Configure the permissions required for the service accounts that Commvault uses to protect Google Cloud resources.
When you use service account impersonation, configure separate service accounts for the Access Node, discovery, backup, restore, and storage operations. The Access Node service account impersonates the applicable target service account for an operation.
Permissions for service account impersonation
Configure the permissions in this section only when you use service account impersonation.
Service account impersonation separates authentication from the permissions required to perform discovery, backup, restore, and storage operations.
| Service account | Purpose | Permission scope |
|---|---|---|
| Access Node service account | Authenticates the Access Node and impersonates target service accounts. | Target service accounts that the Access Node is permitted to impersonate. |
| Discovery service account | Performs discovery operations. | Resources required for discovery operations in the workload project. |
| Backup service account | Performs backup operations. | Resources required for backup operations in the workload project. |
| Restore service account | Performs restore operations. | Resources required for restore operations in the workload project. |
| Storage service account | Performs storage operations. | Storage resources required for data protection operations. |
Access Node service account
Grant the Access Node service account the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on each backup, restore, and storage service account that it must impersonate.
This role lets the Access Node service account generate short-lived access tokens for the target service accounts.
Don't grant discovery, backup, restore, or storage workload permissions directly to the Access Node service account when the operation uses service account impersonation. Grant the required permissions to the target service account that performs the operation.
Target service account bindings
Configure the impersonation binding on each target service account that the Access Node must impersonate.
For example, if an Access Node performs backup and restore operations for a project, grant its service account the Service Account Token Creator role on the backup and restore service accounts for that project.
Limit the binding to the target service accounts that the Access Node requires.
Discovery service account
Grant the discovery service account the permissions required to discover resources in its workload project.
Use the discovery permissions in the Permissions for data protection operations section when you configure this service account.
Backup service account
Grant the backup service account the permissions required for backup operations in its target project.
Use the backup permissions in the Permissions for data protection operations section when you configure this service account.
Restore service account
Grant the restore service account the permissions required for restore operations in its target project.
Use the restore permissions in the Permissions for data protection operations section when you configure this service account.
Storage service account
Grant the storage service account the permissions required to access the storage resources used for data protection operations.
Cross-project permissions
When an operation accesses a resource in a project other than the project associated with the target service account, grant the applicable target service account access to the required resource in the other project.
For operations that require access to a snapshot in another project, the required permissions can include:
-
compute.snapshots.get -
compute.snapshots.useReadOnly
Grant these permissions to the backup or restore service account that performs the operation.
For resources that use customer-managed encryption keys (CMEKs), grant the applicable target service account the permissions required to use the key.
You can modify the roles to meet your organization's security and compliance requirements.
Reference
Predefined IAM roles
To simplify configuration, Commvault provides predefined Google Cloud IAM role definitions for common operations.
Use the following YAML files to create custom IAM roles in Google Cloud:
These role definitions include the permissions that are required for the corresponding workflows described on this page.
You can modify the roles to meet your organization's security and compliance requirements.
Permissions for data protection operations
The following tables list the permissions required for supported data protection operations. When you use service account impersonation, grant each permission to the target service account that performs the corresponding operation.
General
The following sections list the individual permissions that are included in the predefined IAM role file.
|
Permission |
Backups |
Restores |
VM conversions |
Replication |
|---|---|---|---|---|
|
compute.addresses.get |
-- |
Yes |
Yes |
Yes |
|
compute.addresses.list |
-- |
Yes |
Yes |
-- |
|
compute.addresses.use |
-- |
Yes |
Yes |
-- |
|
compute.addresses.useInternal |
-- |
Yes |
Yes |
Yes |
|
compute.disks.create |
Yes |
Yes |
Yes |
Yes |
|
compute.disks.createSnapshot |
Yes |
Yes |
Yes |
Yes |
|
compute.disks.delete |
Yes |
Yes |
Yes |
Yes |
|
compute.disks.get |
Yes |
Yes |
Yes |
Yes |
|
compute.disks.list |
Yes |
-- |
-- |
-- |
|
compute.disks.resize |
-- |
Yes |
Yes |
Yes |
|
compute.disks.setLabels |
Yes |
Yes |
Yes |
Yes |
|
compute.disks.use |
Yes |
Yes |
Yes |
Yes |
|
compute.diskTypes.get |
Yes |
-- |
-- |
-- |
|
compute.images.list |
No |
Yes |
-- |
No |
|
compute.instances.attachDisk |
Yes |
Yes |
Yes |
Yes |
|
compute.instances.create |
-- |
Yes |
Yes |
Yes |
|
compute.instances.delete |
-- |
Yes |
Yes |
Yes |
|
compute.instances.detachDisk |
Yes |
Yes |
Yes |
Yes |
|
compute.instances.get |
Yes |
-- |
-- |
-- |
|
compute.instances.getSerialPortOutput |
-- |
-- |
Yes |
-- |
|
compute.instances.list |
Yes |
-- |
-- |
-- |
|
compute.instances.setDeletionProtection |
No |
Yes |
-- |
Yes |
|
compute.instances.setLabels |
-- |
Yes |
Yes |
Yes |
|
compute.instances.setMetadata |
-- |
Yes |
Yes |
Yes |
|
compute.instances.setServiceAccount |
-- |
Yes |
Yes |
Yes |
|
compute.instances.setTags |
-- |
Yes |
Yes |
Yes |
|
compute.instances.start |
-- |
Yes |
Yes |
Yes |
|
compute.instances.stop |
-- |
Yes |
Yes |
Yes |
|
compute.instances.updateDisplayDevice |
-- |
Yes |
Yes |
Yes |
|
compute.globalOperations.get |
Yes |
Yes |
Yes |
Yes |
|
compute.machineTypes.get |
Yes |
Yes |
Yes |
Yes |
|
compute.machineTypes.list |
-- |
Yes |
Yes |
Yes |
|
compute.networks.get |
-- |
Yes |
Yes |
Yes |
|
compute.networks.list |
-- |
Yes |
Yes |
Yes |
|
compute.projects.get |
Yes |
Yes |
Yes |
Yes |
|
compute.regionoperations.get |
Yes |
Yes |
Yes |
Yes |
|
compute.regions.get |
Yes |
Yes |
Yes |
Yes |
|
compute.regions.list |
Yes |
Yes |
Yes |
Yes |
|
compute.snapshots.create |
Yes |
Yes |
Yes |
Yes |
|
compute.snapshots.delete |
Yes |
Yes |
Yes |
Yes |
|
compute.snapshots.get |
Yes |
Yes |
Yes |
Yes |
|
compute.snapshots.setLabels |
Yes |
Yes |
Yes |
Yes |
|
compute.snapshots.useReadOnly |
Yes |
Yes |
Yes |
Yes |
|
compute.subnetworks.get |
Yes |
Yes |
Yes |
Yes |
|
compute.subnetworks.list |
-- |
Yes |
Yes |
Yes |
|
compute.subnetworks.use |
-- |
Yes |
Yes |
Yes |
|
compute.subnetworks.useExternalIp |
-- |
Yes |
Yes |
Yes |
|
compute.zoneOperations.get |
Yes |
Yes |
Yes |
Yes |
|
compute.zones.get |
Yes |
Yes |
Yes |
Yes |
|
compute.zones.list |
Yes |
Yes |
Yes |
Yes |
|
iam.serviceAccounts.actAs |
Yes |
Yes |
Yes |
Yes |
|
iam.serviceAccounts.get |
Yes |
Yes |
Yes |
Yes |
|
iam.serviceAccounts.list |
Yes |
Yes |
Yes |
Yes |
Note
While replicating instances to a GC destination using the RTO option Hot site replication, the software uses a JSON config file to create the instance. The software saves the JSON config file in a storage bucket during the replication operation, and then after the instance is created, deletes the JSON config file. Configure the relevant permissions for the GC Service Account in the destination project to create a storage bucket, otherwise replication will fail.
|
Permission |
Backups |
Restores |
VM conversions |
Replication |
|---|---|---|---|---|
|
storage.buckets.create |
-- |
-- |
-- |
Yes |
|
storage.buckets.delete |
-- |
-- |
-- |
Yes |
|
storage.buckets.get |
-- |
-- |
-- |
Yes |
|
storage.buckets.update |
-- |
-- |
-- |
Yes |
|
storage.multipartUploads.create |
Yes |
Yes |
-- |
Yes |
|
storage.objects.create |
-- |
-- |
-- |
Yes |
|
storage.objects.delete |
-- |
-- |
-- |
Yes |
|
storage.objects.get |
-- |
-- |
-- |
Yes |
|
storage.objects.list |
-- |
-- |
-- |
Yes |
|
storage.objects.update |
-- |
-- |
-- |
Yes |
Encryption
|
Permission |
Backups |
Restores |
VM conversions |
Replication |
|---|---|---|---|---|
|
cloudkms.cryptoKeyEncrypterDecrypter |
Yes |
Yes |
Yes |
Yes |
|
cloudkms.cryptoKeyVersions.useToDecrypt |
Yes |
Yes |
Yes |
Yes |
|
cloudkms.cryptoKeyVersions.useToEncrypt |
Yes |
Yes |
Yes |
Yes |
|
cloudkms.cryptoKeyVersions.useToEncryptViaDelegation |
Yes |
Yes |
Yes |
Yes |
|
cloudkms.cryptoKeys.create |
Yes |
Yes |
Yes |
Yes |
|
cloudkms.cryptoKeys.get |
Yes |
Yes |
Yes |
Yes |
|
cloudkms.cryptoKeys.update |
Yes |
Yes |
Yes |
Yes |
|
cloudkms.cryptoKeys.list |
Yes |
Yes |
Yes |
No |
|
cloudkms.keyRings.create |
Yes |
Yes |
Yes |
Yes |
|
cloudkms.keyRings.get |
Yes |
Yes |
Yes |
Yes |
Node affinity
|
Permission |
Backups |
Restores |
VM conversions |
Replication |
|---|---|---|---|---|
|
compute.nodeGroups.get |
-- |
Yes |
Yes |
-- |
|
compute.nodeGroups.list |
-- |
Yes |
Yes |
-- |
Shared VPC
|
Permission |
Backups |
Restores |
VM conversions |
Replication |
|---|---|---|---|---|
|
compute.subnetworks.use |
-- |
Yes |
Yes |
Yes |
DVDF
While replicating instances to a Google Cloud destination using the Deploy virtual machine only during failover option, Commvault uses a JSON configuration file to create the instance. Commvault saves the JSON configuration file in a storage bucket during the replication operation and deletes the file after the instance is created.
Configure the required permissions for the Google Cloud service account in the destination project to create and manage the storage bucket. Without the required permissions, replication fails.
| Permission | Backups | Restores | VM conversions | Replication |
|---|---|---|---|---|
storage.buckets.create |
-- | -- | -- | Yes |
storage.buckets.delete |
-- | -- | -- | Yes |
storage.buckets.get |
-- | -- | -- | Yes |
storage.buckets.update |
-- | -- | -- | Yes |
storage.multipartUploads.create |
Yes | Yes | -- | Yes |
storage.objects.create |
-- | -- | -- | Yes |
storage.objects.delete |
-- | -- | -- | Yes |
storage.objects.get |
-- | -- | -- | Yes |
storage.objects.list |
-- | -- | -- | Yes |
storage.objects.update |
-- | -- | -- | Yes |
Power Management for MediaAgents
|
Permission |
Backups |
Restores |
VM conversions |
Replication |
|---|---|---|---|---|
|
compute.instances.list |
Yes |
Yes |
Yes |
Yes |
|
compute.instances.start |
Yes |
Yes |
Yes |
Yes |
|
compute.instances.stop |
Yes |
Yes |
Yes |
Yes |
|
compute.machineTypes.get |
Yes |
Yes |
Yes |
Yes |
|
compute.zone.list |
Yes |
Yes |
Yes |
Yes |