Preview before submit
Dry runs enumerate object counts and bytes so a delegated user can see the blast radius before a job runs.
Let people run the job. Never hand them the keys.
Data Convoy lets a team empower individual users to run one-off backups, archive a prefix, or kick off a restore — without ever issuing them a standing AWS credential.
Self-service jobs, zero credential sprawl
The usual way to let someone "just run a backup" is to hand them an access key or a role they can assume directly, and then track down that access later. Data Convoy replaces the handout with a job: a team member browses the tree picker, previews scope, and submits an archive or backup request through the app. The external worker that actually touches S3 assumes the customer's own IAM role via STS on demand — no user ever holds an AWS key, and no standing customer data credential lives in the app tier itself.
Worker tokens, not AWS keys
Workers authenticate to the control plane with a bearer token; only its SHA-256 hash is stored, and the plaintext is shown once at issue time.
The permission floor does the safety work
Delegation is bounded by the same four-role matrix used everywhere else in Data Convoy. A user role can preview and run non-destructive copies — archiving or backing up into cold storage — without being able to delete production data or issue a restore. Destructive and cost-bearing actions require manager or owner, so handing someone day-to-day archive duty never quietly hands them the ability to remove production objects.
Non-destructive by default
Archive-with-verify-and-remove, restores, and other destructive/cost-bearing actions sit above the user role in the permission matrix.
Revocation is immediate
Role changes take effect without a TTL delay, so removing someone from a team removes their delegated access right away.
What it looks like day to day
A researcher who needs to clear space browses their team's production prefix in the tree picker, previews the exclusion-adjusted object count and byte total, and submits a one-off archive job. The job lands in the shared queue; a worker running under the team's own AWS role claims it, copies and verifies the objects, and reports progress back to the job record. The researcher watches status update in the jobs view. At no point did they see, request, or hold an AWS access key — the only thing they authenticated with was their own Data Convoy session.
Your buckets. Your workers. Your control.