PBM cannot restore/resync from a read-only datastore, improve to allow this to work even if some restrictions
General
Escalation
General
Escalation
Description
Currently, if you point PBM to a datastore where it has only read only permissions (i.e. an S3 bucket with IAM policies set to read with no DeleteObject/PutObject) - PBM cannot function. It insists on replacing the .pbm.init file whenever it initiates – even if the content of that file is the same.
Please consider changing the behavior to: “Try to replace the file if the current content is different than what I’m trying to write” instead of forcing it to write every time.
I was able to work around by adjusting the IAM policy to allow it to delete/put just that single file, but that’s just a hack, especially when it isn’t even changing the resulting content of the file.
Goal/intent is to do restore testing/validation from a development system that cannot alter the state of the production backup.
Thanks @Nathan Neulinger for reporting this. We’ve decided to convert it to an improvement and we’ll work on this later this year. We also welcome external contributions to our github repository.
Nathan Neulinger
January 20, 2025 at 3:25 PM
Something else I noticed while working on this - it also looks like it tries to edit/replace a .pbm.init file in the top level bucket (without the prefix). That failure does not appear to be affecting anything during restore, just unclear why it’s trying to do something at that path.
Currently, if you point PBM to a datastore where it has only read only permissions (i.e. an S3 bucket with IAM policies set to read with no DeleteObject/PutObject) - PBM cannot function. It insists on replacing the .pbm.init file whenever it initiates – even if the content of that file is the same.
Please consider changing the behavior to: “Try to replace the file if the current content is different than what I’m trying to write” instead of forcing it to write every time.
I was able to work around by adjusting the IAM policy to allow it to delete/put just that single file, but that’s just a hack, especially when it isn’t even changing the resulting content of the file.
Goal/intent is to do restore testing/validation from a development system that cannot alter the state of the production backup.
Forum post: https://forums.percona.com/t/how-to-restore-from-a-read-only-s3-bucket/36206