Permissions required to deploy the Clumio service on GCP

To protect Google Cloud Storage (GCS) data, Clumio requires that certain resources are present in your GCP project. You deploy those resources with Clumio's Terraform template, either by running it locally or through Google Cloud Infrastructure Manager. For the deployment procedure, see Connecting a GCP project using Terraform.

The Clumio Terraform template follows the "least privileges" model, in line with standard Google Cloud Identity and Access Management (IAM) security guidelines.

Before you connect your GCP project, verify the permission requirements below to ensure the connection process runs smoothly.

Which identity needs these permissions

These permissions apply to the deploying identity — the user account or service account that runs terraform apply. They are the permissions needed to create the Clumio resources.

If you deploy through Google Cloud Infrastructure Manager, Terraform runs as the service account you choose for the deployment, so grant these permissions to that service account. It also needs the Infra Manager Agent role (roles/config.agent), and the user who creates the deployment needs the Service Account User role (roles/iam.serviceAccountUser) on it. For details, see "Configure the service account" in the Google Cloud documentation.

They are not the permissions Clumio uses to protect your data. Those are granted by the template to a separate service account in your project, through Clumio custom roles scoped to GCS inventory, backup, and restore.

Note the following:

All permissions are granted at the project level, on the project you are connecting. Clumio does not require organization-level or folder-level permissions.
The roles/owner predefined role is not required.
The same permissions are used to update and to remove the deployment, so the deploying identity should keep them for as long as the connection exists.
IAM changes can take a minute to take effect. If terraform apply fails with a permission error right after you grant the permissions, wait a minute and re-run it.

Base permissions

Grant the following permissions for every GCP connection, regardless of which Clumio capabilities you enable.

Permission	Purpose
`resourcemanager.projects.get`	Read the project name and number reported back to Clumio.
`serviceusage.services.use`	Allow the Google Terraform provider to bill API calls to the connected project.
`iam.serviceAccounts.create`	Create the service account that Clumio impersonates. Not needed if you supply an existing service account through `customer_service_account_email`.
`iam.serviceAccounts.get`	Read the service account, including one you supply through `customer_service_account_email`.
`iam.serviceAccounts.update`	Update the service account on later applies.
`iam.serviceAccounts.delete`	Remove the service account when the connection is removed.
`iam.serviceAccounts.getIamPolicy`	Read the service account's IAM policy before granting impersonation. Not needed if you set `manage_service_account_impersonation = false`.
`iam.serviceAccounts.setIamPolicy`	Grant the Clumio service account `roles/iam.serviceAccountTokenCreator` and `roles/iam.serviceAccountUser` on it. Not needed if you set `manage_service_account_impersonation = false`.

Additional permissions for Google Cloud Storage

Grant the following permissions in addition to the base permissions when is_gcs_enabled is set to true, which is required for Clumio Protect for GCS.

Enable Google APIs

Permission	Purpose
`serviceusage.services.enable`	Enable the Cloud Storage, Storage Transfer, Pub/Sub, Cloud Asset Inventory, Storage Insights, and Cloud Monitoring APIs, and materialize their service agents.
`serviceusage.services.get`	Read the current state of those APIs.
`serviceusage.services.list`	List enabled APIs.
`serviceusage.operations.get`	Poll the long-running operation each enablement returns.

Manage project IAM

Permission	Purpose
`resourcemanager.projects.getIamPolicy`	Read the project IAM policy before modifying it.
`resourcemanager.projects.setIamPolicy`	Bind the Clumio custom roles to the service account, and bind the Google service agents that move inventory data.

Setting the project IAM policy is unavoidable project-IAM-administrator power. The template binds three Google service agents at the project level whenever is_gcs_enabled is true, so setting manage_gcs_iam = false does not remove this requirement. That setting only makes the template skip the Clumio custom roles and their bindings, which you then provision with your own tooling. In that case, the iam.roles.* permissions below are not needed.

Manage Clumio custom roles

Permission	Purpose
`iam.roles.create`	Create the Clumio GCS inventory, backup, and restore custom roles.
`iam.roles.get`	Read those roles.
`iam.roles.update`	Update them when the template is upgraded.
`iam.roles.delete`	Remove them when the connection is removed.
`iam.roles.undelete`	Restore a role id when a project is re-onboarded within GCP's soft-delete window for custom roles.

Manage the inventory bridge bucket

Permission	Purpose
`storage.buckets.create`	Create the per-region inventory bridge bucket. Not needed if you supply an existing bucket for every region through `using_custom_inventory_bridge_bucket`.
`storage.buckets.get`	Read the bucket.
`storage.buckets.update`	Update the bucket configuration.
`storage.buckets.delete`	Remove the bucket when the connection is removed.
`storage.buckets.getIamPolicy`	Read the bucket IAM policy before modifying it.
`storage.buckets.setIamPolicy`	Grant the Storage Insights and Storage Transfer service agents access to the bucket.
`storagetransfer.projects.getServiceAccount`	Look up the Storage Transfer service agent so the template can grant it access.

Manage the change-notification topic

Permission	Purpose
`pubsub.topics.create`	Create the Pub/Sub topic that carries GCS change notifications.
`pubsub.topics.get`	Read the topic.
`pubsub.topics.update`	Update the topic.
`pubsub.topics.delete`	Remove the topic when the connection is removed.
`pubsub.topics.getIamPolicy`	Read the topic IAM policy before modifying it.
`pubsub.topics.setIamPolicy`	Allow Cloud Asset Inventory to publish to the topic and Clumio to subscribe to it.

Manage the Cloud Asset Inventory feed

Permission	Purpose
`cloudasset.feeds.create`	Create the project feed that publishes bucket changes to the topic.
`cloudasset.feeds.get`	Read the feed.
`cloudasset.feeds.update`	Update the feed.
`cloudasset.feeds.delete`	Remove the feed when the connection is removed.
`cloudasset.assets.exportResource`	Required alongside `cloudasset.feeds.create` because the feed uses the `RESOURCE` content type.

Additional permissions for customer-managed encryption keys

Grant the following permissions on each Cloud KMS key only if you set inventory_bridge_kms_key_name or delta_topic_kms_key_name, which encrypt the inventory bridge bucket and the change-notification topic with your own keys. Organizations subject to the constraints/gcp.restrictNonCmekServices organization policy need these.

Permission	Purpose
`cloudkms.cryptoKeys.getIamPolicy`	Read the key's IAM policy before modifying it.
`cloudkms.cryptoKeys.setIamPolicy`	Grant `roles/cloudkms.cryptoKeyEncrypterDecrypter` on the key to the Cloud Storage, Storage Insights, Storage Transfer, and Pub/Sub service agents.

The predefined role roles/cloudkms.admin also grants both. Grant them on the key itself, which may live in a different project from the one you are connecting.

Create and grant a custom role

Save the following as clumio-deployer-role.yaml. Remove the # GCS block if you are connecting a project without Clumio Protect for GCS.

title: Clumio Onboarding Deployer
description: Least-privilege permissions to run the Clumio GCP onboarding module.
stage: GA
includedPermissions:
  # Base
  - resourcemanager.projects.get
  - serviceusage.services.use
  - iam.serviceAccounts.create
  - iam.serviceAccounts.get
  - iam.serviceAccounts.update
  - iam.serviceAccounts.delete
  - iam.serviceAccounts.getIamPolicy
  - iam.serviceAccounts.setIamPolicy
  # GCS
  - serviceusage.services.enable
  - serviceusage.services.get
  - serviceusage.services.list
  - serviceusage.operations.get
  - resourcemanager.projects.getIamPolicy
  - resourcemanager.projects.setIamPolicy
  - iam.roles.create
  - iam.roles.get
  - iam.roles.update
  - iam.roles.delete
  - iam.roles.undelete
  - storage.buckets.create
  - storage.buckets.get
  - storage.buckets.update
  - storage.buckets.delete
  - storage.buckets.getIamPolicy
  - storage.buckets.setIamPolicy
  - storagetransfer.projects.getServiceAccount
  - pubsub.topics.create
  - pubsub.topics.get
  - pubsub.topics.update
  - pubsub.topics.delete
  - pubsub.topics.getIamPolicy
  - pubsub.topics.setIamPolicy
  - cloudasset.feeds.create
  - cloudasset.feeds.get
  - cloudasset.feeds.update
  - cloudasset.feeds.delete
  - cloudasset.assets.exportResource

Create the role in the project you are connecting, as follows:

gcloud iam roles create ClumioOnboardingDeployer \
    --project=PROJECT_ID \
    --file=clumio-deployer-role.yaml

Grant the role to the identity that runs Terraform, as follows:

gcloud projects add-iam-policy-binding PROJECT_ID \
    --member="user:DEPLOYER_EMAIL" \
    --role="projects/PROJECT_ID/roles/ClumioOnboardingDeployer"

Replace PROJECT_ID with the project you are connecting, and user:DEPLOYER_EMAIL with the deploying identity. For a service account, use serviceAccount:NAME@PROJECT_ID.iam.gserviceaccount.com.

If you use customer-managed encryption keys, also grant the key permissions on each key, as follows:

gcloud kms keys add-iam-policy-binding KEY_NAME \
    --keyring=KEY_RING --location=KEY_LOCATION --project=KEY_PROJECT_ID \
    --member="user:DEPLOYER_EMAIL" \
    --role="roles/cloudkms.admin"

Predefined roles

If your organization prefers predefined roles to a custom role, the following set covers the permissions above. Predefined roles are broader than the custom role, so grant them only if a custom role is not an option.

Role	Purpose
`roles/serviceusage.serviceUsageAdmin`	Enable the required Google APIs.
`roles/iam.serviceAccountAdmin`	Create the service account and manage its IAM policy.
`roles/iam.roleAdmin`	Create the Clumio custom roles.
`roles/resourcemanager.projectIamAdmin`	Bind the custom roles and the Google service agents at the project level.
`roles/storage.admin`	Manage the inventory bridge bucket and its IAM bindings.
`roles/storagetransfer.viewer`	Look up the Storage Transfer service agent so the template can grant it access.
`roles/pubsub.admin`	Create the change-notification topic and set its IAM policy.
`roles/cloudasset.owner`	Create the Cloud Asset Inventory project feed.
`roles/cloudkms.admin`	Required only when you use customer-managed encryption keys. Grant on the key.