From f55bd49f8d2b2930fde249f346b28a54351d7b9c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Sat, 26 Sep 2026 01:10:13 +0200
Subject: [PATCH] docs(backup): name the bucket listing the restore drill needs

The drill section said the drill needs nothing beyond the uploader's
GetObject and ListBucket, but the documented uploader grant is PutObject,
GetObject and AbortMultipartUpload. The drill lists the bucket to find the
newest object, so ListBucket is an addition, not something already granted.
---
 docs/ops/backup-restore.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/docs/ops/backup-restore.md b/docs/ops/backup-restore.md
index 97d614d29..08fce5451 100644
--- a/docs/ops/backup-restore.md
+++ b/docs/ops/backup-restore.md
@@ -361,5 +361,7 @@ Outcomes:
 - **Not configured** — deployments without the `BACKUP_S3_*` vars skip
   silently (wide-event warning only).
 
-The drill needs no IAM grant beyond the uploader's existing
-`GetObject` + `ListBucket`.
+The drill lists the bucket to find the newest object, so it needs
+`ListBucket` on top of the uploader's `PutObject`, `GetObject` and
+`AbortMultipartUpload`. Cloudflare R2's **Object Read & Write** token covers
+all four.