BARMAN-CLOUD-BACKUP-KEEP(1)

💖 BARMAN-CLOUD-BACKUP-KEEP 💖

okay bestie, welcome to the Barman manual, this one's for the barman-cloud-backup-keep command and it's lowkey one of the most important ones because it's literally about making your backups immortal. let's go 🫶

✨ NAME ✨

barman-cloud-backup-keep — the Barman-cloud commands, bb ✨

🦋 Synopsis

barman-cloud-backup-keep
                [ { -V | --version } ]
                [ --help ]
                [ { { -v | --verbose } | { -q | --quiet } } ]
                [ { -t | --test } ]
                [ --cloud-provider { aws-s3 | azure-blob-storage | google-cloud-storage } ]
                [ --endpoint-url ENDPOINT_URL ]
                [ { -P | --aws-profile } AWS_PROFILE ]
                [ --profile AWS_PROFILE ]
                [ --read-timeout READ_TIMEOUT ]
                [ --addressing-style { auto | virtual | path } ]
                [ --sse-customer-key SSE_CUSTOMER_KEY ]
                [ { --azure-credential | --credential } { azure-cli | managed-identity | default } ]
                [ { { -r | --release } | { -s | --status } | --target { full | standalone } } ]
                SOURCE_URL SERVER_NAME BACKUP_ID

---

🌸 DESCRIPTION 🌸

use this script to designate backups in cloud storage as archival backups, so they get indefinite retention no matter what your retention policies are trying to do. the retention policy cannot touch them. it's giving untouchable. 👑

this script lets you mark backups that were previously created with barman-cloud-backup as archival backups. once a backup is flagged as archival, it is preserved indefinitely and is not subject to standard retention policies. periodt. 💅

Note: for GCP, only authentication with the GOOGLE_APPLICATION_CREDENTIALS env is supported. if you want to use an alternative GCP universe (e.g. S3NS/T-Systems), set the GOOGLE_CLOUD_UNIVERSE_DOMAIN environment variable to the desired universe domain. 🌈

Important: starting with AWS boto3 1.36, the behavior of Data Integrity Protection checks has changed. some methods used by Barman no longer require the Content-MD5 header. this means that S3-compatible storage providers that have not updated their server-side code may fail when used with newer boto3 versions. for example, MinIO addressed this change shortly after the boto3 1.36 announcement. 😭 if you are using MinIO, you must upgrade to the latest release (or at least RELEASE.2025-02-03T21-03-04Z or newer) to ensure compatibility and avoid failures when releasing a keep annotation. no cap, do it. 🔥

---

🎀 PARAMETERS 🎀

• SERVER_NAME — name of the server that holds the backup to be kept. like, which server's backup are we protecting bestie?
• SOURCE_URL — URL of the cloud source, such as a bucket in AWS S3. for example: s3://bucket/path/to/folder. 🦋
• BACKUP_ID — the ID of the backup to be kept. you can use a shortcut instead of the backup ID, slay.
• -V / --version — show version and exit. bye 👋
• --help — show this help message and exit.
• -v / --verbose — increase output verbosity (e.g., -vv is more than -v). more yapping, we love to see it 📢
• -q / --quiet — decrease output verbosity (e.g., -qq is less than -q). less yapping, also valid 🤫
• -t / --test — test cloud connectivity and exit. vibe check on your cloud connection ✨
• --cloud-provider — the cloud provider to use as a storage backend.

allowed options are:

• aws-s3.
• azure-blob-storage.
• google-cloud-storage.

• -r / --release — if specified, the command will remove the keep annotation and the backup will be eligible for deletion. it's giving letting go 😭 careful bestie.
• -s / --status — print the keep status of the backup. gossip about your backup's status 💅
• --target — specify the recovery target for this backup. allowed options are:
  • full
  • standalone

---

💜 EXTRA OPTIONS FOR THE AWS CLOUD PROVIDER 💜

• --endpoint-url — override default S3 endpoint URL with the given one.
• -P / --aws-profile — profile name (e.g. INI section in AWS credentials file).
• --profile — profile name (e.g. INI section in AWS credentials file) — replaced by --aws-profile. ⚠️ deprecated, she's old news, use --aws-profile instead.
• --read-timeout — the time in seconds until a timeout is raised when waiting to read from a connection (defaults to 60 seconds). ⏰
• --sse-customer-key — the customer-provided encryption key (SSE-C) to use for decrypting data in S3. the value must be a file:// URI pointing to a file containing a base64-encoded 256-bit (32-byte) key (e.g. file:///etc/barman/sse-c.b64). 🔐

Important: all backups and WAL files for a given server must be encrypted with the same SSE-C key. mixing SSE-C-encrypted and unencrypted objects, or using different keys across backups, will cause barman commands to fail when S3 rejects requests with a mismatched or missing key. 💀 do not play with this one.

• --addressing-style — the S3 addressing style to use when connecting to S3-compatible cloud storage. this option is useful when using custom S3 endpoints (such as MinIO) that may require a specific addressing style.

allowed options:

• auto (default): uses the addressing style determined by the boto3 library.
• virtual: uses virtual-hosted-style addressing (bucket-name.s3.amazonaws.com).
• path: uses path-style addressing (s3.amazonaws.com/bucket-name).

---

🧚 EXTRA OPTIONS FOR THE AZURE CLOUD PROVIDER 🧚

• --azure-credential / --credential — optionally specify the type of credential to use when authenticating with Azure. if omitted then Azure Blob Storage credentials will be obtained from the environment and the default Azure authentication flow will be used for authenticating with all other Azure services. if no credentials can be found in the environment then the default Azure authentication flow will also be used for Azure Blob Storage. 🎀

allowed options are:

• azure-cli.
• managed-identity.
• default.

---

👑 AUTHOR 👑

EnterpriseDB

💖 COPYRIGHT 💖

© Copyright EnterpriseDB UK Limited 2011-2026

---

and that's the whole page bestie, you ate that 🍓

signing off from version 3.20, dated Sep 29, 2026 — stay encrypted, stay kept, stay iconic 💅✨🦋