I want to use separate backblaze B2 buckets for backups and uploads. I don’t want discourse to have access to any buckets other than the two it is using. Backblaze allows creating an application key to access either a single bucket, or all buckets. But discourse requires that uploads and backups use the same S3 credentials, as far as I can tell, so there’s no way to do that. Is there anything I’m missing?

Hi there :wave: welcome :slight_smile: Perhaps this topic can help [image] Configure an S3 compatible object storage provider for uploads Self-Hosting information_source This topic covers how to configure some common S3 compatible Object Storage providers (S3 clones). See Set up file and image uploads to S3 for more details about Amazon AWS S3 configuration, which is officially supported and used internally by Discourse for our hosting services. Provider Service Name Works with Discourse? Amazon AWS S3 Yes Digital Ocean Spaces Yes Linode Object Storage Yes Google Cloud Storage Yes Scaleway Object Storage Yes Vultr Obj…

Sadly, no. For Backblaze the example given just puts the backups in a /backups subdirectory of the (publicly readable) uploads bucket. I’m sure it’s possible to secure that, but it doesn’t seem like a great approach.

So I was able to setup an IAM user with 2 roles in AWS that allows for separate permissions for my backup and assets buckets. Each role is scoped to that bucket and has specific permissions. I believe that the backup is set to only put and not read or list. Where as the assets bucket is allowing all functions. However this sounds like an issue with the Backblaze role specification is that correct? Seems like you can only attach a permission to 1 or all buckets and the way that it works with discourse is that they share the same permission keys?

Yup. Backblaze handling of application key permissions seems to be (drastically) simpler than AWS. A Backblaze permission key seems to have access to either a single bucket or all buckets in the owners account. So the discourse S3 interface is just fine for AWS S3 buckets, but not quite as good for Backblaze B2 buckets.

Having the same issue with Backblaze. This FAQ would suggest that you can use the same bucket, but with different paths, except our current version of discourse (3.4.0.beta3-dev) throws an error when I try to save that setting.

Separate S3 access keys for backups and uploads?

Product Support

Walter_Jenkins (Aviddabbler ) November 10, 2024, 6:25pm 6

Sounds like you could use aws or create a different backblaze account

Topic		Replies	Views
S3 image upload access denied while backups upload working fine Self-hosting s3	22	3019	March 23, 2020
Setting up backup and image uploads to Backblaze B2 Product Support	6	3227	July 24, 2020
Do I need a second aws S3 bucket for backup? Self-hosting backups , s3	9	1504	December 31, 2017
S3 backup permissions Product Support	5	1557	March 22, 2018
Cannot use the same bucket for 's3_upload_bucket' and 's3_backup_bucket' Product Support	2	591	May 10, 2019

Separate S3 access keys for backups and uploads?

Related topics