Synology Glacier Backup - Quick Setup Guide

[@undifini]

Thank you for the easy explanation! Just set up my backup. In 20 years or so, when I spill water on the NAS or whatever, I'll be glad to have done so :)

[@runekock]

Seems so simple once you have explained it - but as a total newbie to AWS, I wouldn't have guessed about IAM, users and permissions. Many thanks.

[@techable7524]

Glad it was helpful!

[@motionforgecg]

Great vid - thanks - One thing I would add is I also untick the 'Preserve backed up files at destination' - this way if I delete something off my NAS drive - it's also deleted from AWS glacier. Of course, this will change depending on the user requirements and it's possible you may want to keep everything on glacier, but I don't need to keep any NAS deleted files and this helps also keep down the size of my overall glacier archive.

[@techable7524]

Thanks for sharing!

[@AskJoe]

Well done... Instant like and subscribe! Just created my first test run. I'll explore your other videos to see if you have one that explains how to configure "Glacier Deep Archive" so I can get the lowest price possible for backups.

[@StarlessBlack2007]

Does it store the file tree as it is on the Synology? Or is the backup image based like hyperbackup?

[@andresprietsch]

Thanks a lot, it's help me!

[@2012kani]

Thanks a lot, very helpful!

[@techable7524]

You're welcome!

[@AB-tq7ys]

thanks for the explanation. Would this backup be encrypted on AWS or does the data lie there unencrypted?

[@snivesz32]

It's my understanding that Synology can encrypt the data in transit, via that checkbox, but that layer of encryption is peeled off upon receiving. Amazon S3 Glacier will then encrypt each backup as an archive, using encryption keys that your IAM account has internally. If you wish to manage your own keys you would have to encrypt prior to backing up or use a tool that automates this. The reasoning for this is likely because you will incur charges to recover files from Glacier, and if the data were encrypted you would be forced to recover the entire archive just to get that one file/folder you needed. Since Amazon manages those keys their system can produce the directory contents of your archive, allowing you to selectively retrieve the files/folders you need.

[@PokeyRuleJams]

Fwiw if you don't want to give full access to all glacier vaults, you can initially give the account the following policy: ``` { "Effect": "Allow", "Resource": "arn:aws:glacier:us-west-2:123456789012:vaults/*", "Action":["glacier:CreateVault", "glacier:SetVaultNotifications", "glacier:GetVaultNotifications", "glacier:DeleteVaultNotifications", "glacier:DescribeVault", "glacier:ListVaults"] } ``` Then after setup is complete, check your glacier for the newly created vaults, get their arns, and expand the policy to something like the following: ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "arn:aws:glacier:us-west-2:123456789012:vaults/BlahBlahBlah_12345ABC123_1*", "Action": [ "glacier:*" ] }, { "Effect": "Allow", "Resource": "arn:aws:glacier:us-west-2:123456789012:vaults/*", "Action": [ "glacier:CreateVault", "glacier:SetVaultNotifications", "glacier:GetVaultNotifications", "glacier:DeleteVaultNotifications", "glacier:DescribeVault", "glacier:ListVaults" ] } ] } ```