BACKUPS
June 24, 2026

How to Back Up Your Server to Amazon S3

10 min read
Author
CloudStick Team
WordPress Engineer
Share this article
Server Backup to Amazon S3
CloudStick
Backup to Amazon S3

Why Amazon S3 Is a Reliable Backup Destination

Amazon S3 offers 99.999999999% (eleven nines) object durability by default — data is automatically replicated across multiple Availability Zones within a region. For backup storage, this means you can treat an S3 object as effectively indestructible under normal failure scenarios. A single AZ failure, server failure, or datacenter fire will not affect your backup data.

Cost-wise, S3 Standard storage is roughly $0.023 per GB per month. A 50 GB backup set costs about $1.15/month in storage — cheaper than most managed backup add-ons. If you use S3 Glacier Instant Retrieval (for archives you rarely access), that drops to $0.004/GB/month.

Create a Dedicated Backup Bucket and IAM User

Never use your root AWS account credentials for backup uploads. Create a dedicated IAM user with the minimum permissions required:

# IAM policy for backup-only user (JSON)
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:PutObject", "s3:GetObject", "s3:ListBucket"],
"Resource": ["arn:aws:s3:::my-server-backups", "arn:aws:s3:::my-server-backups/*"]
}
]
}

Enable S3 Versioning on the bucket so that overwritten or deleted objects are retained. Enable S3 Lifecycle Rules to transition objects older than 30 days to Glacier and delete objects older than 90 days to manage costs.

Install and Configure AWS CLI on the Server

# Install AWS CLI v2
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o awscliv2.zip
unzip awscliv2.zip && sudo ./aws/install && rm -rf aws awscliv2.zip
# Configure with dedicated backup IAM credentials
aws configure --profile backups
# Enter: AWS Access Key ID
# Enter: AWS Secret Access Key
# Enter: Default region (e.g. us-east-1)
# Enter: Default output format (json)
# Test access
aws s3 ls s3://my-server-backups/ --profile backups

The Full Backup-to-S3 Script

#!/bin/bash
# /usr/local/bin/backup-to-s3.sh
set -euo pipefail
DATE=$(date +%Y%m%d-%H%M)
SITE_DIR="/var/www/mysite"
DB_NAME="mysite_db"
BUCKET="s3://my-server-backups"
TMP="/tmp/backup-$DATE"
mkdir -p "$TMP"
# Dump database
mysqldump --single-transaction --quick "$DB_NAME" | gzip > "$TMP/$DB_NAME-$DATE.sql.gz"
# Archive site files
tar -czf "$TMP/files-$DATE.tar.gz" --exclude="$SITE_DIR/wp-content/cache" "$SITE_DIR"
# Upload to S3
aws s3 cp "$TMP/" "$BUCKET/$DATE/" --recursive --profile backups
# Cleanup
rm -rf "$TMP"
echo "Backup $DATE uploaded to $BUCKET"

Schedule the Backup with Cron

# Run backup daily at 2am, log output
0 2 * * * /usr/local/bin/backup-to-s3.sh >> /var/log/s3-backup.log 2>&1
TIP

Add a heartbeat monitor (e.g., healthchecks.io) at the end of the script: curl -s https://hc-ping.com/your-uuid > /dev/null. You will get an alert if the backup job stops running silently.

CloudStick Manages Offsite Backup Storage Without Extra Config

If you prefer not to manage AWS credentials and S3 lifecycle rules yourself, CloudStick's managed backup storage handles the offsite backup destination — archives are stored in geographically separate managed storage, not on your server. For teams that want explicit control over the destination (e.g., a specific AWS account for compliance reasons), the S3 approach above is the right path to pair alongside CloudStick's dashboard management.

Leave a comment
Full Name
Email Address
Message
Contents

We use cookies to improve your experience

CloudStick uses cookies to personalise content, analyse traffic and keep you signed in. Cookie Policy · Terms of Service

Manage cookies