Skip to main content

Repositories

A Corso repository stores encrypted copies of a Microsoft 365 tenant's backup data. Each repository is configured to store data in an object storage bucket and, optionally, a user-specified prefix within the bucket. A repository is only meant to store a single tenant's data but a single object storage bucket can contain multiple repositories if unique --prefix options are specified when initializing a repository.

Within a repository, Corso uses AES256-GCM-HMAC-SHA256 to encrypt data at rest using keys that are derived from the repository passphrase. Data in flight to and from the repositiry is encrypted via TLS.

Repositories are supported on the following object storage systems:


note

Depending on community interest, Corso will add support for other object storage backends in the future.

Amazon S3​

Prerequisites​

Before setting up your Corso S3 repository, the following prerequisites must be met:

  • The S3 bucket for the repository already exists. Corso won't create it for you.
  • You have access to credentials for a user or an IAM role that has the following permissions:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:DeleteObject",
                "s3:GetBucketLocation",
            ],
            "Resource": [
                "arn:aws:s3:::<YOUR_BUCKET_NAME>",
                "arn:aws:s3:::<YOUR_BUCKET_NAME>/*"
            ]
        }
    ]
}

Credential setup​

Corso supports the credential options offered by the AWS Go SDK. For Full details, see the Specifying Credentials section of the official documentation. The two most commonly-used options are:

  • Environment variables - set and export AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. If using temporary credentials derived by assuming an IAM Role, you will also need AWS_SESSION_TOKEN.

  • Credentials file - ensure that the credentials file is available to Corso (for example, may need to map it if using Corso as a container). You may also want to set and export AWS_PROFILE, if not using the default profile, and AWS_SHARED_CREDENTIALS_FILE, if not using the default file location. You can learn more about the AWS CLI environment variables here.

Initialize repository​

Before first use, you need to initialize a Corso repository with corso repo init s3. See the command details here.

# Initialize the Corso Repository
$Env:CORSO_PASSPHRASE = "CHANGE-ME-THIS-IS-INSECURE"
.\corso repo init s3 --bucket corso-test

Connect to a repository​

If a repository already exists, you can connect to it with corso repo connect s3. See the command details here.

# Connect to the Corso Repository
.\corso repo connect s3 --bucket corso-test

S3-compatible object storage​

Configuring Corso to use object storage systems compatible with the AWS S3 API (for example, Google Cloud Storage, Backblaze B2, MinIO, etc.) is almost identical to the Amazon S3 instructions above with the exception that you will need to use the following flag with the initial Corso repo init command:

  --endpoint <domain.example.com>

Testing with insecure TLS configurations​

Corso also supports the use of object storage systems with no TLS certificate or with self-signed TLS certificates with the --disable-tls or --disable-tls-verification flags. These flags should only be used for testing.