How to use Impossible Cloud Storage with Synology ActiveProtect
Impossible Cloud Storage can be added to a Synology ActiveProtect site as remote storage, giving your ActiveProtect appliances an off-site destination for immutable backup copies.
Synology ActiveProtect is a line of dedicated backup appliances running ActiveProtect Manager (APM), Synology's backup and recovery operating system. It protects workloads such as physical servers, PCs, virtual machines, file servers, databases and Microsoft 365 from a single console. It is a separate product from Hyper Backup, which runs as a package on Synology DSM.
Synology maintains the step-by-step instructions for this integration: How do I add Impossible Cloud Storage to the ActiveProtect site as remote storage? Use that article for detailed instructions in ActiveProtect Manager. This article covers what you need to prepare on the Impossible Cloud side first.
Prepare the bucket
Create a bucket with Object Lock enabled and leave the default object retention on the bucket unset. ActiveProtect Manager sets the lock period per version from its own retention policy, so a bucket-level default would conflict with it. See Enabling object lock.
Object Lock has to be enabled when the bucket is created, so use a new bucket dedicated to ActiveProtect. Everything in the bucket is managed exclusively by ActiveProtect Manager, including retention and deletion.
Prepare the access key
ActiveProtect Manager authenticates with an access key and secret key. We recommend a dedicated IAM user restricted to the backup bucket. See How to Set Up a Secure Programmatic Access to Impossible Cloud Storage for Backup Applications for creating the user, attaching a policy and generating the key.
For the policy contents, use the JSON template in Synology's tutorial, which lists the actions ActiveProtect Manager needs.
Check the endpoint and connectivity
Use the regional S3 endpoint for the bucket's region. See S3 regional endpoints.
The management server needs to reach the endpoint for initial authentication. Confirm that every backup server in the site can also reach it, otherwise their backup copies will fail once the storage is in use.
Adding the storage in ActiveProtect Manager
In ActiveProtect Manager, remote storage is added under Infrastructure > Remote storage > Add, using the S3 Compatible type. Follow Synology's tutorial for the full sequence.