BARMAN-CLOUD-BACKUP-DELETE(1)

NAME
barman-cloud-backup-delete - Barman-cloud Commands

Synopsis

    barman-cloud-backup-delete
                    [ { -V | --version } ]
                    [ --help ]
                    [ { { -v | --verbose } | { -q | --quiet } } ]
                    [ { -t | --test } ]
                    [ --cloud-provider { aws-s3 | azure-blob-storage | google-cloud-storage } ]
                    [ --endpoint-url ENDPOINT_URL ]
                    [ --addressing-style { auto | virtual | path } ]
                    [ { -r | --retention-policy } RETENTION_POLICY ]
                    [ { -m | --minimum-redundancy } MINIMUM_REDUNDANCY ]
                    [ { -b | --backup-id } BACKUP_ID]
                    [ --dry-run ]
                    [ --check-object-lock ]
                    [ { -P | --aws-profile } AWS_PROFILE ]
                    [ --profile AWS_PROFILE ]
                    [ --read-timeout READ_TIMEOUT ]
                    [ --sse-customer-key SSE_CUSTOMER_KEY ]
                    [ { --azure-credential | --credential } { azure-cli | managed-identity | default } ]
                    [--batch-size DELETE_BATCH_SIZE]
                    SOURCE_URL SERVER_NAME

Description

The barman-cloud-backup-delete script is used to delete one or more backups created with the barman-cloud-backup command from cloud storage and to remove the associated WAL files.

Backups can be specified for deletion either by their backup ID (as obtained from barman-cloud-backup-list) or by a retention policy. Retention policies mirror those used by the Barman server, deleting all backups that are not required to meet the specified policy. When a backup is deleted, any unused WAL files associated with that backup are also removed.

WALs are considered unused if:

•   The WALs predate the begin_wal value of the oldest remaining backup.

•   The WALs are not required by any archival backups stored in the cloud.

    Note: For GCP, only authentication with GOOGLE_APPLICATION_CREDENTIALS env is supported. To use an alternative GCP universe (e.g. S3NS/T-Systems), set the GOOGLE_CLOUD_UNIVERSE_DOMAIN environment variable to the desired universe domain.

    Important: Each backup deletion involves three separate requests to the cloud provider: one for the backup files, one for the backup.info file, and one for the associated WALs. Deleting by retention policy may result in a high volume of delete requests if a large number of backups are accumulated in cloud storage.

    Important: Starting with AWS boto3 1.36, the behavior of Data Integrity Protection checks has changed. Some methods used by Barman no longer require the Content-MD5 header.

    This means that S3-compatible storage providers that have not updated their server-side code may fail when used with newer boto3 versions. For example, MinIO addressed this change shortly after the boto3 1.36 announcement.

    If you are using MinIO, you must upgrade to the latest release (or at least RELEASE.2025-02-03T21-03-04Z or newer) to ensure compatibility and avoid failures.

    Parameters

SERVER_NAME
    Name of the server that holds the backup to be deleted.

SOURCE_URL
    URL of the cloud source, such as a bucket in AWS S3. For example: s3://bucket/path/to/folder.

-V / --version
    Show version and exit.

--help
    show this help message and exit.

-v / --verbose
    Increase output verbosity (e.g., -vv is more than -v).

-q / --quiet
    Decrease output verbosity (e.g., -qq is less than -q).

-t / --test
    Test cloud connectivity and exit.

--cloud-provider
    The cloud provider to use as a storage backend.

    Allowed options are:

•   aws-s3.

•   azure-blob-storage.

•   google-cloud-storage.

-b / --backup-id
    ID of the backup to be deleted. You can use a shortcut instead of the backup ID.

-m / --minimum-redundancy
    The minimum number of backups that should always be available.

-r / --retention-policy
    If specified, delete all backups eligible for deletion according to the supplied retention policy.

    Syntax: REDUNDANCY value | RECOVERY WINDOW OF value { DAYS | WEEKS | MONTHS }

--batch-size
    The maximum number of objects to be deleted in a single request to the cloud provider. If unset then the maximum allowed batch size for the specified cloud provider will be used (1000 for aws-s3, 256 for azure-blob-storage and 100 for google-cloud-storage).

--dry-run
    Find the objects which need to be deleted but do not delete them.

    Extra options for the AWS cloud provider

--check-object-lock
    Check whether backup files are protected by S3 Object Lock before attempting deletion. Enable this when your S3 bucket has Object Lock configured and you want to ensure deletion operations respect object-level retention policies. If any base backup file is locked (either by an active retention period or legal hold), the deletion is aborted with an error.

    For performance reasons, lock checks are only performed for base backup files, since once the base backup is removed, the corresponding WAL files are no longer useful. Note that this check requires one request per file to check the lock status, which may increase deletion time for backups with many files. This feature is only available for AWS S3-compatible object stores and it also requires the s3:GetObjectRetention and s3:GetObjectLegalHold IAM permissions.

--endpoint-url
    Override default S3 endpoint URL with the given one.

--addressing-style
    The addressing style to use for S3 requests. This is useful when connecting to S3-compatible services that require a specific addressing style.

    Allowed options are:

•   auto (default): Uses the addressing style determined by the underlying library.

•   virtual: Uses virtual-hosted style addressing (e.g., bucket-name.s3.amazonaws.com).

•   path: Uses path-style addressing (e.g., s3.amazonaws.com/bucket-name).

-P / --aws-profile
    Profile name (e.g. INI section in AWS credentials file).

--profile (deprecated)
    Profile name (e.g. INI section in AWS credentials file) - replaced by --aws-profile.

--read-timeout
    The time in seconds until a timeout is raised when waiting to read from a connection (defaults to 60 seconds).

--sse-customer-key
    The customer-provided encryption key (SSE-C) to use for decrypting data in S3. The value must be a file:// URI pointing to a file containing a base64-encoded 256-bit (32-byte) key (e.g. file:///etc/barman/sse-c.b64).

    Important: All backups and WAL files for a given server must be encrypted with the same SSE-C key. Mixing SSE-C-encrypted and unencrypted objects, or using different keys across backups, will cause barman commands to fail when S3 rejects requests with a mismatched or missing key.

    Extra options for the Azure cloud provider

--azure-credential / --credential
    Optionally specify the type of credential to use when authenticating with Azure. If omitted then Azure Blob Storage credentials will be obtained from the environment and the default Azure authentication flow will be used for authenticating with all other Azure services. If no credentials can be found in the environment then the default Azure authentication flow will also be used for Azure Blob Storage.

    Allowed options are:

•   azure-cli.

•   managed-identity.

•   default.

Author
EnterpriseDB

Copyright
© Copyright EnterpriseDB UK Limited 2011-2026