[Yandex Cloud documentation](../../index.md) > [Yandex Object Storage](../index.md) > [Tutorials](index.md) > Backups > Backing up to Object Storage with rclone

# Backing up to Yandex Object Storage with rclone

In this tutorial, you will set up backup of local files to [Yandex Object Storage](../index.md) using [rclone](../tools/rclone.md).

[Rclone](https://rclone.org/) is a versatile command-line tool for managing files in S3 cloud storage, including Object Storage. You can use it to copy and synchronize files between your local machine and a [bucket](../concepts/bucket.md).

Features of rclone:

* Connects directly to the S3 API so you do not need to mount a bucket.
* Supported on Linux, Windows, and macOS.
* Supports copy, sync, filtering, checks, and automation with scripts.
* Easy setup and integration with task schedulers.

To set up backup with rclone:

1. [Get your cloud ready](#before-begin).
1. [Create a bucket](#create-bucket).
1. [Create a service account](#create-sa).
1. [Create a static access key](#create-static-key).
1. [Set up your environment](#prepare-env).
1. [Synchronize the local folder with the bucket](#sync).

If you no longer need the resources you created, [delete them](#clear-out).


## Getting started {#before-you-begin}

Sign up for Yandex Cloud and create a [billing account](../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../billing/quickstart/index.md) and [link](../../billing/operations/pin-cloud.md) a cloud to it.

If you have an active billing account, you can create or select a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).

[Learn more about clouds and folders here](../../resource-manager/concepts/resources-hierarchy.md).


### Required paid resources {#paid-resources}

The bucket support cost includes the fee for bucket data storage and data operations (see [Yandex Object Storage pricing](../pricing.md)).


## Create a bucket {#create-bucket}

{% note info %}

To protect your backups from accidental file deletion, enable [S3 bucket versioning](../operations/buckets/versioning.md). This way, deleted or overwritten files will be saved as previous versions you can [restore](../operations/objects/restore-object-version.md) if needed. For more information about S3 bucket versioning, see [this guide](../concepts/versioning.md).

Without versioning, you will not be able to restore files deleted from S3, even if previously copied.

{% endnote %}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), navigate to the relevant folder.
  1. Navigate to **Object Storage**.
  1. Click **Create bucket**.
  1. Enter a name for the bucket in line with the [naming requirements](../concepts/bucket.md#naming).
  1. In the **Read objects**, **Read object list**, and **Read settings** fields, select `With authorization`.
  1. Click **Create bucket**.

- AWS CLI {#cli}

  1. If you do not have the AWS CLI yet, [install and configure it](../tools/aws-cli.md).
  1. Create a bucket by entering its name consistent with the [naming conventions](../concepts/bucket.md#naming):

      ```bash
      aws --endpoint-url=https://storage.yandexcloud.net \
        s3 mb s3://<bucket_name>
      ```

      Result:

      ```text
      make_bucket: backup-bucket
      ```

- API {#api}

  Use the [create](../api-ref/Bucket/create.md) REST API method for the [Bucket](../api-ref/Bucket/index.md) resource, the [BucketService/Create](../api-ref/grpc/Bucket/create.md) gRPC API call, or the [create](../s3/api-ref/bucket/create.md) S3 API method.

{% endlist %}


## Create a service account {#create-sa}

Create a [service account](../../iam/concepts/users/service-accounts.md) to be used for backups.

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the relevant folder.
  1. Navigate to **Identity and Access Management**.
  1. Click **Create service account**.
  1. In the **Name** field, specify `sa-backup-to-s3`.
  1. Click ![image](../../_assets/console-icons/plus.svg) **Add role** and select [`storage.editor`](../security/index.md#storage-editor).
  1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. Create a service account:

      ```bash
      yc iam service-account create --name sa-backup-to-s3 \
        --folder-name <folder_name>
      ```

      Result:

      ```yaml
      id: ajeab0cnib1p********
      folder_id: b0g12ga82bcv********
      created_at: "2025-10-03T09:44:35.989446Z"
      name: sa-backup-to-s3
      ```

  1. Assign the `storage.editor` [role](../security/index.md#storage-editor) for the folder to the service account:

      ```bash
      yc resource-manager folder add-access-binding <folder_name> \
        --service-account-name sa-backup-to-s3 \
        --role storage.editor \
        --folder-name <folder_name>
      ```

      Result:

      ```text
      effective_deltas:
        - action: ADD
          access_binding:
            role_id: storage.editor
            subject:
              id: ajeab0cnib1p********
              type: serviceAccount
      ```

- API {#api}

  1. Create a service account named `sa-backup-to-s3`. Do it by using the [create](../../iam/api-ref/ServiceAccount/create.md) REST API method for the [ServiceAccount](../../iam/api-ref/ServiceAccount/index.md) resource or the [ServiceAccountService/Create](../../iam/api-ref/grpc/ServiceAccount/create.md) gRPC API call.
  1. Assign the `storage.editor` [role](../security/index.md#storage-editor) for the current folder to the the service account. Do it by using the [setAccessBindings](../../resource-manager/api-ref/Folder/setAccessBindings.md) REST API method for the [Folder](../../resource-manager/api-ref/Folder/index.md) resource or the [FolderService/SetAccessBindings](../../resource-manager/api-ref/grpc/Folder/setAccessBindings.md) gRPC API call.

{% endlist %}

{% note info %}

To work with objects in an [encrypted](../concepts/encryption.md) bucket, a user or [service account](../../iam/concepts/users/service-accounts.md) must have the following [roles for the encryption key](../../kms/operations/key-access.md) in addition to the `storage.configurer` [role](../security/index.md#storage-configurer):

* `kms.keys.encrypter`: To read the key, [encrypt](../../kms/security/index.md#kms-keys-encrypter) and upload objects.
* `kms.keys.decrypter`: To read the key, [decrypt](../../kms/security/index.md#kms-keys-decrypter) and download objects.
* `kms.keys.encrypterDecrypter`: This role includes the `kms.keys.encrypter` and `kms.keys.decrypter` [permissions](../../kms/security/index.md#kms-keys-encrypterDecrypter).

For more information, see [Key Management Service service roles](../../kms/security/index.md#service-roles).

{% endnote %}


## Create a static access key {#create-static-key}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the relevant folder.
  1. Navigate to **Identity and Access Management**.
  1. In the left-hand panel, select ![FaceRobot](../../_assets/console-icons/face-robot.svg) **Service accounts**.
  1. Select the `sa-backup-to-s3` service account.
  1. In the top panel, click ![image](../../_assets/console-icons/plus.svg) **Create new key** and select **Create static access key**.
  1. Enter a description for the key and click **Create**.
  1. Save the ID and secret key for later when you are mounting the bucket.

      {% note alert %}

      After you close this dialog, the key value will no longer be available.

      {% endnote %}

- CLI {#cli}

  1. Run this command:

      ```bash
      yc iam access-key create \
        --service-account-name sa-backup-to-s3
      ```

      Where `--service-account-name` is the name of the service account you are creating the key for.

      Result:

      ```text
      access_key:
        id: aje726ab18go********
        service_account_id: ajecikmc374i********
        created_at: "2024-11-28T14:16:44.936656476Z"
        key_id: YCAJEOmgIxyYa54LY********
      secret: YCMiEYFqczmjJQ2XCHMOenrp1s1-yva1********
      ```

  1. Save the ID (`key_id`) and secret key (`secret`) for later when you are mounting the bucket.

- API {#api}

  To create an access key, use the [create](../../iam/awscompatibility/api-ref/AccessKey/create.md) REST API method for the [AccessKey](../../iam/awscompatibility/api-ref/AccessKey/index.md) resource or the [AccessKeyService/Create](../../iam/awscompatibility/api-ref/grpc/AccessKey/create.md) gRPC API call.

  Save the ID (`key_id`) and secret key (`secret`) for later when you are mounting the bucket.

{% endlist %}


## Set up your environment {#prepare-env}

### Install rclone {#install-rclone}

{% list tabs group=operating_system %}

- Linux {#linux}

  1. Install the latest version of rclone using the following command:

      ```bash
      sudo -v ; curl https://rclone.org/install.sh | sudo bash
      ```

      Result:

      ```text
      ...
      rclone v1.71.1 has successfully installed.
      Now run "rclone config" for setup. Check https://rclone.org/docs/ for more details.
      ```

      For more information about the command, see [this rclone guide](https://rclone.org/install/).

  1. Make sure rclone is installed:

     ```bash
     rclone version
     ```

      Result:

      ```text
      rclone v1.71.1
      - os/version: ubuntu 24.04 (64 bit)
      - os/kernel: 6.14.0-29-generic (x86_64)
      - os/type: linux
      - os/arch: amd64
      - go/version: go1.25.1
      - go/linking: static
      - go/tags: none
      ```

- Windows {#windows}

  1. Download the [rclone archive](https://rclone.org/downloads/) from the vendor website and unpack it to a local folder.
  1. Add the folder to the `PATH` variable to make the utility CLI-accessible from anywhere. Proceed as follows:

      1. Click **Start** and type **Change system environment variables** in the Windows search bar.
      1. Click **Environment variables...** at the bottom right.
      1. In the window that opens, find the `PATH` parameter and click **Edit**.
      1. Add your folder path to the list.
      1. Click **OK**.

  1. Make sure rclone is installed:

      ```bash
      rclone version
      ```

      Result:

      ```text
      rclone v1.71.1
      - os/version: Microsoft Windows 10 Pro 22H2 22H2 (64 bit)
      - os/kernel: 10.0.19045.4046 (x86_64)
      - os/type: windows
      - os/arch: amd64
      - go/version: go1.25.1
      - go/linking: static
      - go/tags: cmount
      ```

{% endlist %}


### Set up a connection to Object Storage {#connect-rclone}

1. Run a configuration session for rclone using this command:

    ```bash
    rclone config
    ```

1. Follow the prompts to create a new connection profile:

    1. Start creating a new profile by entering `n` in the terminal.
    1. Enter a connection name, e.g., `yandex-s3`.
    1. Select the storage type by entering `4` (Amazon S3 Compliant Storage) in the terminal.
    1. Select the provider by entering `1` (Amazon Web Services S3) in the terminal.
    1. Select manual entry of credentials by typing `1` in the terminal.
    1. In the terminal, enter the secret key ID you got previously.
    1. In the terminal, enter the secret key value you got previously.
    1. Specify the region by entering `ru-central1` in the terminal.
    1. Specify the endpoint by entering `storage.yandexcloud.net` in the terminal.
    1. You can leave all other settings at their defaults by pressing **Enter** to skip them; at the last item, select `q` (`Quit config`).

    {% note info %}

    You can perform advanced connection setup if required. To do this, type `y` at the `Edit advanced config?` step. For more information about advanced settings, see [this `rclone` guide](https://rclone.org/s3/).

    {% endnote %}

    Also, you can configure connections by manually editing the `rclone.conf` configuration file. To get the configuration file location, run this command:

    ```bash
    rclone config file
    ```

1. Check your connection to the bucket by running this command:

    ```bash
    rclone ls <connection_name>:<bucket_name>
    ```

    If your configuration is correct, in your terminal, you will see a list of objects in the bucket.


## Synchronize the local folder with the bucket {#sync}

To complete the backup setup, configure [manual](#manual-sync) or [automatic](#auto-sync) synchronization of the local folder with the bucket.

{% note info %}

Files deleted from your local folder will also be deleted from the bucket. If you do not want to delete files from the bucket when they are deleted from the local folder, run the `copy` command instead of `sync`.

{% endnote %}


### Manual synchronization {#manual-sync}

{% list tabs group=operating_system %}

- Linux {#linux}

  For a one-off synchronization, run this command:
  
  ```bash
  rclone sync <local_folder_path> <connection_name>:<bucket_name>
  ```
  
  Where `sync` creates an exact copy, including deletion of files from the bucket when they are deleted from the local folder. To copy files without deletion, use the `copy` command.

- Windows {#windows}

  For a one-off synchronization, run this command:
  
  ```bash
  rclone sync <local_folder_path> <connection_name>:<bucket_name>
  ```
  
  Where `sync` creates an exact copy, including deletion of files from the bucket when they are deleted from the local folder. To copy files without deletion, use the `copy` command.

  {% note tip %}

  To avoid running the command manually each time, you can create a BAT file:

  1. Open **Notepad** and add the following contents:

      ```bash
      @echo off
      rclone sync <local_folder_path> <connection_name>:<bucket_name>
      ```

      Where `sync` creates an exact copy, including deletion of files from the bucket when they are deleted from the local folder. To copy files without deletion, use the `copy` command.

  1. Save the file, e.g., as `sync_to_s3.bat`.
  1. To synchronize folders, run the BAT file.

  {% endnote %}

{% endlist %}


### Automatic synchronization {#auto-sync}

{% list tabs group=operating_system %}

- Linux {#linux}

  To automatically synchronize your local folder with the bucket:

  1. Make sure the user who will schedule the `cron` job has access to the local folder.
  1. Open the current user's scheduler file by running this command:

      ```bash
      crontab -e
      ```

  1. Add a line to the file to trigger autosync, e.g., every 10 minutes:

      ```text
      */10 * * * * rclone sync <local_folder_path> <connection_name>:<bucket_name> --log-file=<log_file_path>
      ```

      Where:

      * `sync`: Command for an exact copy, including deletion of files from the bucket when they are deleted from the local folder. To copy files without deletion, use the `copy` command.
      * `--log-file` is an optional parameter for writing logs. Specify the full path.

      {% note info %}
      
      Specify the full absolute path to folders without using `~`, e.g., `/home/user/`.
      
      {% endnote %}

  The job will run at the specified frequency and synchronize the folders.

- Windows {#windows}

  For auto sync, set up a task in the **Task scheduler**:
  
  1. Open the Windows **Task Scheduler**:
  
      * **Start Menu** → **Task Scheduler**.
      * Or start it in **Run** → `taskschd.msc`.
  
  1. Click **Create task...**.
  1. In the **Actions** tab, add a new action by specifying the absolute path to the executable script, e.g., a BAT file, under **Program or script**.
  1. In the **Triggers** tab, add a schedule.
  1. Click **OK**.

{% endlist %}


## How to delete the resources you created {#clear-out}

To stop paying for the resources you created:

1. [Delete the objects](../operations/objects/delete-all.md) from the bucket.
1. [Delete the bucket](../operations/buckets/delete.md).