Proxmox Backup Server and S3 object storage: what works, what it costs, what is missing

1. How an S3 datastore works

An S3 datastore has the same structure as an on-disk datastore (indexes, chunks, snapshots), but its objects are written to a bucket, prefixed with the datastore name. Several datastores can therefore share a bucket. What the documentation says:

• A local cache is mandatory. It keeps the indexes and some chunks to limit requests. The documentation recommends 64 to 128 GiB, on a dedicated disk, partition or ZFS dataset with a quota. An existing datastore cannot serve as the cache, and a memory-only cache is not possible.
• PBS does not create the bucket nor manage its permissions: bucket and access key are set up at the provider, with rights to get, put, list and delete objects.
• HTTPS only. For self-hosted object storage with a self-signed certificate, the certificate fingerprint must be provided.
• One PBS at a time can operate a datastore. After losing the server, a fresh PBS can take it over with the reuse-datastore and overwrite-in-use options, under the same name.

proxmox-backup-manager s3 endpoint create my-s3 \
  --access-key '<access-key>' --secret-key '<secret-key>' \
  --endpoint '{{bucket}}.s3.{{region}}.amazonaws.com' --region eu-central-1

proxmox-backup-manager datastore create store-s3 /mnt/datastore/store-s3-cache \
  --backend type=s3,client=my-s3,bucket=pbs-bucket

The documentation also gives examples for Ceph RADOS Gateway and Cloudflare R2. Some providers have quirks (path-style addressing, object-by-object deletion), which can be set in the endpoint configuration.

2. Copying an existing datastore to S3

There is no separate "export to S3" mode. You create an S3 datastore, then a sync job that copies the snapshots of the local datastore into it. Without --remote, the sync runs between two datastores on the same PBS.

proxmox-backup-manager sync-job create copy-s3 \
  --store store-s3 --remote-store store-local --schedule daily

• Encryption is not added along the way. PBS sends chunks to the bucket as they are stored; only the transport is encrypted (HTTPS). For the S3 provider to see only encrypted data, encrypt on the client side with your own key: see the PBS encryption key.
• The copied snapshot arrives unverified: sync does not carry the verification state, the S3 datastore's verify job has to check it (see verify jobs and sync). On S3, that check has a cost, detailed below.
• No tape from S3: the PBS 4.2.8 code refuses tape backup operations directly from an S3 datastore (« direct s3/tape operations are not supported », src/tape/mod.rs).

3. The real cost: storage, requests, egress

The documentation warns: « operating as S3 backed object store might cause additional costs. Providers might charge you for storage space and API requests performed to the buckets, egress and bandwidth fees might be charged as well ». Here is what each PBS task does on the bucket:

The surprising item is verify. A verify job reads back all chunks of the snapshots it examines, not only the new ones. A VM with 1 TB of data backed up every night, with a daily verify, therefore downloads about 1 TB per night, some thirty TB per month.

Calculation on the published Backblaze B2 price list (checked on 9 October 2026: $6.95 per TB per month, common API calls free on pay-as-you-go, free egress up to 3 times the average volume stored in the month, then $0.01 per GB), for this case: 3 TB of free egress, about 27 TB billed, i.e. around $270 per month of verification. This is an estimate from the price list, not a measurement. It only holds for that provider, and changes completely if verifications are spaced out or if the provider does not bill egress.

PBS gives you the means to monitor it: versions 4.1 and 4.2 added rate limits towards S3 endpoints, then request and traffic counters per datastore, with notification thresholds. Set them before the first invoice, not after.

4. Immutability: Object Lock is not supported

It is the most frequently asked question, and the Proxmox team's answer is consistent:

• August 2025: « object locking is currently not part of the PBS S3 implementation feature set » (Proxmox forum);
• January 2026: « immutable objects are currently not supported by the PBS S3 implementation », and « Garbage collection must be handled by the PBS, not by retention settings of the S3 backend » (Proxmox forum).

The request is open in ticket 6780, assigned but not delivered as of 9 October 2026. The reason lies in deduplication: one chunk serves many snapshots, and PBS decides when it can go. A lock set on the bucket prevents the deletions PBS requests (garbage collection, snapshot removal); an expiry rule on the bucket can, on the contrary, erase a chunk still used by a recent snapshot, which then becomes unreadable.

An S3 datastore is therefore an online copy, reachable with the PBS keys. Against an attacker who obtains those keys, the protection that depends on no setting remains an offline copy: see immutable backup and ransomware.

5. When a hosted PBS is simpler

The S3 datastore has real strengths: it reuses object storage you may already have, it grows without changing disks, and it avoids running a second server. It makes sense if you already have a PBS, an S3 provider that bills neither egress nor requests, and few restores.

A hosted PBS is simpler in the other cases, and it is what we sell, so read this with that bias in mind:

• you reserve TB, with no request or egress invoice; verification reads our disks, not a billed bucket;
• no local cache to size on your side: your PVE nodes back up directly to a PBS;
• an offline copy on unplugged disks exists, with the AirGapped Drive plan from €34 excl. VAT per TB per month.

6. What about the Nimbus Backup Gateway S3 entry point?

It is the reverse of the S3 datastore: here S3 is the way in, not the storage. Tools that do not speak to PBS (restic, rclone, Synology Hyper Backup, database scripts) write over S3 to the Gateway, and what it receives is then backed up to PBS. Proxmox VMs, for their part, go straight from Proxmox VE to PBS. Details in offsite S3 backup to PBS.

Frequently asked questions