
  * `--endpoint-url`: Object Storage endpoint.
  * `--delete`: Flag to delete files from the bucket when they are deleted from the local folder.
  
  This command copies all contents from your local folder to the S3 bucket by moving only new and modified files.

  {% note tip %}

  To avoid running the command manually each time, you can create a BAT file:

  1. Open **Notepad** and add the following contents:

      ```text
      @echo off
      aws s3 sync "<local_folder_path>" s3://<bucket_name> ^
        --endpoint-url=https://storage.yandexcloud.net ^
        --delete
      ```

      Where `--delete` is a flag to delete files from the bucket when they are deleted from the local folder.

  1. Save the file, e.g., as `sync_to_s3.bat`.
  1. To synchronize folders, run the BAT file.

  {% endnote %}

{% endlist %}


### Automatic synchronization {#auto-sync}

{% list tabs group=operating_system %}

- Linux {#linux}

  To automatically synchronize your local folder with the bucket:

  1. Make sure the user who will schedule the `cron` job has access to the local folder.
  1. Open the current user's scheduler file by running this command:

      ```bash
      crontab -e
      ```

  1. Add a line to the file to trigger autosync, e.g., every 10 minutes:

      ```text
      */10 * * * * aws s3 sync <local_folder_path> <connection_name>:<bucket_name> --delete --log-file=<log_file_path>
      ```

      Where:

      * `--delete`: Flag to delete files from the bucket when they are deleted from the local folder.
      * `--log-file`: Optional parameter for writing logs. Specify the full path.

      {% note info %}
      
      Specify the full absolute path to folders without using `~`, e.g., `/home/user/`.
      
      {% endnote %}

  The job will run at the specified frequency and synchronize the folders.

- Windows {#windows}

  For auto sync, set up a task in the **Task scheduler**:
  
  1. Open the Windows **Task Scheduler**:
  
      * **Start Menu** → **Task Scheduler**.
      * Or start it in **Run** → `taskschd.msc`.
  
  1. Click **Create task...**.
  1. In the **Actions** tab, add a new action by specifying the absolute path to the executable script, e.g., a BAT file, under **Program or script**.
  1. In the **Triggers** tab, add a schedule.
  1. Click **OK**.

{% endlist %}


## How to delete the resources you created {#clear-out}

To stop paying for the resources you created:

1. [Delete the objects](../operations/objects/delete-all.md) from the bucket.
1. [Delete the bucket](../operations/buckets/delete.md).