This guide shows how to create a versioned Synology Hyper Backup task to Amazon S3. It covers the S3 bucket, a dedicated least-privilege IAM user, scheduling, rotation, verification, and a test restore.

Amazon S3 is a durable off-site destination with several storage classes. The real cost depends on stored data, requests, retrievals, and lifecycle choices—not the storage price alone.

Important: use the current AWS Signature Version 4 connection. Keep the Hyper Backup encryption password and key outside the NAS; an encrypted backup cannot be recovered without them.

When Amazon S3 is a good backup destination

S3 is a strong choice when you need an off-site copy that can scale beyond local storage. For a smaller personal backup with simpler billing, compare it with Google Drive. For a backup to infrastructure you control, see the rsync server guide.

Set up Synology Hyper Backup to Amazon S3

Step 1: Create an S3 bucket

In the AWS Management Console, search for the S3 service:

Click Create bucket:

Give the bucket a globally unique name. Keep it descriptive so you can identify the backup later:

Review the default settings, keep public access blocked, then scroll down and click Create bucket:

The new bucket now appears in the bucket list:

Step 2: Create a dedicated IAM user

Open the IAM console:

Choose Users from the left menu:

Click Create user:

Enter a username that clearly shows its purpose, such as synology-hyper-backup. Do not use your AWS root account for this connection.

Leave Provide user access to the AWS Management Console unchecked. Hyper Backup needs programmatic credentials, not console access.

Then click Next:

Step 3: Attach a least-privilege policy

For permissions, attach a custom policy directly to this dedicated user. The policy should grant only the S3 actions Hyper Backup needs. AWS recommends least-privilege access, so avoid broad policies such as AmazonS3FullAccess. Create a custom policy with the minimum required permissions.

If several backup users need the same permissions, create an IAM user group, attach the policy to the group, and add the users to it.

According to Synology’s current permission list, the policy must cover:

Bucket listing, location lookup, and multipart-upload listing
Object upload, download, deletion, version access, ACL access, and multipart-upload cleanup
Listing the account’s buckets while the task is created

Use the following policy as a starting point:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:ListBucketMultipartUploads"
      ],
      "Resource": ["arn:aws:s3:::{Bucket Name}"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:GetObject",
        "s3:GetObjectAcl",
        "s3:GetObjectVersion",
        "s3:GetObjectVersionAcl",
        "s3:PutObject",
        "s3:PutObjectAcl"
      ],
      "Resource": ["arn:aws:s3:::{Bucket Name}/*"]
    },
    {
      "Effect": "Allow",
      "Action": "s3:ListAllMyBuckets",
      "Resource": "*"
    }
  ]
}

Replace {Bucket Name} in both resource ARNs with the exact backup-bucket name, then paste the policy into the JSON editor:

Give the policy a clear name, then click Create policy:

Return to the IAM user setup, search for the policy, select it, and click Next:

Then click Create user:

Step 4: Create an access key

In the IAM user list, open the user you just created:

Open the Security credentials tab and scroll to Access keys.

Click Create access key:

Choose Third-party service, read the warning, and confirm that you want to create an access key:

Then click Create access key:

Download the CSV file once and store it securely. AWS will not show the secret access key again. Do not paste these credentials into notes, screenshots, or source code:

Step 5: Create the Hyper Backup task

In Synology DSM, open the Hyper Backup application:

Click the add button to create a new backup task:

Choose Folders and packages, then click Next:

Scroll down and choose S3 Storage as the destination:

Enter the access key ID and secret access key from the CSV file you downloaded.

Choose the bucket from the drop-down menu and select the directory where you want Hyper Backup to store the repository:

Choose the shared folders or volumes you want to back up:

Select any supported applications whose configuration and data you also want to back up:

Enable transfer encryption, then choose the S3 storage class. Check retrieval fees and minimum-storage-duration charges first. Do not move Hyper Backup repository objects to Glacier with a separate S3 lifecycle rule; Synology warns that this can make the backup task fail:

Choose a backup schedule that matches how often the data changes.

For this small test I will leave Compress backup data unchecked. For production data, compression can reduce stored data and transfer time, although the benefit depends on the file types:

Enable backup rotation and choose how many versions to retain. Make sure the retention policy fits both your recovery needs and S3 costs:

Review the settings and click Done:

Step 6: Run and verify the backup

For this test, the shared folder named test contains testFile.html:

In Hyper Backup, open the task and click Back up now:

Monitor the backup until it completes without errors:

After the backup succeeds, open the S3 bucket. You will see a repository with the .hbk extension. Treat this as a managed Hyper Backup repository; restore through Hyper Backup rather than editing its objects directly:

Step 7: Test a restore from Amazon S3

Open Hyper Backup and click the restore button:

Choose Folders and packages, then click Next:

If this is a new Synology NAS, or no backup task exists on it, choose Restore from existing repositories:

Choose S3 Storage:

Enter the access key ID and secret access key, then choose the bucket and directory that contain the backup repository:

If you only need files and applications, choose Do not restore system configuration:

Choose the shared folder or volume you want to restore:

Review the restore settings and click Done:

When the restore status shows Completed, confirm that the restored files appear in File Station and open at least one file:

Final checks

A backup is useful only if you can restore it. Whether you use QNAP, Synology, or another storage platform, Amazon S3 can provide a durable off-site copy with storage classes for different access patterns.

After the first successful run, restore a test file and run Hyper Backup’s integrity check. Review the S3 bill and access-key activity periodically, rotate the IAM access key, and keep the Hyper Backup encryption key in a separate secure location.

An off-site backup does not replace every local copy. If you have an external drive, consider keeping an additional backup on an external HDD.

How to Back Up a Synology NAS to Amazon S3

What this guide covers