During backup operations, Commvault discovers Google Cloud Bigtable resources, reads table data, and stores backup data in Cloud Storage. The following permissions are required to perform these operations successfully.
Important
In addition to the permissions listed on this page, the service account must have the Dataflow Worker IAM role (roles/dataflow.worker). This role is required for both backup and restore operations.
Google Cloud Storage Permissions
| Permission |
Usage |
storage.buckets.create |
Create Cloud Storage buckets for backup operations. |
storage.buckets.get |
View Cloud Storage bucket metadata. |
storage.buckets.list |
List Cloud Storage buckets. |
storage.buckets.update |
Update Cloud Storage bucket configuration. |
storage.objects.create |
Create backup objects in Cloud Storage. |
storage.objects.get |
Read backup objects from Cloud Storage. |
storage.objects.list |
List objects in Cloud Storage buckets. |
storage.objects.delete |
Delete backup objects from Cloud Storage. |
storage.multipartUploads.create |
Initiate multipart uploads for large backup objects. |
Cloud Bigtable Permissions
| Permission |
Usage |
bigtable.instances.ping |
Verify connectivity to Cloud Bigtable instances. |
bigtable.instances.get |
View Cloud Bigtable instance details. |
bigtable.instances.list |
List Cloud Bigtable instances. |
bigtable.instances.getIamPolicy |
View the IAM policy for Cloud Bigtable instances. |
bigtable.instances.executeQuery |
Execute queries against Cloud Bigtable instances. |
bigtable.clusters.get |
View Cloud Bigtable cluster details. |
bigtable.clusters.list |
List Cloud Bigtable clusters. |
bigtable.tables.get |
View Cloud Bigtable table metadata. |
bigtable.tables.list |
List Cloud Bigtable tables. |
bigtable.tables.readRows |
Read Cloud Bigtable table data. |
bigtable.tables.sampleRowKeys |
Retrieve sampled row keys. |
bigtable.tables.update |
Update Cloud Bigtable table configuration. |
bigtable.tables.getIamPolicy |
View the IAM policy for Cloud Bigtable tables. |
bigtable.tables.create |
Create temporary tables required during backup operations. |
bigtable.tables.delete |
Delete temporary tables created during backup operations. |
bigtable.appProfiles.get |
View application profile details. |
bigtable.appProfiles.list |
List application profiles. |
bigtable.tables.mutateRows |
Write backup data to Cloud Bigtable tables. |
Dataflow Permissions
| Permission |
Usage |
dataflow.jobs.create |
Create Dataflow jobs for backup operations. |
dataflow.jobs.get |
View Dataflow job status and details. |
dataflow.jobs.list |
List Dataflow jobs. |
dataflow.jobs.updateContents |
Update Dataflow job contents. |
dataflow.jobs.cancel |
Cancel Dataflow jobs. |
dataflow.shuffle.read |
Read Dataflow shuffle data. |
dataflow.shuffle.write |
Write Dataflow shuffle data. |
Cloud Monitoring Permissions
| Permission |
Usage |
monitoring.timeSeries.list |
View monitoring metrics used during backup operations. |
monitoring.timeseries.list |
List Cloud Monitoring time series. |
Cloud KMS Permissions
| Permission |
Usage |
cloudkms.cryptoKeys.get |
View Cloud KMS key metadata. |
IAM Permissions
| Permission |
Usage |
iam.serviceAccounts.actAs |
Allow the service account to impersonate another service account during backup operations. |
Compute Engine Permissions
| Permission |
Usage |
compute.regions.list |
List Compute Engine regions. |
Resource Manager permissions
| Permission |
Usage |
resourcemanager.projects.get |
View Google Cloud project information. |