Automating PostgreSQL Backups to S3

Why Automate PostgreSQL Backups?

Manual backups are the leading cause of data loss during incidents. Teams think their backups work until they actually need to restore and discover the last successful backup was weeks ago.

Automated backups solve three critical problems:

• Consistency — backups run on schedule, every time, without human intervention
• Encryption — data is encrypted before it leaves your server
• Verification — every backup is tested by restoring it in an isolated environment

The Traditional Approach and Why It Fails

Most teams start with a cronjob running pg_dump:

0 2 * * * pg_dump mydb | gzip > /backups/mydb_$(date +%Y%m%d).gz

This approach has critical blind spots. There is no encryption, so backups are stored in plaintext. There is no upload, so backups stay on the same server as the database. There is no verification, so you have no idea if the backup can actually be restored. And there is no alerting, so if the cronjob fails silently, nobody knows.

A Better Approach with BackupAgent

BackupAgent handles the entire pipeline automatically:

jobs:
  - name: postgres-nightly
    engine: postgresql
    database: mydb
    schedule: "0 2 * * *"
    storage:
      provider: s3
      bucket: my-backups
      encryption: AES-256
    verify:
      enabled: true
      sandbox: docker

What happens at 2:00 AM every night:

1. pg_dump exports your database in custom format
2. zstd compresses the dump (typically 60-70% size reduction)
3. AES-256-GCM encrypts the compressed file
4. The encrypted file uploads to your S3 bucket
5. An ephemeral Docker container spins up with fresh PostgreSQL
6. The backup is decrypted, decompressed, and restored
7. Integrity checks run: row counts, schema validation, custom queries
8. The container is destroyed and a Slack summary is sent

Setting Up in 5 Minutes

Step 1: Install the agent

curl -fsSL get.backupagent.ai | sh

Step 2: Register with your dashboard

backupagent register --token YOUR_TOKEN

Step 3: Start the service

sudo systemctl enable --now backupagent

The agent automatically detects PostgreSQL on your server, generates the YAML config, and starts running scheduled backups with verification.

Key Takeaway

If you cannot prove your backup restores successfully, you do not have a backup. You have a file. Automated verification is the difference between confidence and hope.