Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThe reliable pattern is to prepare a consistent backup set on the Linux VPS, upload it to a private Amazon S3 bucket, retain older versions, and prove that restores work. Use aws s3 sync for an incremental directory transfer and aws s3 cp for a deliberately created, timestamped archive. Schedule the job with a restricted identity, encrypt the data, monitor failures, and test recovery instead of assuming an uploaded object is a usable backup.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What an S3 VPS backup actually protects
Amazon S3 is the off-server destination; it does not by itself create a coherent backup of a running VPS. Your process must decide what to capture, make databases internally consistent, package files, transfer them, retain recovery points, and provide a documented restore path.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A practical backup set commonly contains application data, deployment files, selected /etc configuration, database dumps, and TLS certificates or private keys that the service needs. Store those items under a controlled directory such as /srv/backup before uploading. Exclude caches, temporary files, package-manager caches, build artifacts, and anything that can be recreated. The exact paths are workload-specific, so keep an inventory beside the job configuration.
- Recovery point objective (RPO): how much recent work you can afford to lose. Nightly uploads imply a larger possible loss window than hourly uploads.
- Recovery time objective (RTO): how quickly the service must be usable again. A small archive may restore faster than thousands of individual objects, while a directory sync can be faster for a small change.
- Consistency: files copied while an application is writing may not form a usable point-in-time set. Dump databases first and then upload the completed dumps.
Choose the backup shape: directory sync or archive
| Approach | Best use | Recovery behavior | Important caveat |
|---|---|---|---|
aws s3 sync |
Recursive, incremental transfer of a prepared backup directory | Individual files are easy to retrieve; unchanged files are not uploaded again | It mirrors a directory’s current contents only when you deliberately add deletion options; it is not automatically an immutable snapshot |
aws s3 cp of a tarball or dump |
A named point-in-time recovery set | One object identifies one restore point and can be downloaded as a unit | Creating and reading a large archive consumes local disk, CPU, and time |
Many operators use both: create database dumps and a timestamped archive for a complete point-in-time set, then use sync for smaller, frequently changing application directories. Keep each restore point under a date-stamped prefix such as hosts/web-01/2026-10-15T020000Z/; do not overwrite the same key when you need clearly identifiable snapshots.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Create and lock down the S3 bucket
Choose a Region close enough to meet latency and data-residency requirements. Every S3 object lives in a bucket, and the bucket name is globally unique. Create it with the AWS CLI identity that administers your account:
aws s3api create-bucket
--bucket BUCKET_NAME
--region REGION
--create-bucket-configuration LocationConstraint=REGIONFor the us-east-1 Region, omit --create-bucket-configuration; that Region uses the older create-bucket request format.
Free tools Windows power users keep installed
One-click scans. No signup required.
Immediately block public access. A backup bucket should not need a public bucket policy, website hosting, or anonymous object reads:
aws s3api put-public-access-block
--bucket BUCKET_NAME
--public-access-block-configuration
BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=trueEnable Versioning when you need to recover from an accidental overwrite or deletion. AWS describes versioning as keeping multiple variants of an object in the same bucket:
aws s3api put-bucket-versioning
--bucket BUCKET_NAME
--versioning-configuration Status=EnabledVersioning protects previous object versions, but it also means deleted or replaced data can continue consuming storage. Pair it with lifecycle rules that match your retention policy rather than enabling it and forgetting about cost.
Install the AWS CLI and use a dedicated identity
Install the AWS CLI from your Linux distribution or the current AWS installation method, then configure a non-interactive credential source for the backup job. Verify which identity the VPS is actually using:
Recommended Free Tools
aws sts get-caller-identity
aws configure listThe identity needs only the S3 actions required by the job. A one-way upload job can usually avoid deletion and administrative actions; a restore job also needs object reads. Restrict permissions to the chosen bucket and, where practical, to a host-specific prefix. Keep backup credentials separate from your interactive administrator credentials, rotate them, and never put secret keys in a script committed to source control.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
If the VPS runs in an environment that can provide short-lived credentials through an attached role or equivalent identity mechanism, prefer that over long-lived access keys. Whichever method you use, document where the job obtains credentials and how an operator revokes them.
Prepare a consistent backup set
Create a staging directory with restrictive permissions, then generate database dumps before copying application files. Examples:
install -d -m 700 /srv/backup/staging
# PostgreSQL example
pg_dump --format=custom --file=/srv/backup/staging/app-$(date -u +%Y%m%dT%H%M%SZ).dump DATABASE_NAME
# MySQL or MariaDB example
mysqldump --single-transaction --routines --events DATABASE_NAME
> /srv/backup/staging/app-$(date -u +%Y%m%dT%H%M%SZ).sqlUse the database engine’s documented consistency options and credentials. A dump command that merely reads live tables without a transaction or lock strategy can produce an unusable or logically inconsistent result. For very large databases, consider the engine’s native physical-backup tooling and verify that the resulting files are complete before upload.
Copy configuration and application data into the same staging tree only after the dump succeeds. Do not include live database socket files, transient lock files, or secrets that the service does not need at restore time. If private keys must be recoverable, treat the staging directory as sensitive and limit its Unix permissions.
Upload with aws s3 sync
For a prepared directory, synchronize recursively to a host-specific prefix:
aws s3 sync /srv/backup/staging
s3://BUCKET_NAME/hosts/HOSTNAME/
--only-show-errors
--sse AES256The sync command compares source and destination and transfers files that are new or changed. --only-show-errors keeps routine output manageable while still exposing failures. Add explicit exclusions for content that must never leave the VPS:
aws s3 sync /srv/backup/staging s3://BUCKET_NAME/hosts/HOSTNAME/
--exclude '*.tmp'
--exclude 'cache/*'
--only-show-errors
--sse AES256Do not add --delete casually. It removes destination objects that no longer exist locally, which can erase a file you intended to retain; Versioning may make recovery possible, but it does not make an unsafe mirror harmless. If your policy requires pruning, test it against a non-production prefix first and rely on lifecycle retention as an additional safety net.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
For customer-managed key control, replace --sse AES256 with --sse aws:kms --sse-kms-key-id KMS_KEY_ARN. The uploading identity then needs permission to use that key, and the key policy must remain available during a restore.
Create immutable, timestamped archives with aws s3 cp
An archive gives operators an unambiguous restore point. Build it outside the directory that is being archived, include a manifest, and upload it under a unique UTC timestamp:
STAMP=$(date -u +%Y%m%dT%H%M%SZ)
ARCHIVE=/srv/backup/${HOSTNAME}-${STAMP}.tar.zst
tar --zstd -cpf "$ARCHIVE" -C /srv/backup/staging .
sha256sum "$ARCHIVE" > "$ARCHIVE.sha256"
aws s3 cp "$ARCHIVE"
"s3://BUCKET_NAME/hosts/$HOSTNAME/archives/${STAMP}.tar.zst"
--only-show-errors --sse AES256
aws s3 cp "$ARCHIVE.sha256"
"s3://BUCKET_NAME/hosts/$HOSTNAME/archives/${STAMP}.tar.zst.sha256"
--only-show-errors --sse AES256Date-stamped keys avoid accidental replacement and make retention audits understandable. Remove local archives only after every upload and verification step has succeeded, and keep enough local free space for the largest expected archive plus a new database dump.
Automate nightly backups without overlapping jobs
A systemd service and timer provide explicit logs and status. The service below serializes runs with flock, fails on an upload error, and calls a separate script so the policy is easy to review.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall[Unit]
Description=Upload VPS backup to Amazon S3
After=network-online.target
Wants=network-online.target
[Service]
Type=oneshot
User=backup
Group=backup
ExecStart=/usr/local/sbin/vps-s3-backup
[Unit]
Description=Nightly VPS S3 backup timer
[Timer]
OnCalendar=*-*-* 02:00:00 UTC
Persistent=true
RandomizedDelaySec=15m
[Install]
WantedBy=timers.target
In /usr/local/sbin/vps-s3-backup, use strict shell settings, a lock, and a log destination:
#!/usr/bin/env bash
set -Eeuo pipefail
exec 9>/run/lock/vps-s3-backup.lock
flock -n 9 || { echo 'backup already running'; exit 1; }
LOG=/var/log/vps-s3-backup.log
exec >>"$LOG" 2>&1
echo "$(date -u +%FT%TZ) backup started"
# 1. Create verified database dumps and stage files here.
# 2. Upload with aws s3 sync or aws s3 cp.
# 3. Check every command's exit status.
echo "$(date -u +%FT%TZ) backup completed"
Enable and inspect it with:
chmod 750 /usr/local/sbin/vps-s3-backup
systemctl daemon-reload
systemctl enable --now vps-s3-backup.timer
systemctl list-timers vps-s3-backup.timer
systemctl start vps-s3-backup.service
journalctl -u vps-s3-backup.service --since todayCron is also suitable for a small deployment, provided the script uses absolute paths, exports the intended credential environment, writes logs, and prevents overlap with flock. Whichever scheduler you choose, alert on a nonzero exit status and on missing objects, not merely on whether the scheduler launched.
Encryption, access control, and sensitive data
Amazon S3 buckets have encryption configured by default, and new objects are automatically encrypted at rest with SSE-S3. The AWS CLI uses SSL for transport by default, protecting data in transit. These defaults do not decide who can read the bucket or who controls a customer-managed key.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
- SSE-S3: the simplest explicit option for server-side encryption with keys managed by the service.
- SSE-KMS: use when a customer-managed key, key-use audit trail, or organization policy requires it. Restrict key use and protect the key policy separately from the S3 policy.
- Client-side encryption: an additional layer when the operator must control plaintext before it reaches S3; it increases key-storage and recovery responsibility.
Database dumps, environment files, signing keys, and TLS private keys remain sensitive even when encrypted at rest. Limit shell history exposure, avoid printing secrets in logs, and ensure the restore operator can obtain the required decryption key without placing it in the same failure domain as the backup.
Retention, Versioning, and lifecycle costs
Define retention in terms of recovery points: for example, keep recent daily archives, fewer weekly points, and a monthly point for longer-term incidents. The exact schedule should follow your RPO, legal requirements, and budget.
Versioning retains older variants when a key is overwritten or deleted. Lifecycle rules can expire noncurrent versions and transition objects according to your retention plan. Review these rules whenever your backup frequency changes; a policy that silently retains every daily dump forever can cost more than expected, while an aggressive expiration rule can remove the only usable restore point.
Storage is not the only cost. Account for request charges, lifecycle transitions, retrieval, and data transfer when restoring large archives or copying them to another Region. A second Region or independent account improves resilience against a regional or account-level incident, but it adds storage, transfer, permissions, and operational complexity.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Restore a single file
Restore into a disposable directory first so you do not overwrite a live configuration accidentally:
install -d -m 700 /srv/restore-test
aws s3 cp
s3://BUCKET_NAME/hosts/HOSTNAME/etc/nginx/nginx.conf
/srv/restore-test/nginx.conf
--only-show-errorsIf Versioning is enabled and the current object is wrong, list versions, identify the required version ID, and request that exact version:
aws s3api list-object-versions
--bucket BUCKET_NAME
--prefix hosts/HOSTNAME/etc/nginx/nginx.conf
aws s3api get-object
--bucket BUCKET_NAME
--key hosts/HOSTNAME/etc/nginx/nginx.conf
--version-id VERSION_ID
/srv/restore-test/nginx.confCompare the restored file with its expected checksum or inspect it before placing it under /etc. Preserve ownership and permissions when replacing production files, then validate the service configuration before restarting the service.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Restore a complete archive or rebuild a VPS
- Provision a replacement VPS with the required operating-system version, disk capacity, network access, and service dependencies.
- Install the AWS CLI and configure an identity with read access to the backup prefix and, if applicable, decrypt permission for the KMS key.
- List available date-stamped archives and select a restore point that meets the incident’s RPO.
- Download the archive and checksum file into a directory with sufficient free space.
- Verify the checksum and archive integrity before extracting:
aws s3 cp s3://BUCKET_NAME/hosts/HOSTNAME/archives/20261015T020000Z.tar.zst /tmp/restore.tar.zst
aws s3 cp s3://BUCKET_NAME/hosts/HOSTNAME/archives/20261015T020000Z.tar.zst.sha256 /tmp/restore.tar.zst.sha256
(cd /tmp && sha256sum --check restore.tar.zst.sha256)
tar --zstd -tf /tmp/restore.tar.zst > /tmp/restore.manifest
install -d -m 700 /srv/restore-test
tar --zstd -xpf /tmp/restore.tar.zst -C /srv/restore-testRestore database dumps with the database engine’s import command, restore configuration only after reviewing paths and secrets, then start services in dependency order. A full application restore should include a smoke test: can the service start, can it read its data, can a user authenticate, and can the application serve a representative request?
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Test and monitor the backup process
At least periodically, perform both a single-file restore and a complete restore to a disposable directory or replacement VPS. Record the archive timestamp, checksum result, database-import result, and elapsed restore time. This measures whether the actual RTO is realistic.
- Alert when the script exits nonzero or when the expected object is absent after its scheduled window.
- Check object timestamps, local disk capacity, and the size of database dumps for unexpected changes.
- Review S3 access logs or your account’s audit trail for unauthorized reads, policy changes, and key-use failures.
- Rehearse loss of the VPS and loss of the primary AWS account separately; the recovery procedure and credentials should not depend on the failed host.
Common failure modes and fixes
The CLI uploads to the wrong account or Region
Run aws sts get-caller-identity, inspect aws configure list, and make the Region explicit in both the profile and S3 URI operations. A successful command is not proof that it used the intended identity.
The job succeeds but the database is unusable
Move the dump into the workflow before the upload, use a transactionally consistent dump method, and test an import. Never treat a copied live database directory as equivalent to a verified database backup.
Old files disappear after a sync
Check whether --delete was used, inspect object versions, and remove destructive options from the scheduled command. Use date-stamped archive prefixes when independent restore points matter.
Uploads fail with AccessDenied or KMS errors
Confirm bucket policy, identity permissions, prefix conditions, and—when using SSE-KMS—the key policy and key identifier. The restore identity needs decrypt permission even if the upload identity does not.
The backup fills local disk
Measure archive and dump sizes, prune only after successful uploads, stream or compress where appropriate, and reserve space for the next run. A lock prevents two simultaneous jobs from consuming the same disk.
When AWS Backup is a better fit
AWS Backup provides centralized, policy-based protection for AWS and hybrid resources, including schedules, retention, and lifecycle policies. It is worth evaluating when one team manages many VPS-related resources and needs a single policy plane, standardized compliance controls, or centralized reporting. A small per-host script is often easier to understand for one VPS, while AWS Backup adds service configuration, permissions, and cost considerations. Compare both approaches by RPO/RTO, database consistency, credential scope, encryption-key ownership, retention cost, cross-account or cross-Region resilience, monitoring, and the effort required to prove a restore.
Document the runbook
Keep a short, offline-readable runbook containing the bucket name and Region, host and prefix convention, encryption mode, KMS key identifier if used, retention rules, scheduler location, expected object names, and exact restore commands. Include who can authorize access and where emergency credentials are stored. Update it whenever the backup layout or application changes; a correct command is useless if nobody knows which prefix contains the latest usable restore point.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
