Veeam

Prepare the bucket and credentialsCopy Anchor Link

Create a dedicated bucket with versioning and Object Lock enabled. Versioning is a prerequisite for the Object Lock that Veeam immutability relies on:

rc bucket create <your-alias>/veeam-repo --with-lock
rc bucket version info <your-alias>/veeam-repo

Create a least-privilege policy scoped to the bucket. The policy intentionally omits s3:CreateBucket: Veeam offers automatic bucket provisioning, and declining it is the recommended posture when the bucket already exists.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject","s3:PutObject","s3:DeleteObject",
                 "s3:GetObjectVersion","s3:DeleteObjectVersion",
                 "s3:AbortMultipartUpload","s3:ListMultipartUploadParts",
                 "s3:ListBucketMultipartUploads",
                 "s3:PutObjectRetention","s3:GetObjectRetention",
                 "s3:PutObjectLegalHold","s3:GetObjectLegalHold",
                 "s3:BypassGovernanceRetention"],
      "Resource": ["arn:aws:s3:::veeam-repo/*"]
    },
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket","s3:ListBucketVersions","s3:GetBucketLocation",
                 "s3:GetBucketVersioning"],
      "Resource": ["arn:aws:s3:::veeam-repo"]
    }
  ]
}

rc admin policy create <your-alias> veeam-repo-rw <path-to-policy-file>
rc admin user add <your-alias> veeam <your-secret-key>
rc admin policy attach <your-alias> veeam-repo-rw --user veeam

Veeam requires HTTPS for object storage. Terminate TLS in front of RustFS (for example with Traefik or Nginx) using a certificate whose SAN covers the endpoint hostname, and import that certificate into the Veeam server's Trusted Root Certification Authorities store.

Add the RustFS repository in VBRCopy Anchor Link

In the VBR console, go to Backup Infrastructure → Backup Repositories → Add Repository → Object storage → S3 Compatible:

1. Service point: your RustFS HTTPS endpoint, Region: us-east-1.
2. Credentials: the veeam access key and secret key.
3. Bucket: veeam-repo, Folder: veeam.
4. Optionally enable Make backups immutable (the bucket's Object Lock is already enabled).

When Veeam reports that automatic bucket provisioning fails with Access Denied, choose Yes to disable it and proceed — the bucket exists and the IAM user intentionally cannot create buckets.

On success, the repository is listed as S3-compatible with the used space matching the bucket contents:

Enroll the protected computerCopy Anchor Link

The backup job alone does not install the Veeam agent. Use a protection group:

1. Inventory → Physical and Cloud Infrastructure → Add protection group…
2. Type Individual computers, add the machine with its real hostname and local administrator credentials in HOSTNAME\user form.
3. Keep Install Veeam Backup & Replication Agent enabled, then Apply.

Run the backup jobCopy Anchor Link

1. Home → Backup Job → Windows computer…
2. Computers: From protection group, Backup Mode: Entire computer.
3. Storage: Backup repository = RustFS, retention as needed.
4. Finish, then right-click the job and select Start.

After the job completes, the job list shows Last Result: Success and the restore point appears under Home → Backups → Object Storage → RustFS Veeam Backup:

Verify the objects in RustFS:

rc object find <your-alias>/veeam-repo/ | tail -1

Veeam stores roughly 1 MiB data blocks under Veeam/Backup/veeam/Clients/{agent-id}/… with an ETag and a version on every object.

Restore filesCopy Anchor Link

1. Home → Backups → Object Storage → RustFS Veeam Backup → .
2. Right-click the restore point → Restore guest files… → Browse.
3. Pick a file in the Backup Browser, restore it to a target folder, and verify its content.

Restoring reads back only the blocks containing the selected file, which validates the full read path against RustFS.