From c2c046c7b1abded47b62fd4877d8c2e851d5901d Mon Sep 17 00:00:00 2001 From: omrzk <193513049+omrzk@users.noreply.github.com> Date: Thu, 5 Nov 2026 23:18:24 +0200 Subject: [PATCH] docs: keep S3 credentials out of Docker arguments (#22118) --- doc/030_preparing_a_new_repo.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/doc/030_preparing_a_new_repo.rst b/doc/030_preparing_a_new_repo.rst index 37edb00fe..0ba592051 100644 --- a/doc/030_preparing_a_new_repo.rst +++ b/doc/030_preparing_a_new_repo.rst @@ -249,6 +249,14 @@ while creating the bucket. $ export AWS_ACCESS_KEY_ID= $ export AWS_SECRET_ACCESS_KEY= +Restic can also read credentials from an AWS shared credentials file. Set +``AWS_SHARED_CREDENTIALS_FILE`` to its path, or use the default location at +``~/.aws/credentials``. When running restic in a container, mount the file +read-only and set ``AWS_SHARED_CREDENTIALS_FILE`` to the path inside the +container. Avoid passing secret values in ``docker run -e NAME=value`` +arguments, where they can be exposed in process listings. Docker's +``--env-file`` option also keeps the values out of command-line arguments. + When using temporary credentials make sure to include the session token via the environment variable ``AWS_SESSION_TOKEN``.