During restore operations, Commvault recreates or updates Google Cloud Bigtable resources and writes data back to Google Cloud Bigtable from backup data stored in Cloud Storage. The following permissions are required to perform these operations successfully.
Important
In addition to the permissions listed on this page, the service account must have the Dataflow Worker IAM role (roles/dataflow.worker). This role is required for both backup and restore operations.
Google Cloud Storage Permissions
| Permission | Usage |
|---|---|
storage.buckets.create |
Create Cloud Storage buckets for restore operations. |
storage.buckets.get |
View Cloud Storage bucket metadata. |
storage.buckets.list |
List Cloud Storage buckets. |
storage.buckets.update |
Update Cloud Storage bucket configuration. |
storage.objects.create |
Create Cloud Storage objects during restore operations. |
storage.objects.get |
Read backup objects from Cloud Storage. |
storage.objects.list |
List objects in Cloud Storage buckets. |
storage.objects.delete |
Delete temporary Cloud Storage objects. |
storage.objects.update |
Update Cloud Storage objects during restore operations. |
storage.multipartUploads.create |
Initiate multipart uploads for large restore objects. |
Cloud Bigtable Permissions
| Permission | Usage |
|---|---|
bigtable.instances.ping |
Verify connectivity to Cloud Bigtable instances. |
bigtable.instances.get |
View Cloud Bigtable instance details. |
bigtable.instances.list |
List Cloud Bigtable instances. |
bigtable.instances.create |
Create Cloud Bigtable instances. |
bigtable.instances.update |
Update Cloud Bigtable instance configuration. |
bigtable.instances.getIamPolicy |
View the IAM policy for Cloud Bigtable instances. |
bigtable.instances.setIamPolicy |
Set the IAM policy for Cloud Bigtable instances. |
bigtable.instances.executeQuery |
Execute queries against Cloud Bigtable instances. |
bigtable.clusters.create |
Create Cloud Bigtable clusters. |
bigtable.clusters.get |
View Cloud Bigtable cluster details. |
bigtable.clusters.list |
List Cloud Bigtable clusters. |
bigtable.tables.create |
Create Cloud Bigtable tables. |
bigtable.tables.delete |
Delete Cloud Bigtable tables. |
bigtable.tables.get |
View Cloud Bigtable table metadata. |
bigtable.tables.list |
List Cloud Bigtable tables. |
bigtable.tables.mutateRows |
Write restored data to Cloud Bigtable tables. |
bigtable.tables.readRows |
Read Cloud Bigtable table data. |
bigtable.tables.update |
Update Cloud Bigtable table configuration. |
bigtable.tables.getIamPolicy |
View the IAM policy for Cloud Bigtable tables. |
bigtable.tables.setIamPolicy |
Set the IAM policy for Cloud Bigtable tables. |
bigtable.appProfiles.create |
Create application profiles. |
bigtable.appProfiles.get |
View application profile details. |
bigtable.appProfiles.list |
List application profiles. |
bigtable.appProfiles.update |
Update application profiles. |
bigtable.appProfiles.delete |
Delete application profiles. |
Dataflow Permissions
| Permission | Usage |
|---|---|
dataflow.jobs.create |
Create Dataflow jobs for restore operations. |
dataflow.jobs.get |
View Dataflow job status and details. |
dataflow.shuffle.read |
Read Dataflow shuffle data. |
dataflow.shuffle.write |
Write Dataflow shuffle data. |
Cloud Monitoring Permissions
| Permission | Usage |
|---|---|
monitoring.timeseries.list |
List Cloud Monitoring time series. |
Cloud KMS Permissions
| Permission | Usage |
|---|---|
cloudkms.cryptoKeys.get |
View Cloud KMS key metadata. |
IAM Permissions
| Permission | Usage |
|---|---|
iam.serviceAccounts.actAs |
Allow the service account to impersonate another service account during restore operations. |
Compute Engine Permissions
| Permission | Usage |
|---|---|
compute.regions.list |
List Compute Engine regions. |
Resource Manager Permissions
| Permission | Usage |
|---|---|
resourcemanager.projects.get |
View Google Cloud project information. |