backupwitness
Docs

AWS S3: a key for BackupWitness

List-only key

A key that can only list one bucket: it cannot read or change any object.

Steps

  1. In IAM, create a user for BackupWitness without console access.

  2. Attach an inline policy that allows only listing your backup bucket:

    {
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::YOUR-BUCKET" }
  ]
}

  3. Optional: limit it to one prefix with an s3:prefix condition.

  4. Create an access key for the user and copy the secret; AWS shows it only once.

In the check form

Endpoint: 
https://s3.<region>.amazonaws.com
Region: 
The bucket's region, for example eu-central-1.
  • Use the endpoint of the region the bucket lives in; another regional endpoint answers with a redirect.

Provider documentation

Create a check