# Cloud Storage Access
+ For example, `Amazon S3` (For `GCP` and `Azure` object storage services, the settings are similar)
+ Two ways to access `S3`:
  + **_(Recommended)_** Associate an `IAM` role that can access `S3` with the `EC2` instances where the `TiKV` and `BR` nodes run
  + **_(Alternative)_** Configure **`access-key`** and **`secret-access-key`** for accessing `S3` in the **`br`** `CLI`, and set **`--send-credentials-to-tikv=true`** to pass the access key from `BR` to each `TiKV`
+ `AWS IAM` references
[https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html)
+ Managing access keys for `IAM` users references
[https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html)
```
~!@// Recommended@!~
$ br backup full --pd "{pd_address}:2379" \
  --storage "s3://{bucket}/{prefix}" --s3.region "{region_code}"

~!@// Alternative@!~
$ br backup full --pd "{pd_address}:2379" \
  --storage "s3://{bucket}/{prefix}?access-key={access_key}&secret-access-key={secret_access_key}" \
  --s3.region "{region_code}" --send-credentials-to-tikv=true
```

-------------------------------------------------------------
For backing up to `S3`, if the you are using `access-key` and `secret-acess-key` for credentials, your command should looks like:

```
br backup full \
  --pd "{pd_address}:2379" \
  --storage "s3://{bucket}/{prefix}?access-key={access_key}&secret-access-key={secret_access_key}" \
  --s3.region "{region_code}" \
  --send-credentials-to-tikv=true
```