Restic S3 backups: AWS S3 vs Cloudflare R2, Backblaze B2, Wasabi, and MinIO

Restic encrypts and deduplicates data on the machine being backed up, then writes repository objects to storage. Moving from Amazon S3 to an S3-compatible service changes the endpoint and credentials; it does not change restic’s repository format or hand the provider your plaintext files.

That narrows the provider decision. Check whether the service implements the S3 operations restic uses, whether credentials can be restricted to one bucket or prefix, and whether the endpoint will still be reachable during a recovery. Durability, account security, support, data location, request charges, and retrieval behavior still deserve a separate review. Prices change too often to be a sound architectural shortcut.

All five options can hold a restic repository. The useful dividing line is who must recover the storage service before restic can recover your files.

If the team already handles incidents in AWS, Amazon S3 keeps identity, audit logs, and regional recovery in that system. Cloudflare R2, Backblaze B2, and Wasabi are managed alternatives with different account and retrieval models; compare their current terms against your backup size and restore pattern. MinIO is different: it is software you operate, so its disks, replicas, TLS, upgrades, monitoring, and recovery plan become prerequisites for every restic restore.

• Existing AWS estate: S3 is usually the least surprising choice because IAM and incident access already exist. Scope one machine role or key to the repository prefix.
• Independent managed copy: R2, B2, or Wasabi can keep backups outside the production cloud account. Check credential recovery, data location, egress or retrieval rules, and support before choosing between them.
• Existing private storage platform: MinIO is reasonable when another team already operates it across an independent failure domain. Installing it beside the server being backed up does not create an off-site backup.
• Small team without object-storage operations: prefer a managed service. Owning fewer storage components is more valuable on recovery day than matching an existing S3 API perfectly.

A restic S3 repository combines an endpoint, bucket, and optional prefix. Copy the endpoint and region from the provider rather than guessing them: a mismatch can surface as an unhelpful signature, redirect, or access error.

Amazon, R2, B2, Wasabi, and MinIO use different endpoint shapes. Keep the selected endpoint, bucket, region, and prefix in the recovery record so another operator can locate the repository without reverse-engineering a server configuration.

An active restic repository needs to list, read, write, and delete objects. Read access is needed for indexes, snapshots, and restores. Write access creates repository data and locks. Delete access matters when restic removes locks and when retention runs forget and prune. Amazon S3 clients may also need s3:GetBucketLocation. A write-only credential may complete part of an upload and still leave you with an unusable maintenance or restore path.

Create credentials for the backup service instead of reusing a root or account-owner key. Scope them to the repository bucket, and to its prefix when the provider’s policy model and S3 implementation support reliable prefix restrictions. Prefix scoping is provider-specific: Amazon IAM conditions, Backblaze file-name restrictions, R2 bucket selection, Wasabi policies, and MinIO inline policies are similar ideas with different syntax and edge cases.

Most first-run failures are configuration mismatches rather than corrupt repositories. A 403 can mean the key is wrong, the bucket is outside its scope, or listing is permitted at the wrong prefix. Signature errors often point to a region or endpoint mismatch.

• R2 needs its S3 API endpoint, not api.cloudflare.com. Jurisdictional buckets use a jurisdiction-specific endpoint.
• Backblaze labels the S3 access key as Application Key ID and the secret as Application Key. The endpoint identifies the region; keep the two in sync.
• Wasabi buckets must use the service URL for their region. Do not assume the global-looking endpoint is right for an existing bucket.
• MinIO’s S3 API address may differ from its administrative or Console address. Use HTTPS with a certificate trusted by the backup host.
• Bucket lifecycle rules, archive tiers, and object locks can interfere with normal repository reads, overwrites, or deletes. Test retention and a restore before enabling them on an active repository. The exact least-privilege policy is covered in the related S3 permissions guide.

The best target is the one your team can authenticate to and restore from when the original server is unavailable. Save the bucket name, endpoint, region, repository path, and restic password outside that server. Keep a separate recovery credential or a documented way to issue one.

Run a restore from a clean machine before committing to the setup. That rehearsal tests DNS, TLS, credential issuance, download access, and the repository password in one go. If MinIO is hosted in the same rack or cluster as the workload, it is not an off-site copy; replicate it or keep another independent backup.

Rested connects the enrolled agent directly to the storage you choose and validates the destination before the first backup. Provider setup stays in the product rather than becoming another per-server script to maintain.