Let's say we want to use OpenShift API for Data Protection (OADP) to schedule reoccurring backups of resources and store the backups in an Amazon Web Services S3 Bucket. 

Let's use the aws s3api create-bucket command to create an S3 Bucket. Notice this is done using an account named "admin". Check out my article Amazon Web Services (AWS) - List Profile Config using the AWS CLI for more details on Amazon Web Services (AWS) profiles.

aws s3api create-bucket --bucket my-bucket-asdfadkjsfasfljdf --region us-east-1 --profile admin

Next let's create an Identity and Access Management (IAM) user named velero using the aws iam create-user command.

aws iam create-user --user-name velero --profile admin

Then create an access key and secret key for the velero user using the aws iam create-access-key command. Notice that the output will include both the value for both the access key and secret key. Make note of the value of the secret key! This is your one and only chance to view the access key. But don't worry, you can always create a new access key if you forgot to make note of the access key.

~]$ aws iam create-access-key --user-name velero --profile admin
{
    "AccessKey": {
        "UserName": "velero",
        "AccessKeyId": "AKIA2MITL76GFDLORQU6",
        "Status": "Active",
        "SecretAccessKey": "Nzy7dzWcr4hU6sYUg0PCquMCiCv04ae2aXmFIsGE",
        "CreateDate": "2025-04-09T01:26:08+00:00"
    }
}

Let's say you add the access key and secret key to your $HOME/.aws/credentials file (on a Linux system).

~]$ cat ~/.aws/credentials
[velero]
aws_secret_access_key = Nzy7dzWcr4hU6sYUg0PCquMCiCv04ae2aXmFIsGE
aws_access_key_id = AKIA2MITL76GFDLORQU6

And to the $HOME/.aws/config file too.

~]$ cat ~/.aws/config
[profile velero]
region = us-east-1
output = json

You can now try to list the location of your S3 Buckets using the velero user account but you'll get Access Denied because you've not yet granted velero any permissions.

~]$ aws s3api get-bucket-location --bucket my-bucket-asdfadkjsfasfljdf --profile velero
An error occurred (AccessDenied) when calling the GetBucketLocation operation: User: arn:aws:iam::123456789012:user/velero is not authorized to perform: s3:GetBucketLocation because no identity-based policy allows the s3:GetBucketLocation action

Let's create a file named velero-s3-policy.json that contains the following JSON, replacing my-bucket-asdfadkjsfasfljdf with the name of your S3 Bucket.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:PutObject",
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket-asdfadkjsfasfljdf/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:ListBucketMultipartUploads"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket-asdfadkjsfasfljdf"
            ]
        }
    ]
}

Let's use the aws iam put-user-policy command to attach the policy to the velero user account.

aws iam put-user-policy --user-name velero --policy-name velero-s3 --policy-document file://velero-s3-policy.json --profile admin

Now velero should be able to list the location of the S3 bucket. Don't worry if LocationContraint is null. We just want to make sure that we get a response instead of Access Denied. So far, so good.

~]$ aws s3api get-bucket-location --bucket my-bucket-asdfadkjsfasfljdf --profile velero
{
    "LocationConstraint": null
}

Let's create a file named credentials-velero that contains your AWS Access Key and Secret Key.

[default]
aws_access_key_id=<your access key>
aws_secret_access_key=<your secret key>

Let's create a secret named cloud-credentials using the credentials-velero file.

oc create secret generic cloud-credentials --namespace openshift-adp --from-file cloud=credentials-velero