Storage in
your workflow.
Repeatable jobs. Useful logs. Recoverable backups.
Separate people from pipelines.
Use a dedicated service key for each automated workload. Put credentials in your CI secret store, restrict their scope to the required bucket and rotate them when ownership changes. Never bake credentials into a container image.
Make the job observable.
The CLI reads SIS3_ACCESS_KEY_ID and SIS3_SECRET_ACCESS_KEY from the environment. Non-interactive jobs use --no-input; --json emits structured output. A non-zero exit code means the job needs attention.
#!/usr/bin/env sh
set -eu
: "${SIS3_ACCESS_KEY_ID:?Set a service key}"
: "${SIS3_SECRET_ACCESS_KEY:?Set a secret key}"
sis3 sync /srv/backups s3://backups/daily \
--no-input --json
sis3 usage --no-input --jsonA backup earns its name on restore.
Schedule restore drills into a separate directory. Check the restored content against your application’s requirements and record the recovery time. Keep a second copy independent of the production account.
sis3 sync s3://backups/daily ./restore-check \
--dry-run
sis3 sync s3://backups/daily ./restore-checkKeep the incident record useful.
Record the UTC timestamp, operation, request ID and redacted error. Alert on failed backups and unexpected usage changes. Contact hello@sis3.si with the affected workload and business impact; never include secret keys.