Object repository S3 for Veeam

Veeam speaks S3, and so does OtterStorage. You can use OtterStorage as an S3-compatible Object Storage Repository in both Veeam Backup & Replication and Veeam Backup for Microsoft 365, with immutability backed by Object Lock and clear per-TB pricing, with no surprises for requests or deletes.

The problem

Backups are your last line of defense, but keeping them only on local disk or on an array in the same datacenter leaves a single point of failure: ransomware that encrypts your infrastructure can encrypt the copies too. And when you move to the cloud, two common surprises appear:

• Unpredictable bills. Many providers charge per request (PUT, GET, LIST) and, in some cases, even for deletes. With Veeam Backup for Microsoft 365 this hurts especially: M365 generates millions of small objects (emails, SharePoint/OneDrive files, Teams messages), so the cost per operation skyrockets.
• No real immutability. Without a mechanism that prevents an attacker (or human error) from deleting or overwriting the copies, there is no guarantee of recovery.

You need an external destination, compatible with Veeam out of the box, immutable, and with a cost you can calculate in advance.

The OtterStorage solution

OtterStorage is S3-compatible object storage. To Veeam, it's simply one more S3 repository: you add it as an Object Storage Repository of type S3 Compatible and it's ready to be used as the Capacity Tier of a Scale-Out Backup Repository (SOBR) or as the destination for your Microsoft 365 backups.

• Anti-ransomware immutability. We enable Veeam immutability on top of Object Lock (OtterVault). During the configured period, not even an attacker with your credentials can delete or overwrite those backups. You can also apply Legal Hold at the bucket level for indefinite retention.
• No charges for requests or deletes. We don't charge for PUT, GET, LIST or DELETE. You pay for the TB you store, and that's it. This is decisive when you have millions of small objects, as with M365.
• Clear per-TB pricing. You know what you'll pay before you start; there's no operations fine print.
• Per-bucket credentials. Each bucket has its own access key + secret key, so you can isolate the Veeam repository from the rest of your organization.

If you want a broader view of using OtterStorage for backups, take a look at backups.

How to set it up

0. Prepare the bucket in OtterStorage

Before touching Veeam, create a dedicated bucket and, if you're going to use immutability, make sure you have Object Lock (OtterVault) enabled at the moment the bucket is created. Note down these values, which you'll need in Veeam:

Endpoint S3 : https://es-mad-1.s3.otterstorage.io
Región      : eu-mad
Bucket      : veeam-backups
Carpeta     : sobr01          (Veeam la llama "folder")
Access key  : <tu-access-key>
Secret key  : <tu-secret-key>

The endpoint is entered in Veeam without the protocol prefix in some dialogs, so keep both https://es-mad-1.s3.otterstorage.io and es-mad-1.s3.otterstorage.io handy. If you have any doubts about the region or the exact format, check the documentation.

Scenario 1 — Veeam Backup & Replication (immutable Capacity Tier)

The idea is: fresh copies live in your fast local repository (Performance Tier) and, via a copy or move policy, are replicated or moved to OtterStorage as an immutable Capacity Tier within a SOBR.

1. Add the Object Storage Repository. In the Veeam console: Backup Infrastructure → Backup Repositories → Add Repository → Object Storage → S3 Compatible.
2. Endpoint and region. In Service point enter https://es-mad-1.s3.otterstorage.io and as Region specify eu-mad.
3. Credentials. Add a new credential with your bucket's access key and secret key.
4. Bucket and folder. Select the veeam-backups bucket and choose (or create) the sobr01 folder as the destination.
5. Immutability. Check Make recent backups immutable for and set the immutable retention period, for example:

   Make recent backups immutable for: 30 days

   Veeam will back this immutability with the bucket's Object Lock (OtterVault). That's why it's essential that the bucket had Object Lock enabled when it was created.
6. Create or edit the SOBR. In Backup Infrastructure → Scale-out Repositories, add your local repository as the Performance Tier and, in Capacity Tier, select the OtterStorage Object Storage Repository you just created.
7. Tiering policy. Choose how data moves down to OtterStorage:
   • Copy policy: copies backups to OtterStorage as soon as they are created (recommended to get an immutable external copy as early as possible).
   • Move policy: moves backups that exceed the operational restore window to free up local space.
   You can combine both for a solid 3-2-1-1-0 protection.

From here on, your backup jobs that point to the SOBR will automatically send copies to OtterStorage according to the defined policy.

Scenario 2 — Veeam Backup for Microsoft 365

To offload copies of Exchange Online, SharePoint, OneDrive and Teams, configure an S3-compatible object storage repository and use it as the destination for your backup repositories.

1. Add the object storage. In the Veeam Backup for Microsoft 365 console: Backup Infrastructure → Object Storage → Add → S3 Compatible.
2. Connection. Enter the Service point https://es-mad-1.s3.otterstorage.io, the region eu-mad and the bucket credentials (access key + secret key).
3. Bucket and folder. Select the bucket (for example veeam-m365) and a dedicated folder, e.g. tenant01.
4. Create the backup repository. In Backup Infrastructure → Backup Repositories → Add, choose the OtterStorage object storage as the destination. For large numbers of users, pick the SSD pool: it delivers the performance that M365 catalogs and granular restores need.
5. Assign the repository to your jobs. Point your M365 backup jobs to this repository and let Veeam do the rest.

This is where the no charges for requests or deletes model makes the difference: M365 generates enormous amounts of small objects, and with OtterStorage you only pay for the TB they occupy, not for the millions of operations Veeam performs to protect and retain them.

Benefits

• Real immutability. Object Lock (OtterVault) plus Veeam's native immutability protect your backups against ransomware and accidental deletes; with bucket-level Legal Hold you cover indefinite retention.
• Predictable cost. No PUT/GET/LIST/DELETE charges: you pay per TB and nothing else, something critical with the millions of small objects in Microsoft 365.
• Out-of-the-box compatibility. OtterStorage appears in Veeam as a standard S3 Compatible destination; no proprietary agents or gateways.
• Per-bucket isolation. Independent credentials per bucket to keep the Veeam destination separate from the rest of your organization.
• 3-2-1-1-0 strategy. An external, immutable and verifiable copy, without giving up local restore speed.

Want the steps in detail, the limits of each plan, or help with sizing? You'll find everything in the documentation, and more backup scenarios in backups.