# Permissions Used for Google Cloud Storage Protection

To protect Google Cloud Storage resources, Commvault requires a Google Cloud service account with the appropriate Identity and Access Management (IAM) permissions. The required permissions vary depending on whether the service account is used for backup operations or restore operations.

Google Cloud IAM permissions determine the actions that Commvault can perform on Google Cloud Storage resources. Depending on the operation, different permissions are required for backup and restore workflows.

For information about creating and assigning custom IAM roles in Google Cloud, see the Google Cloud IAM documentation.

## Configure IAM Permissions for Google Cloud Storage Protection

### Before You Begin

- Open Google Cloud Shell in the Google Cloud console.

- Sign in to your Google Cloud account, if prompted.

- Download the following custom role definition files:

  - Commvault_GoogleCloud_GCSBackupRole.yaml

  - Commvault_GoogleCloud_GCSRestoreRole.yaml

### Create a Service Account and Custom IAM Roles

1. Set the active Google Cloud project.

       gcloud config set project PROJECT_ID

2. Enable required services on the current project.

       gcloud services enable storage.googleapis.com
       gcloud services enable bigtable.googleapis.com
       gcloud services enable bigquery.googleapis.com
       gcloud services enable pubsub.googleapis.com
       gcloud services enable cloudresourcemanager.googleapis.com
       gcloud services enable iam.googleapis.com
       gcloud services enable serviceusage.googleapis.com
       gcloud services enable monitoring.googleapis.com
       gcloud services enable storageinsights.googleapis.com
       gcloud services enable cloudkms.googleapis.com
       gcloud services enable kmsinventory.googleapis.com

3. Create a service account.

       gcloud iam service-accounts create SERVICE_ACCOUNT_ID

4. Create custom roles with the required permissions for different Commvault operations at project level.

       gsutil cp gs://cvltexternalartifacts/terraform-templates/11.0/46/CU20/IAMPermissions/*.yaml .

       gcloud iam roles create Commvault_GoogleCloud_GCSBackupRole --project=PROJECT_ID \
       --file=Commvault_GoogleCloud_GCSBackupRole.yaml

       gcloud iam roles create Commvault_GoogleCloud_GCSRestoreRole --project=PROJECT_ID \
       --file=Commvault_GoogleCloud_GCSRestoreRole.yaml

5. Grant your service account an IAM role on your project.

       gcloud projects add-iam-policy-binding PROJECT_ID --verbosity=debug \
         --member="serviceAccount:SERVICE_ACCOUNT_EMAIL_ADDRESS" \
         --role=projects/PROJECT_ID/roles/Commvault_GoogleCloud_GCSBackupRole

       gcloud projects add-iam-policy-binding PROJECT_ID --verbosity=debug \
         --member="serviceAccount:SERVICE_ACCOUNT_EMAIL_ADDRESS" \
         --role=projects/PROJECT_ID/roles/Commvault_GoogleCloud_GCSRestoreRole

6. Generate a private key file for the service account and download the JSON file.

       gcloud iam service-accounts keys create KEY_FILE_NAME.json \
         --iam-account=SERVICE_ACCOUNT_EMAIL_ADDRESS

       cloudshell download KEY_FILE_NAME.json

7. Associate the service account with multiple projects (replace `PROJECT_ID` with the actual project name).

       gsutil cp gs://cvltexternalartifacts/terraform-templates/11.0/46/CU20/IAMPermissions/*.yaml .

       gcloud iam roles create Commvault_GoogleCloud_GCSBackupRole --project=PROJECT_ID \
       --file=Commvault_GoogleCloud_GCSBackupRole.yaml

       gcloud iam roles create Commvault_GoogleCloud_GCSRestoreRole --project=PROJECT_ID \
       --file=Commvault_GoogleCloud_GCSRestoreRole.yaml

       gcloud projects add-iam-policy-binding PROJECT_ID --verbosity=debug \
         --member="serviceAccount:SERVICE_ACCOUNT_EMAIL_ADDRESS" \
         --role=projects/PROJECT_ID/roles/Commvault_GoogleCloud_GCSBackupRole

       gcloud projects add-iam-policy-binding PROJECT_ID --verbosity=debug \
         --member="serviceAccount:SERVICE_ACCOUNT_EMAIL_ADDRESS" \
         --role=projects/PROJECT_ID/roles/Commvault_GoogleCloud_GCSRestoreRole

## Placeholder Values

The following table describes the placeholders used in the command examples on this page.

Placeholder | Description
--- | ---
`PROJECT_ID` | The ID of your Google Cloud project.
`SERVICE_ACCOUNT_ID` | The name of the service account to create.
`SERVICE_ACCOUNT_EMAIL_ADDRESS` | The email address of the service account.
`KEY_FILE_NAME` | The name of the JSON key file to create.

## Related Topics

- Backup permissions used for Google Cloud Storage protection

- Restore permissions used for Google Cloud Storage protection

×

Loading...