Why Multi-Cloud Backups Matter

Relying on a single cloud provider for both production and backups creates a single point of failure. If your AWS account gets compromised, suspended, or experiences an outage, having backups only in S3 won't help much. Spreading backups across multiple providers gives you real redundancy and protects against vendor-specific issues.

The challenge is doing this without manually copying files every week or writing custom scripts that break every time an API changes. This guide walks through setting up automated backups that work across AWS, Azure, and Google Cloud.

Choose Your Backup Tools

You need tools that can talk to multiple cloud providers without requiring separate configurations for each one. Here are three approaches that work well for small businesses:

Rclone is an open-source command-line tool that supports over 40 cloud storage providers. It's free, reliable, and scriptable. The learning curve is moderate, but once configured, it runs without intervention.

Restic is another open-source option focused specifically on backups. It handles encryption, deduplication, and incremental backups automatically. It works with S3-compatible storage, Azure Blob Storage, and Google Cloud Storage.

Duplicati offers a web interface if you prefer clicking to command lines. It supports the major cloud providers and includes scheduling built-in.

For this guide, we'll focus on Rclone and Restic since they're the most flexible for automation workflows.

Set Up Your Cloud Storage Targets

Before automating anything, create storage buckets in at least two different cloud providers. This gives you geographic and vendor diversity.

AWS S3 Setup:

• Create a new S3 bucket in your preferred region
• Set up an IAM user with programmatic access
• Attach a policy granting s3:PutObject, s3:GetObject, and s3:ListBucket permissions
• Save the access key and secret key

Azure Blob Storage Setup:

• Create a storage account in a different region than your AWS bucket
• Create a container within that storage account
• Generate a storage account key or SAS token
• Note the account name and key

Google Cloud Storage Setup:

• Create a new bucket in a third region
• Set up a service account with Storage Object Admin role
• Download the JSON key file
• Keep this file secure

Spread these buckets across different geographic regions. If you're US-based with your primary infrastructure in us-east-1, consider putting backups in eu-west-1 and asia-southeast-1.

Configure Rclone for Multi-Cloud Access

Rclone uses a configuration file to store credentials for each cloud provider. Run rclone config to start the interactive setup.

For AWS:

rclone config create aws-backup s3
provider AWS
access_key_id YOUR_ACCESS_KEY
secret_access_key YOUR_SECRET_KEY
region us-east-1

For Azure:

rclone config create azure-backup azureblob
account YOUR_ACCOUNT_NAME
key YOUR_ACCOUNT_KEY

For Google Cloud:

rclone config create gcs-backup google cloud storage
service_account_file /path/to/key.json
project_number YOUR_PROJECT_ID

Test each connection:

rclone lsd aws-backup: rclone lsd azure-backup: rclone lsd gcs-backup:

If these commands list your buckets, you're ready to automate.

Create Your Backup Script

A simple bash script can orchestrate backups to multiple destinations. Here's a starting template:

bash #!/bin/bash

BACKUP_SOURCE="/var/www/data" DATE=$(date +%Y-%m-%d) LOG_FILE="/var/log/backup-$DATE.log"

echo "Starting backup at $(date)" >> $LOG_FILE

Backup to AWS

rclone sync $BACKUP_SOURCE aws-backup:my-bucket/backups/$DATE
--log-file=$LOG_FILE
--log-level INFO

Backup to Azure

rclone sync $BACKUP_SOURCE azure-backup:my-container/backups/$DATE
--log-file=$LOG_FILE
--log-level INFO

Backup to Google Cloud

rclone sync $BACKUP_SOURCE gcs-backup:my-bucket/backups/$DATE
--log-file=$LOG_FILE
--log-level INFO

echo "Backup completed at $(date)" >> $LOG_FILE

Save this as /usr/local/bin/multi-cloud-backup.sh and make it executable:

chmod +x /usr/local/bin/multi-cloud-backup.sh

Add Encryption and Compression

Never send unencrypted backups to cloud storage. Rclone supports encryption through its crypt remote type.

Create an encrypted remote that wraps your existing remotes:

rclone config create aws-backup-encrypted crypt
remote aws-backup:my-bucket/encrypted
filename_encryption standard
password YOUR_ENCRYPTION_PASSWORD
password2 YOUR_SALT_PASSWORD

Repeat this for each cloud provider. Now use aws-backup-encrypted: instead of aws-backup: in your scripts. Rclone will encrypt files before uploading them.

For compression, add the --compress flag to your rclone commands. This reduces storage costs and transfer time.

Schedule Automated Backups

Use cron to run backups on a schedule. Edit your crontab:

crontab -e

Add a line to run backups daily at 2 AM:

0 2 * * * /usr/local/bin/multi-cloud-backup.sh

For weekly backups on Sunday at 3 AM:

0 3 * * 0 /usr/local/bin/multi-cloud-backup.sh

Make sure the cron user has access to your rclone config file (usually in ~/.config/rclone/rclone.conf).

Monitor and Alert

Automation only works if you know when it fails. Add monitoring to your backup script:

bash if [ $? -eq 0 ]; then echo "Backup successful" | mail -s "Backup Success" admin@yourcompany.com else echo "Backup failed - check logs" | mail -s "BACKUP FAILURE" admin@yourcompany.com fi

For more sophisticated monitoring, send logs to a service like Healthchecks.io or set up CloudWatch/Azure Monitor alerts.

Check your backups monthly by doing test restores. A backup you can't restore is worthless. Pick a random file and verify you can download and decrypt it from each cloud provider.

Handle Backup Rotation

Don't keep every backup forever. Storage costs add up, and old backups lose value. Implement a retention policy:

• Keep daily backups for 7 days
• Keep weekly backups for 4 weeks
• Keep monthly backups for 12 months

Rclone doesn't have built-in retention, but you can script it:

bash

Delete backups older than 7 days

rclone delete aws-backup:my-bucket/daily
--min-age 7d

Delete weekly backups older than 28 days

rclone delete aws-backup:my-bucket/weekly
--min-age 28d

Run this as a separate cron job weekly.

Security Considerations

Your backup credentials have write access to cloud storage. Protect them:

• Store rclone config files with 600 permissions (readable only by owner)
• Use separate IAM users/service accounts for backups with minimal permissions
• Enable MFA delete on S3 buckets to prevent accidental or malicious deletion
• Rotate access keys every 90 days
• Never commit credentials to version control

Consider using a secrets manager like AWS Secrets Manager or HashiCorp Vault for storing cloud credentials. This adds complexity but improves security for sensitive environments.

Test Your Recovery Process

Set a calendar reminder to test recovery quarterly. Document the steps:

1. List available backups: rclone ls aws-backup:my-bucket/backups/
2. Download a backup: rclone copy aws-backup:my-bucket/backups/2024-01-15 /tmp/restore/
3. Verify file integrity and decrypt if needed
4. Confirm critical files are present and readable

Time how long a full restore takes. This tells you your actual recovery time objective (RTO), not just a theoretical number.

Need Help Getting Started?

Setting up multi-cloud backups takes time and testing. If you'd rather have experts handle the configuration and monitoring, contact our team. We help small businesses implement reliable backup strategies without the complexity.

FAQ

How much does multi-cloud backup storage cost?

Storage costs vary by provider and region, but expect $0.02-0.03 per GB per month for standard storage. A 100GB backup across three providers costs about $6-9 monthly. Egress fees apply if you need to download large amounts of data, typically $0.05-0.12 per GB.

Should I use sync or copy for backups?

Use rclone copy for backups, not rclone sync. Copy only adds new or changed files. Sync makes the destination identical to the source, which means deleted files get removed from backups too. You want backups to accumulate over time, not mirror current state.

What's the difference between Rclone and Restic?

Rclone is a general-purpose cloud storage tool that can do backups, syncing, and file transfers. Restic is purpose-built for backups with features like automatic deduplication, snapshot management, and integrity verification. Restic is better for traditional backup workflows, while Rclone offers more flexibility for custom automation.