3 ms·
> client can append backups only You mention Restic but I don't see how it enforces append-only security. According to its S3 documentation[1], Restic requires
by FooBarWidget 8y ago
> client can append backups only
You mention Restic but I don't see how it enforces append-only security. According to its S3 documentation[1], Restic requires PutObject, DeleteObject and ListBucket permissions.
[1] https://restic.readthedocs.io/en/stable/080_examples.html#setting-up-restic-with-amazon-s3 https://restic.readthedocs.io/en/stable/080_examples.html#se...
- jsiepkes 8y agoYou can do it with the restic server ( https://github.com/restic/rest-server https://github.com/restic/rest-server ). Don't know if it is implemented in the S3 backend.
- regecks 8y agoYou can also just enable versioning on the bucket which prevents PutObject from doing any permanent damage. If restic needs DeleteObject, you can also configure IAM to not allow deleting of specific versions, which means it can only tombstone objects.