BackWPup – Issue with S3

I can confirmed this is not resolved ??

I have created another bucket in another region (DE) with exactly the same settings and this time it works. It seems there is really an issue with the Paris region. My two cents to help fixing this issue. (I have updated to the most recent version of BacWPup)

@rbpe26 : I solved my issue as follows :

Select as S3 service region, the same region as where the bucket is located.
When I select Germany as service region for a bucket located in Ireland, it doesn’t work.

It doen’t matter where you are located or where your website is hosted. I’m located in Belgium and my site is hosted in the Netherlands. I’m using AWS S3 buckets in Germany and Ireland.

I hope this might be of any help to you.

@pmstudio1, thank you very much for your message. I have set the region in line with the AWS bucket, nevertheless while it works perfectly with the bucket in Germany, it does not work with a bucket in France (with the setup on France region).
I understand it can work independently of the site location (I am based in Switzerland, the site is in France and now the backup is in Germany as backup in France does not work… such a small world :-))

By any chance did you try a bucket in France?

Best regards,
RBP

@rbpe26 , no I did not tried France. I’m happy I could solve my issue ??
As long as the backup is somewhere in Europe, it’s OK for me regarding GDPR legislation.
Best regards

hmm weird issue

@rbpe26
could you please help me try with the beta 1474, but in your S3 service tab -> Or a S3 Server URL section -> Endpoint -> fill something like:
https://<your_bucket_unique_name>.eu-west-3.amazonaws.com

Thank you!

Hello @duongcuong96,

I tried, but without success, I may not do it properly as it fails even with the DE region which I managed to get working now.

I get a message “The s3 service does not have version: .” ad then cannot select any bucket.

I hope this can help, please note that there is an issue on the FR region as I got it working on DE region, maybe it worth investigating the potential differences.

Kind regards,
RBPE

could you please help me try with the beta 1474, but in your S3 service tab -> Or a S3 Server URL section -> Endpoint -> fill something like:
https://<your_bucket_unique_name&gt;.eu-west-3.amazonaws.com

Thank you!

Shouldn’t it be s3://<bucket>.<region>.amazonaws.com ?

It’s weird, the plugin S3 settings says it works (with S3, not with http(s) protocol) but the job fails when trying to connect to amazon (ERROR: S3 Service API: Access Denied).

That S3 bucket works with other backup plugins and for other usage.

@jhnchristopher
normally the Access Denied happens because you have missing AWS policy/permission.
Please double check. Thank you!

I dug a bit and came up with this (https://www.ads-software.com/support/topic/s3-permissions-required/#post-11720470 and https://stackoverflow.com/a/52552984/177947):

{
    "Version": "2012-10-17",
    "Id": "PolicyXXX",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::XXX"
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::XXX"
        },
        {
            "Sid": "StmtXXX",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::XXX"
            },
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:GetBucketLocation",
                "s3:GetObject",
                "s3:ListBucketMultipartUploads",
                "s3:ListBucketVersions",
                "s3:ListMultipartUploadParts",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::XXX/*",
                "arn:aws:s3:::XXX"
            ]
        }
    ]
}

FTR, my IAM strategy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ObjectLevel",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::*/*"
        },
        {
            "Sid": "BucketLevel",
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketPublicAccessBlock",
                "s3:PutBucketPublicAccessBlock",
                "s3:CreateBucket",
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Sid": "AccountLevel",
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "*"
        }
    ]
}

Shouldn’t the plugin be able to set up this policy considering that it can create the bucket ?

• This reply was modified 4 years, 7 months ago by jhnchristopher.
• This reply was modified 4 years, 7 months ago by jhnchristopher.