Configure Google Cloud Firestore user and permissions

To connect your Google Cloud Firestore account to Commvault, you must configure a credential with the required permissions and provide the authentication details Commvault needs to connect.

Create or identify a GCP Service Account credential

Create a new GCP Service Account in your Google Cloud project or identify an existing Service Account that you want to use for Commvault backups. The Service Account must have the required IAM roles for Firestore export and import operations and GCS bucket access.

To create a Service Account:

1. In the Google Cloud Console, go to IAM & Admin > Service Accounts.

2. Click Create Service Account.

3. Provide a name and description for the Service Account.

4. Click Create and Continue.

5. Assign the required roles (see the next section).

6. Click Done.

7. Generate and download a JSON key for the Service Account. You'll need the client_email and private_key values from this file during onboarding.

Assign the required permissions

Assign the following IAM roles to the Service Account:

In addition to these roles, the Service Account must have the following OAuth 2.0 scopes:

• https://www.googleapis.com/auth/datastore — Firestore export and import operations

• https://www.googleapis.com/auth/cloud-platform — List and create composite indexes, and GCS bucket access

To assign the roles:

1. In the Google Cloud Console, go to IAM & Admin > IAM.

2. Click Grant Access.

3. Enter the Service Account email address.

4. Select the required roles.

5. Click Save.

Provide connection details

During onboarding, you'll provide the following connection details from the Service Account JSON key file:

• Service Account Email (client_email): Copy the value from the client_email field in the JSON key file (for example, svc@project.iam.gserviceaccount.com).

• Private Key (private_key): Copy the entire PEM-encoded RSA private key from the private_key field in the JSON key file (including the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- markers).

• GCP Project Name: The GCP project ID where your Firestore database is located.

• Region: The GCP region where your Firestore database is located.

• GCS Bucket Name: The name of the GCS bucket where backups will be stored. This bucket must exist before you configure backups.

Notes and considerations

• The Service Account JSON key does not expire unless you delete or rotate it. Store the JSON key file securely.

• Use a dedicated Service Account for Commvault backups rather than a personal user account. This provides better security and audit tracking.

• The Service Account must have access to both the Firestore database and the GCS backup bucket. If the bucket is in a different project, grant the Service Account cross-project permissions.

Validate permissions

After you configure the credential, run a test backup to validate that the permissions are correct. If the backup fails, check the following:

• Permission denied on Firestore export: Verify that the Service Account has the roles/datastore.importExportAdmin role assigned in the Google Cloud Console.

• Permission denied on GCS bucket: Verify that the Service Account has the roles/storage.objectAdmin role and that the bucket exists in the specified region.

• Invalid credential: Verify that you copied the client_email and private_key values correctly from the JSON key file, including the complete PEM key with header and footer markers.

• Missing change stream for incremental backup: Verify that each collection has a change stream configured if you're attempting an incremental backup on a MongoDB-compatible Firestore database.