# How do we add an AWS IRSA annotation to the backups to grant S3 access

**URL:** https://forums.percona.com/t/how-do-we-add-an-aws-irsa-annotation-to-the-backups-to-grant-s3-access/10776
**Category:** Percona Operator for MySQL
**Created:** [June 8, 2021, 4:48am UTC](https://forums.percona.com/t/how-do-we-add-an-aws-irsa-annotation-to-the-backups-to-grant-s3-access/10776 "2021-06-08T04:48:33Z")
**Posts on this page:** 1
**Showing post:** 9

<div class="post-metadata">

### Author: ![Gerwin\_van\_de\_Steeg](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/gerwin_van_de_steeg/32/3715_2.png) [@Gerwin\_van\_de\_Steeg](https://forums.percona.com/u/Gerwin_van_de_Steeg)
#### Post date: [October 6, 2024, 8:37pm UTC](https://forums.percona.com/t/how-do-we-add-an-aws-irsa-annotation-to-the-backups-to-grant-s3-access/10776/9 "2024-10-06T20:37:09Z")

</div>

I’m revisiting the Percona material here and those tickets seem to be completed, how far has this gone to make it workable? It’s been 2 years, and my current exploration seems to indicate this still doesn’t actually work.

```auto
$ kubectl get pod/xb-cron-mysql-pxc-db-sql-20241060610-3ldds-qwshg -o yaml
apiVersion: v1
kind: Pod
metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::1234567678:role/some-irsa-sql-s3-backup-rolename
  creationTimestamp: "2024-10-06T00:12:58Z"
...
status:
  conditions:
  - lastProbeTime: null
    lastTransitionTime: "2024-10-06T00:12:59Z"
    status: "True"
    type: Initialized
  - lastProbeTime: null
    lastTransitionTime: "2024-10-06T00:13:18Z"
    reason: PodFailed
    status: "False"
    type: Ready
...
  phase: Failed

```

Relevant configuration

```auto
    backup:
      enabled: true
      # image:
      # tag: 1.15.0-pxc8.0-backup-pxb8.0.35-debug
      serviceAccountName: sql-db-backup-serviceaccount
      pitr:
        enabled: true
        storageName: binlogs
        # time in seconds between uploads
        timeBetweenUploads: 300
      storages:
        # the normal backups
        sql:
          type: s3
          annotations:
            eks.amazonaws.com/role-arn: arn:aws:iam::1234567678:role/some-irsa-sql-s3-backup-rolename
          s3:
            bucket: example-bucket-database-backups/sql/db1/
            ## with secret specified it does not work
            # credentialsSecret: example-sql-backup-aws-credentials
            # credentialsAccessKey: ""
            # credentialsSecretKey: ""
            region: us-west-2
        # the pitr binlogs for quick restore/replay
        binlogs:
          type: s3
          annotations:
            eks.amazonaws.com/role-arn: arn:aws:iam::1234567678:role/some-irsa-sql-s3-backup-rolename
          s3:
            bucket: example-bucket-database-backups/sql/pitr/
            ## with secret specified it does not work
            # credentialsSecret: example-sql-backup-aws-credentials
            # credentialsAccessKey: ""
            # credentialsSecretKey: ""
            region: us-west-2

```

---

_[View the full topic](https://forums.percona.com/t/how-do-we-add-an-aws-irsa-annotation-to-the-backups-to-grant-s3-access/10776)._