---
title: "backup_targets"
summary: "User-owned off-host S3-compatible repositories available to service protection policies. Accepted by the loader; not yet executable."
status: schema-only
generated: true
read_when:
  - "Evaluating the proposed protection layer"
  - "Understanding why Onebox refuses a backup target that shares the protected host"
---

> **Accepted, not yet executable**
>
> The loader validates this block and it is published in the JSON Schema, so your
> editor will complete it. The behaviour behind it is an open proposal. Declaring
> it changes nothing on the target.

This page is generated from the same Go declarations the loader enforces, so it
cannot drift from what `ob validate` accepts.

## Fields on this page

`access_key_entry` · `bucket` · `cold` · `credentials` · `encryption` · `endpoint` · `failure_domain` · `file` · `host` · `identity` · `kind` · `pitr` · `prefix` · `provider` · `region` · `secret_key_entry` · `session_token_entry` · `snapshot` · `tls`

## Reference

| Field | Type | Default | What it does |
| --- | --- | --- | --- |
| `<name>.bucket` | string | — | Existing destination bucket used by this target. Expects a lower-case S3-compatible bucket name between 3 and 63 characters. |
| `<name>.credentials` | object | — | Trusted encrypted-file entries containing destination credentials; values never appear in the project. |
| `<name>.credentials.access_key_entry` | string | — | Variable name containing the destination access key. Expects a variable name of letters, digits and underscores, not starting with a digit. |
| `<name>.credentials.file` | string | — | Repository-relative encrypted credential file staged through the trusted secret flow. Expects a path inside the repository, with no control character or shell metacharacter. |
| `<name>.credentials.provider` | `sops` | `sops` | Trusted secret provider. Only sops is currently executable. |
| `<name>.credentials.secret_key_entry` | string | — | Variable name containing the destination secret key. Expects a variable name of letters, digits and underscores, not starting with a digit. |
| `<name>.credentials.session_token_entry` | string | — | Optional variable name containing a temporary destination session token. Expects a variable name of letters, digits and underscores, not starting with a digit. |
| `<name>.encryption` | object | — | Required encryption mode for each recovery kind this target may store. |
| `<name>.encryption.cold` | `client-side` · `archive-password` · `server-side-sse` | — | Encryption mode required for cold recovery: client-side, archive-password, or server-side-sse. |
| `<name>.encryption.pitr` | `client-side` · `archive-password` · `server-side-sse` | — | Encryption mode required for point-in-time recovery: client-side, archive-password, or server-side-sse. |
| `<name>.encryption.snapshot` | `client-side` · `archive-password` · `server-side-sse` | — | Encryption mode required for snapshot recovery: client-side, archive-password, or server-side-sse. |
| `<name>.endpoint` | string | — | Destination API endpoint. HTTPS is required unless tls is explicitly insecure. Expects an http or https URL. |
| `<name>.failure_domain` | object | — | Operator-declared identity used to prove the destination does not share the protected host. |
| `<name>.failure_domain.host` | string | — | Destination host identity used to refuse a target on the protected host. Expects a stable identifier of letters, digits, dots, colons, slashes, underscores and hyphens. |
| `<name>.failure_domain.identity` | string | — | Stable operator-owned failure-domain identity, distinct from the protected host. Expects a stable identifier of letters, digits, dots, colons, slashes, underscores and hyphens. |
| `<name>.kind` | `s3-compatible` | — | Destination kind. Only s3-compatible is supported. |
| `<name>.prefix` | string | — | Non-secret object prefix reserved for Onebox protection data. Expects a relative object prefix with no empty leading component or shell metacharacter. |
| `<name>.region` | string | — | S3-compatible region when the endpoint requires one. Expects a lower-case S3-compatible region of letters, digits and hyphens. |
| `<name>.tls` | `required` · `insecure` | `required` | TLS verification policy: required or insecure. |