Permissions Used for Google Cloud Bigtable Protection

To protect Google Cloud Bigtable resources, Commvault requires a Google Cloud service account with the appropriate Identity and Access Management (IAM) permissions. The required permissions vary depending on whether the service account is used for backup operations or restore operations.

Google Cloud IAM permissions determine the actions that Commvault can perform on Google Cloud Bigtable resources. Depending on the operation, different permissions are required for backup and restore workflows.

For information about creating and assigning custom IAM roles in Google Cloud, see the Google Cloud IAM documentation.

Configure IAM Permissions for Google Cloud Bigtable Protection

Before You Begin

• Open Google Cloud Shell in the Google Cloud console.

• Sign in to your Google Cloud account, if prompted.

• Download the following custom role definition files:

  • Commvault_GoogleCloud_BigTableBackupRole.yaml

  • Commvault_GoogleCloud_BigTableRestoreRole.yaml

Create a Service Account and Custom IAM Roles

1. Set the active Google Cloud project.

   gcloud config set project PROJECT_ID
   

2. Create a service account.

   gcloud iam service-accounts create SERVICE_ACCOUNT_ID
   

3. Create the Backup custom role.

   gcloud iam roles create Commvault_GoogleCloud_BigTableBackupRole \
     --project=PROJECT_ID \
     --file=Commvault_GoogleCloud_BigTableBackupRole.yaml
   

4. Create the Restore custom role.

   gcloud iam roles create Commvault_GoogleCloud_BigTableRestoreRole \
     --project=PROJECT_ID \
     --file=Commvault_GoogleCloud_BigTableRestoreRole.yaml
   

5. Assign the Backup custom role to the service account.

   gcloud projects add-iam-policy-binding PROJECT_ID \
     --member="serviceAccount:SERVICE_ACCOUNT_EMAIL_ADDRESS" \
     --role="projects/PROJECT_ID/roles/Commvault_GoogleCloud_BigTableBackupRole"
   

6. Assign the Restore custom role to the service account.

   gcloud projects add-iam-policy-binding PROJECT_ID \
     --member="serviceAccount:SERVICE_ACCOUNT_EMAIL_ADDRESS" \
     --role="projects/PROJECT_ID/roles/Commvault_GoogleCloud_BigTableRestoreRole"
   

7. Create a service account key.

   gcloud iam service-accounts keys create KEY_FILE_NAME.json \
     --iam-account=SERVICE_ACCOUNT_EMAIL_ADDRESS
   

8. Download the service account key.

   cloudshell download KEY_FILE_NAME.json
   

Placeholder Values

Related Topics

• Backup permissions used for Google Cloud Bigtable protection.

• Restore permissions used for Google Cloud Bigtable protection.