Docs
Cloudflare R2: a key for BackupWitness
Read-only key (no list-only option)R2 has no list-only permission. The narrowest key is "Object Read only" for one bucket, which could also read object contents. BackupWitness never does: it only calls ListObjectsV2.
Steps
In the Cloudflare dashboard open R2 object storage, then Manage API tokens.
Create an Account API token with the permission "Object Read only".
Apply it to the backup bucket only, not to all buckets.
Copy the Access Key ID and Secret Access Key; the secret is shown once.
In the check form
- Endpoint:
https://<account-id>.r2.cloudflarestorage.com- Region:
- auto
- Buckets in the EU jurisdiction use https://<account-id>.eu.r2.cloudflarestorage.com.
- The token cannot be limited to a prefix; set the prefix in the check instead.