Managed by server vs by agent (security)

[n_lev]

I'm relatively new to Veeam and trying to understand what would be a better approach, would very much appreciate any pointers.

I have a server in AWS where I want to run the VBR server and several sites in different countries where I have several VMs that I want to back up.
The backups should go to an S3 bucket.

What would be a better design from cybersecurity perspective: backups managed by server or by agents.
If I understand correctly, "Manager by server" means that effectively the server in AWS will reach down to the site, "pull" the data and "push" it to S3. Correct? This means I need to open quite a few ports on my firewall in top-down direction.
"Managed by agent" sounds like the backups will be executed by the agent on site and the data will be "pushed" from there directly to S3. So, this means I'll need to open some ports in bottom-up direction from site to S3 (plus I'll probably still need some top-down for server to manager comms?).
Intuitively, this "managed by agent" option sounds more secure but I am not sure.
Any advice?

[Dima P.]

Hello Nikolay,

Both options provide a way to connect directly with S3 or 'proxy' the connection via using a gateway server. You can control it via object storage configuration > connection type. When a gateway server is set agents will upload data via such gateway server, if not set - directly from every agent. Thank you!