Gen3 Admin Aws S3 Backup Setup - GT-Edge-AI/GT-AI-OS GitHub Wiki

Amazon S3 Portable Backup Setup

Connect GT AI OS portable backups (gt3-portable-backup-v1) to Amazon S3.

Use a dedicated bucket used only for GT backups. Keep Backup & Restore → Object storage open while you work. Configure bucket connection and credentials entirely in the Control Panel — no command-line tools or repo scripts.

Quick checklist

  1. Create an S3 bucket in your chosen AWS region.
  2. Create an IAM policy scoped to that bucket only, attach it to an IAM user, create access keys.
  3. On Object storage: provider Amazon S3 → fill connection fields → paste keys → Save credentials to cluster → enable Backups → Save Object Storage.
  4. On the Backup tab: Test bucket (leave Endpoint CA secret empty on commercial AWS).

Before you start

You need Example
S3 bucket name gt3-backup-prod
AWS region us-east-1 (must match the bucket)
Path prefix production (logical folder for this deployment; no / at start or end)

Part 1 — Create the S3 bucket (AWS console)

  1. AWS console → S3 → Create bucket.
  2. Enter Bucket name and AWS Region.
  3. Leave other defaults → Create bucket.

Part 2 — IAM policy (one bucket only)

AWS does not offer a managed policy for a single bucket. Create a custom policy once:

  1. IAM → Policies → Create policy.
  2. Open the Visual tab → choose service S3.
  3. Turn on only:
    • ListBucket (under List)
    • GetObject, PutObject, DeleteObject (under Read / Write)
  4. Resources → Specific:
    • bucket → Add ARN → type your bucket name only → Add
    • object → Add ARN → same bucket name, object name * → Add
  5. Next → name the policy (e.g. GT3-backup-one-bucket) → Create policy.

This allows Test bucket probes and portable archives anywhere under the bucket (including {pathPrefix}/portable/).

Part 3 — IAM user and access keys (AWS console)

  1. IAM → Users → Create user → user name e.g. gt3-backup → Next.
  2. Attach policies directly → select GT3-backup-one-bucket → Next → Create user.
  3. Open the user → Security credentials tab.
  4. Access keys → Create access key.
  5. Use case: Application running outside AWS → Next → Create access key.
  6. Copy Access key ID and Secret access key (secret shown once).

Part 4 — Control Panel Object storage

Go to Backup & Restore → Object storage.

Step 1 — Provider

Select Amazon S3.

Step 2 — Connection settings

Form field Example Notes
S3 endpoint URL (optional for AWS) (leave empty) Commercial AWS — leave blank for virtual-hosted S3
S3 bucket name gt3-backup-prod Case-sensitive
AWS region us-east-1 Must match bucket region
Path prefix in bucket production Portable files go under {pathPrefix}/portable/

GovCloud: set endpoint e.g. https://s3.us-gov-west-1.amazonaws.com and the matching AWS region; use GovCloud IAM credentials.

Leave Advanced fields at their defaults unless your installation guide says otherwise.

Step 4 — Save AWS IAM credentials to the cluster

Paste Access key ID and Secret access key from IAM → Save credentials to cluster.

GT AI OS writes these into the cluster for backup jobs. They are not stored in Settings JSON.

Step 5 — Enable usage and save

  1. Check Backups.
  2. Click Save Object Storage.

Part 5 — Test on the Backup tab

  1. Open the Backup tab.
  2. Leave Endpoint CA secret empty for public AWS (*.amazonaws.com).
  3. Click Test bucket — should report success.

Optional: Run backup now → confirm portable tar under {pathPrefix}/portable/ in S3 and in the catalog.

If Test bucket fails

Problem What to check
Wrong region AWS region in Control Panel matches the bucket region
Access denied IAM policy attached to the user; Save credentials to cluster completed before Save Object Storage
Timeout Cluster pods can reach s3.<region>.amazonaws.com (network/firewall/DNS from the GT AI OS host)

Where files land in S3

{pathPrefix}/portable/{backupSetId}/gt3-portable-backup-….tar.gz
{pathPrefix}/portable/{backupSetId}/….manifest.json

Related pages

⚠️ **GitHub.com Fallback** ⚠️