Getting started

Install pi2s3 in minutes

Two things to have in place before the first backup: an S3 bucket with an IAM policy, and AWS credentials on the Pi. The installer checks everything and walks you through it — from a clean Pi to a scheduled nightly backup in under 10 minutes.

Before you start

Prerequisites

Three things to have in place before running install.sh. The installer verifies all three and will tell you what's missing.

1

AWS account & S3 bucket

You need an AWS account and an S3 bucket in your chosen region. Create the bucket in the S3 console or with the CLI:

aws s3 mb s3://your-bucket-name --region af-south-1
2

IAM credentials on the Pi

Configure AWS credentials on the Pi. Use the minimum required permissions. Create an IAM user or role with this policy:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "s3:PutObject",
      "s3:GetObject",
      "s3:DeleteObject",
      "s3:ListBucket"
    ],
    "Resource": [
      "arn:aws:s3:::your-bucket-name",
      "arn:aws:s3:::your-bucket-name/*"
    ]
  }]
}

Then configure credentials on the Pi:

aws configure   # or set AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY in environment
3

Enable S3 bucket encryption

Your backup contains secrets: .env files, SSH keys, database data, API tokens. Enable default encryption before the first backup. It costs nothing and takes 30 seconds.

aws s3api put-bucket-encryption \
  --bucket your-bucket-name \
  --server-side-encryption-configuration \
  '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'

Use SSE KMS instead of AES256 if you need CloudTrail audit trails or cross account key management. The backup does not encrypt client side. S3 managed encryption is the recommended baseline.

Quick start

Up and running in minutes

One install script handles dependencies, AWS verification, lifecycle policy, cron scheduling, and a dry run test.

1

Run the installer on your Pi

SSH into your Pi and paste one command. It detects your hardware, installs dependencies, prompts for your S3 bucket and region (creates the bucket if it doesn't exist), configures cron, runs a dry-run test, then offers to run a real backup immediately.

curl -sL pi2s3.com/install | bash
2

First backup

Force an immediate backup to confirm everything works end to end. You'll get a push notification when done.

bash ~/pi2s3/pi-image-backup.sh --force
3

List your backups

bash ~/pi2s3/pi-image-backup.sh --list

2026-04-16/  3.4 GB  raspberrypi  (nvme0n1, mmcblk0)
2026-04-15/  3.3 GB  raspberrypi
2026-04-14/  3.3 GB  raspberrypi
4

Named AWS profile

If you use multiple AWS accounts, set a profile in config.env:

AWS_PROFILE="pi-backup"   # in config.env
5

Check status any time

bash ~/pi2s3/install.sh --status   # cron, log tail, dependency versions
bash ~/pi2s3/install.sh --upgrade  # git pull + redeploy
🔌
Using the CloudScale Cyber & Devtools plugin?
Trigger backups, browse restore points, and monitor backup health directly from the WordPress admin panel — no SSH required. View the backup & restore panel docs →