In order for Duplicator Pro to properly access your S3 bucket, a policy similar to the following must be set up.

This JSON policy applies to genuine Amazon S3, where access is managed through AWS IAM. Most S3-compatible providers (Wasabi, DigitalOcean Spaces, Vultr S3, Cloudflare R2, Backblaze B2, Dream Objects) use their own console-based key and permission model instead, so this policy document does not apply to them.

Add the following to your IAM policy document, replacing the name of your bucket for BUCKETNAME (e.g. mybucket.domain.com)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:ListBucketMultipartUploads"
            ],
            "Resource": "arn:aws:s3:::BUCKETNAME",
            "Condition": {}
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionAcl",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::BUCKETNAME/*",
            "Condition": {}
        },
        {
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "*",
            "Condition": {}
        }
    ]
}

AWS now defaults new buckets to “Block all public access” with ACLs disabled (“Bucket owner enforced”). This is fine for the IAM permissions above, since Duplicator authenticates with an IAM user key rather than relying on public access. However, Duplicator Pro’s own S3 storage settings include a separate “Give bucket owner full control (ACL)” option, checked by default, which sends an ACL header on every upload. If the target bucket has ACLs disabled, leave this option unchecked in the storage settings; otherwise uploads can fail even with the correct IAM policy in place.

Note: For an in-depth understanding of buckets, users, and policies, see the official S3 documentation. For the full connection walkthrough, see Storing Your Backup to Amazon S3; for connection issues, see How do I fix issues with Amazon S3 or S3-compatible storage types?

With this policy attached to the IAM user, Duplicator Pro can list, upload, retrieve, and delete backups in the specified bucket without needing broader account access.