06 Sep BackupAssist and Wasabi Cloud Storage for MSP’s

The BackupAssist Classic Cloud Backup add-on supports a number of cloud based locations. This backup type gives you the option to perform file and application level backups to the cloud, by configuring a compatible backup container with your chosen cloud storage provider or remote WebDAV destination.

Amazon S3 and Microsoft Azure provide cloud storage that is compatible with the cloud backup add-on, but the configuration and pricing structures of these providers can be complicated and difficult to easily understand. WebDAV is typically used on a remote NAS, so there is an additional hardware requirement and suitable location to host it, that needs to be factored in.

Wasabi is a cloud storage provider that simplifies configuration and pricing and provides a great alternative to these other providers, the key advantages being:

• It’s much easier to set-up and use, with a 30-Day free trial period
• It’s up to 80% cheaper than AWS S3
• It uses a really simple pricing model at $5.99/TB/month
• Significant discounts for term and volume commitments are available
• There are no additional data transfer charges (for example, you won’t be charged to egress data – restore backups)
• Easy to manage ‘per customer’ storage buckets

By enabling Wasabi Cloud backups for your BackupAssist customers, you can therefore improve their backup resilience, reduce manual work and add an additional billable service to your portfolio.

The following are our current recommendations for setting up BackupAssist backup jobs to Wasabi Cloud Storage but they’re not definitive as there are several ways of doing this based on differing sets of requirements.

These recommendations assume that a reseller will be storing ‘buckets’ of data for each of their customers’ backup jobs (one bucket per job) in the reseller’s own Wasabi Cloud Storage account.

Configuring Wasabi Cloud Storage

Once you’ve created your own Wasabi account (don’t forget to setup 2FA!), login.

You’ll initially need to create an access policy for your customer.  Do this by selecting the Policies section and clicking the Create Policy button.

Give the policy a name which will help you identify it as being for this customer eg. bloggs-company and copy and paste the following policy:-

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:List*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::bloggs-company-*"
    }
  ]
}

Note: In the policy above, you’ll need to edit the text displayed in red for each customer.  This policy, once assigned to the user you’ll create in the next step, will allow the user to list all ‘storage buckets’ in your Wasabi storage account but will only allow them to create and access buckets if the name of the bucket begins with ‘bloggs-company-‘.

Next, you’ll need to create a ‘User’ account for your customer to generate a unique Access Key for them along with assigning the new policy you’ve just created, to the user.

When creating the user, give them a username that makes it easy for you to recognise which customer the user represents eg. ‘bloggs-company’

Note: You’ll only be giving this user programmatic access:-

Click NEXT, and then NEXT on the Groups section.

On the Policies section, attach your newly created policy to the user and then click NEXT:-

Finally, complete the creation of the user by clicking CREATE USER:-

Once you’ve created the user, the access key for the user will be displayed:-

When setting up a job in BackupAssist, you’re going to need both the Access Key and the Secret Key (click Show to display this) along with a suitably strong encryption password.

Typically, you will have a set of one Access Key, Secret Key and Encryption Password for each of your customers – make sure you keep a safely stored record of these for each customer.  It’s worth noting that it’s very easy to create new access key pairs for a user via the Wasabi interface but don’t forget that you’ll also need to update the BackupAssist job if you update them.

Configuring the Cloud Backup job in BackupAssist

A new Cloud Backup job can be created by launching the Cloud Wizard in the BackupAssist Interface at New -> Cloud Backup.

The Bucket Name you enter in the job should be unique for each back up job you create but, because of the Wasabi policy you created above, must start with the customer specific string you decided on ie. ‘bloggs-company-‘ in order that the user is allowed to create and access the bucket.

Click Check destination… to verify that the details have been entered correctly.  Once you’ve done that, if you check your Wasabi account in the Buckets section, you should see the new bucket ‘bloggs-company-server01’ that has been created and that will store this backup job’s data.

For restoring files from a Wasabi backup, you just use the standard restore features built into the BackupAssist console:-

RECOVER -> Files/Apps -> Local and Network files

Your backup should be listed in the backup jobs that have run recently (if your job isn’t listed, you can use the ‘Discover Backups’ button, click the cloud button and enter your Wasabi credentials).

Then click on your job to view the contents of the bucket in Wasabi (note: if you encrypted the job, which is recommended, you’ll be asked for the encryption password at this point).

From there you can then select the files/folders to restore in the usual way.