Why Backblaze B2 is a natural fit for backup storage
#Backblaze B2 was designed from the ground up as a storage platform for backup and archive workloads. Combined with Plakar, it provides a complete backup solution with strong cost and security properties:
- Predictable, low costs: B2 is significantly cheaper than AWS S3 or Google Cloud Storage, with no egress fees when used with supported partners. For large backup repositories, the cost difference is substantial.
- S3-compatible API: B2 speaks the S3 protocol natively, meaning Plakar’s S3 integration works out of the box with no special configuration.
- Object Lock and immutability: B2 supports Object Lock, providing write-once, read-many (WORM) storage that prevents backups from being modified or deleted — even by a compromised account.
- Built-in replication: B2 supports cross-region replication without egress fees, making it straightforward to maintain geographically distributed backup copies.
What happens when backup storage credentials are compromised
#B2 access is controlled by API keys with fine-grained permission scoping. Despite this, credentials embedded in scripts or shared across services remain a risk:
- Total loss: An attacker with a writable API key can delete or overwrite entire buckets through the S3-compatible API.
- Ransomware: Malicious actors can overwrite backup data with encrypted content, making it inaccessible without paying a ransom.
- No recovery path: Without an independent layer of protection, there is nothing to restore from if backup data is tampered with.
Plakar mitigates these risks by adding end-to-end encryption and immutable snapshots on top of B2. Even if B2 credentials are compromised, Plakar’s encryption ensures backup data cannot be read or silently tampered with.
How Plakar works with Backblaze B2
#Backblaze B2 is supported through Plakar’s S3 integration. All three connector types are available:
- Source Connector: Take snapshots of a B2 bucket and store them in an independent Kloset Store.
- Storage Connector: Use a B2 bucket as the backend for a Kloset Store, storing encrypted and deduplicated snapshots from any source.
- Destination Connector: Restore verified snapshots back to a B2 bucket, whether the original or a different one entirely.
