Read-only S3 repo for periodic DR testing without taking ownership

[dbeerts]

Currently it's not possible to add an existing S3 repo used for PRD backups to a DR environment with a separated VBR as read-only repo, without interrupting the backup jobs on PRD side. This because the DR VBR will take ownership of the repo and PRD VBR will lose access to it.

Is Veeam working on this to make this possible? Or is it technically infeasible and do we have to look at other solutions?
It would be a great feature to perform periodic testing of backups when simulating specific situations.

Thanks!

[Mildur]

Hi DBeerts,

We have some ideas on how this use case can be addressed in a future update, but there’s no ETA or further information we can share at this time.

Ownership is transferred by writing an object containing the backup server name to the bucket during initial connection configuration.
If you use S3 credentials with read-only permissions via IAM policies on your second backup server, overtaking ownership is not possible because this object cannot be overwritten; however, the backup server can still connect.

You can try adding the bucket to the second backup server using different access keys with read-only permissions, as described here.

Best regards,
Fabian

[pirx]

As I have the same use case I looked into this. The read only IAM has the limitation that it does not work if the bucket is encrypted. As least that is noted in doc.