Choosing a destination: provider, region, addressing, storage class and object lock
A destination is the bucket your sealed archives land in, and it is the first thing you configure because nothing can run without it. The console never stores a destination it has not verified: the primary action on the form is Verify and save, and it reaches the bucket, authenticates, and performs a real write probe before anything is kept. A typo fails at the form, not during your first backup.
This page walks the decisions on that form in the order you meet them, with the recommended path and what the other options translate to.
R2 or S3-compatible
Cloudflare R2 is the default because the endpoint is derived from your account id, so there is less to type and less to mistype. Ticking “this bucket is in a different Cloudflare account” reveals an account id field and derives that account’s endpoint instead, which is the off-site copy most estates should hold.
S3-compatible makes every field explicit: the endpoint URL, the region, and optionally the addressing style and storage class. Use it for AWS S3 or any S3-compatible store you already trust.
Region
For R2, auto is correct and is the default. For AWS S3 with static keys, the bucket’s real region is what you want. Under STS AssumeRole the region must be a real AWS region: the form refuses auto there, mirroring the engine’s own check, because the STS endpoint is regional.
Addressing style
Leave it on auto unless your store documents otherwise: auto picks virtual-hosted style for AWS S3 and path style elsewhere, which is what almost every S3-compatible store expects. The explicit path and vhost options exist for the store that documents a firm requirement.
Storage class
Blank means the bucket’s default, which is right for R2. On S3, INTELLIGENT_TIERING is the cost-safe pick for archives: it moves cold objects to cheaper storage without changing retrieval behaviour. STANDARD_IA and ONEZONE_IA trade availability or retrieval cost for a lower storage price.
Glacier and Deep Archive are deliberately not offered. A backup you cannot restore for hours is a backup that fails you on the day you need it, so the archive-hostile classes are excluded rather than left as a trap.
Object lock (WORM)
Off is the default and is right until you have decided your ransomware stance. governance mode lets a suitably privileged principal override the lock; compliance mode makes every object undeletable by anyone for the retention window you set, which also blocks your own retention pruning for that window. Choosing either mode requires a retention period in days, and the verify probe confirms the bucket actually enforces it.
Credentials, and AssumeRole
Access keys are sent once for verification and never shown again; the stored view carries the host, bucket, and region only. On AWS you can leave the keys as the standing credential or supply a role ARN to assume instead: with an ARN set, the keys are used only to assume the role, and the optional external id is the cross-account confused-deputy guard you should set whenever the ARN crosses an account boundary.
The default destination
Your first destination becomes the default. A downpipe that does not pick destinations explicitly writes to the default, so repointing the default is a fleet-wide decision. Fanning a downpipe out to more than one destination is its own topic: see multiple destinations for the 3-2-1 pattern.
Last updated .