Verestore
Launching shortly

Google Cloud Storage (S3 interoperability)

Verified against the provider's documentation, not against a live account.

A provider snapshot disappears with the project that holds it; a dump in a bucket you control is the copy that survives, and Verestore proves it restores. For Cloud SQL, see Cloud SQL scheduled export to Cloud Storage for the write side.

1. Write dumps to Cloud Storage

From any host with gcloud and write access to the bucket:

pg_dump --format=custom --no-owner "$DATABASE_URL" \
  | gcloud storage cp - "gs://acme-backups/orders/orders-$(date -u +%Y-%m-%dT%H-%M).dump"

Verestore accepts pg_dump custom format (-Fc) or plain SQL, optionally gzipped. The format is detected from the content, not the file extension.

2. Create a reader service account

gcloud iam service-accounts create verestore-reader \
  --project=PROJECT --display-name="Verestore (read-only)"

Grant it roles/storage.objectViewer on the bucket only, not on the project:

gcloud storage buckets add-iam-policy-binding gs://acme-backups \
  --member=serviceAccount:verestore-reader@PROJECT.iam.gserviceaccount.com \
  --role=roles/storage.objectViewer

3. Optional: restrict it to the prefix

The simplest strict scope is a dedicated bucket per database. If the bucket is shared, add an IAM Condition to the binding instead (the bucket must use uniform bucket-level access). Listing is checked against the bucket itself, so the condition must allow the bucket as well as the objects under the prefix:

gcloud storage buckets add-iam-policy-binding gs://acme-backups \
  --member=serviceAccount:verestore-reader@PROJECT.iam.gserviceaccount.com \
  --role=roles/storage.objectViewer \
  --condition='title=orders-prefix-only,expression=resource.name == "projects/_/buckets/acme-backups" || resource.name.startsWith("projects/_/buckets/acme-backups/objects/orders/")'

Use this binding in place of the unconditional one from step 2, not in addition to it. Listing still reveals object names in the whole bucket, never their content.

4. Create an HMAC key

Verestore uses the Cloud Storage XML API through its S3 interoperability. Create an HMAC key for the service account:

gcloud storage hmac create verestore-reader@PROJECT.iam.gserviceaccount.com

The output contains the access ID (the access key ID) and the secret (the secret access key). The secret is shown once.

Verestore only lists objects under the prefix (ListObjectsV2) and reads orders/*, pinned to the listed ETag. It never writes or deletes.

5. Add the target in Verestore

  • S3 endpoint: https://storage.googleapis.com
  • Region: auto (or leave it empty: it is filled from the endpoint)
  • Bucket: acme-backups
  • Prefix: orders/
  • Access key ID: the HMAC access ID; secret access key: the HMAC secret