Title: Cloud storage bucket requirements
Author: WordPress VIP Documentation
Published: February 3, 2023
Last modified: March 12, 2026

---

 1. [Logs](https://docs.wpvip.com/logs/)
 2. [Log Shipping](https://docs.wpvip.com/logs/log-shipping/)
 3. Cloud storage bucket requirements

#  Cloud storage bucket requirements

Before enabling [Database Backup Shipping](https://docs.wpvip.com/database-backup-shipping/)
or [Log Shipping](https://docs.wpvip.com/enable-log-shipping/), a cloud storage 
bucket (e.g. [Amazon Web Services (AWS) S3 buckets](https://aws.amazon.com/s3/),
[Google Cloud Storage buckets](https://cloud.google.com/storage/docs/buckets#naming),
[Azure Blob Storage](https://azure.microsoft.com/en-us/products/storage/blobs)) 
must be created and correctly configured to receive the shipped files.

 * AWS S3
 * Google Cloud
 * Azure Blob

 * The name of the bucket must be globally unique. To ensure a unique bucket name,
   include the organization’s name, the application’s name, and the name of the 
   enabled feature. For example, an organization named “Acme, Inc.” would name their
   S3 bucket for Database Backup Shipping: `acme-inc-db-shipping`. Failure to create
   a globally unique name creates a risk for files to be shipped to a bucket other
   than the one intended.
 * The bucket name can only include lowercase letters (`a-z`), numbers (`0-9`) and
   hyphens (`-`).
 * File shipping will fail if the name of the bucket includes a period (`.`).

 * The name of the bucket must be globally unique. To ensure a unique bucket name,
   include the organization’s name, the application’s name, and the name of the 
   enabled feature. For example, an organization named “Acme, Inc.” would name their
   S3 bucket for Database Backup Shipping: `acme-inc-db-shipping`. Failure to create
   a globally unique name creates a risk for files to be shipped to a bucket other
   than the one intended.
 * The bucket name can only include lowercase letters (`a-z`), numbers (`0-9`) and
   hyphens (`-`).
 * File shipping will fail if the name of the bucket includes a period (`.`).

 * [Azure Storage Account names](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json#storage-account-name)
   must be globally unique, 3 to 24 characters long, and use only lowercase letters(`
   a-z`) and numbers (`0-9`).
 * The name of an Azure Blob Storage container does not need to be globally unique.
   The name must be 3 to 63 characters long, begin with a lowercase letter or number,
   and only include lowercase letters (`a-z`), numbers (`0-9`) and hyphens (`-`).
 * File shipping will fail if the name of the bucket includes a period (`.`).

## Encryption

Files are encrypted in-transit using TLS between VIP and the cloud storage bucket.
Additional options and requirements for encryption are dependent on the cloud storage
provider.

 * AWS S3
 * Google Cloud
 * Azure Blob
 * Azure Blob

 * For an AWS S3 bucket, [encryption can be configured](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html)
   to ensure that files are encrypted at-rest.
 * An AWS S3 bucket must not use KMS encryption; SSE-S3 is the preferred encryption
   option.

 * For a Google Cloud bucket, Cloud Storage [encrypts customer content at rest](https://cloud.google.com/docs/security/encryption/default-encryption)
   by default. Customers can optionally utilize [the default key option for customer-managed encryption keys](https://cloud.google.com/storage/docs/encryption/using-customer-managed-keys#set-default-key)(
   CMEKs).

 * Azure blob containers can be encrypted with [Microsoft-Managed Keys](https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption#platform-managed-keys),
   [Customer-Managed Keys (CMK)](https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption#customer-managed-keys),
   or [Infrastructure Encryption](https://learn.microsoft.com/en-us/azure/storage/common/infrastructure-encryption-enable?tabs=portal).

## Encryption

 * Azure blob containers can be encrypted with [Microsoft-Managed Keys](https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption#platform-managed-keys),
   [Customer-Managed Keys (CMK)](https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption#customer-managed-keys),
   or [Infrastructure Encryption](https://learn.microsoft.com/en-us/azure/storage/common/infrastructure-encryption-enable?tabs=portal).

Last updated: March 12, 2026