Scaleway (Managed Database for PostgreSQL or self-managed)

1. Write dumps to Object Storage

Managed Database backups stay inside Scaleway's service, so keep a logical backup in a bucket you own:

pg_dump --format=custom --no-owner "$DATABASE_URL" \
  | aws --endpoint-url https://s3.fr-par.scw.cloud s3 cp - "s3://acme-backups/orders/orders-$(date -u +%Y-%m-%dT%H-%M).dump"

2. Create an IAM application for Verestore

1. IAM → Applications → Create application, for example verestore-reader.
2. IAM → Policies → Create policy for that application, scoped to the bucket's project, with the permission sets ObjectStorageBucketsRead and ObjectStorageObjectsRead.
3. Create an API key for the application. Its access key and secret key are what you give Verestore.

3. Limit it to the prefix with a bucket policy

IAM permission sets apply to the whole project. This bucket policy narrows the application to reading one prefix:

{
  "Version": "2023-04-17",
  "Id": "verestore-read-only",
  "Statement": [
    {
      "Sid": "VerestoreReadPrefix",
      "Effect": "Allow",
      "Principal": { "SCW": "application_id:YOUR-APPLICATION-ID" },
      "Action": ["s3:GetObject"],
      "Resource": ["acme-backups/orders/*"]
    },
    {
      "Sid": "VerestoreList",
      "Effect": "Allow",
      "Principal": { "SCW": "application_id:YOUR-APPLICATION-ID" },
      "Action": ["s3:ListBucket"],
      "Resource": ["acme-backups"]
    }
  ]
}

A bucket policy replaces the default access for everyone, so add statements for your own users and applications before applying it. Listing reveals object names in the whole bucket, never their content; for strict scoping, use a dedicated bucket per database.

Add the target with endpoint https://s3.fr-par.scw.cloud (or your region), region fr-par, the bucket and prefix orders/.