During backup operations, Commvault discovers Google Cloud Spanner resources, reads table data, and stores backup data in Cloud Storage. The following permissions are required to perform these operations successfully.
Google Cloud Storage Permissions
| Permission | Usage |
|---|---|
storage.buckets.create |
Create Cloud Storage buckets for backup operations. |
storage.buckets.get |
View Cloud Storage bucket metadata. |
storage.buckets.list |
List Cloud Storage buckets. |
storage.buckets.update |
Update Cloud Storage bucket configuration. |
storage.objects.create |
Create backup objects in Cloud Storage. |
storage.objects.get |
Read backup objects from Cloud Storage. |
storage.objects.list |
List objects in Cloud Storage buckets. |
storage.objects.delete |
Delete backup objects from Cloud Storage. |
storage.multipartUploads.create |
Initiate multipart uploads for large backup objects. |
Cloud Spanner Permissions
| Permission | Usage |
|---|---|
spanner.instances.list |
List Cloud Spanner instances. |
spanner.instances.get |
View Cloud Spanner instance details. |
spanner.instanceConfigs.list |
List Cloud Spanner instance configurations. |
spanner.instanceConfigs.get |
View Cloud Spanner instance configuration details. |
spanner.databases.list |
List Cloud Spanner databases. |
spanner.databases.get |
View Cloud Spanner database details. |
spanner.databases.getDdl |
Retrieve database schema definitions. |
spanner.databases.beginReadOnlyTransaction |
Create read-only transactions for consistent backups. |
spanner.databases.partitionQuery |
Partition queries for parallel processing. |
spanner.databases.partitionRead |
Partition table reads for parallel processing. |
spanner.databases.read |
Read data from Cloud Spanner tables. |
spanner.databases.select |
Query Cloud Spanner database metadata. |
spanner.sessions.create |
Create Cloud Spanner sessions. |
spanner.sessions.delete |
Delete Cloud Spanner sessions. |
Dataflow Permissions
| Permission | Usage |
|---|---|
dataflow.jobs.create |
Create Dataflow jobs for backup operations. |
dataflow.jobs.get |
View Dataflow job status and details. |
dataflow.jobs.list |
List Dataflow jobs. |
dataflow.jobs.updateContents |
Update Dataflow job contents. |
dataflow.jobs.cancel |
Cancel Dataflow jobs. |
dataflow.messages.list |
View Dataflow job messages. |
dataflow.shuffle.read |
Read Dataflow shuffle data. |
dataflow.shuffle.write |
Write Dataflow shuffle data. |
autoscaling.sites.readRecommendations |
Read autoscaling recommendations for Dataflow worker autoscaling decisions. |
autoscaling.sites.writeMetrics |
Write autoscaling metrics for Dataflow worker autoscaling decisions. |
autoscaling.sites.writeState |
Write autoscaling state for Dataflow worker autoscaling decisions. |
compute.instanceGroupManagers.update |
Update instance group managers for Dataflow worker management. |
compute.instances.delete |
Delete Dataflow worker instances. |
compute.instances.setDiskAutoDelete |
Set automatic disk deletion for Dataflow worker instances. |
dataflow.streamingWorkItems.commitWork |
Commit work for Dataflow streaming workers. |
dataflow.streamingWorkItems.getData |
Get data for Dataflow streaming workers. |
dataflow.streamingWorkItems.getWork |
Get work for Dataflow streaming workers. |
dataflow.streamingWorkItems.getWorkerMetadata |
Get worker metadata for Dataflow streaming workers. |
dataflow.streamingWorkItems.importState |
Import state for Dataflow streaming workers. |
dataflow.workItems.lease |
Lease work items for Dataflow workers. |
dataflow.workItems.sendMessage |
Send messages to Dataflow work items. |
dataflow.workItems.update |
Update Dataflow work items. |
logging.logEntries.create |
Create log entries for Dataflow workers. |
logging.logEntries.route |
Route log entries for Dataflow workers. |
monitoring.timeSeries.create |
Create monitoring time series for Dataflow workers. |
Cloud Monitoring Permissions
| Permission | Usage |
|---|---|
monitoring.timeSeries.list |
List Cloud Monitoring time series used during backup operations. |
Cloud KMS Permissions
| Permission | Usage |
|---|---|
cloudkms.cryptoKeys.get |
View Cloud KMS key metadata. |
IAM Permissions
| Permission | Usage |
|---|---|
iam.serviceAccounts.actAs |
Impersonate another service account during backup operations. |
Compute Engine Permissions
| Permission | Usage |
|---|---|
compute.machineTypes.get |
View Compute Engine machine type details. |
compute.regions.list |
List Compute Engine regions. |
Resource Manager permissions
| Permission | Usage |
|---|---|
resourcemanager.projects.get |
View Google Cloud project information. |
resourcemanager.projects.list |
List Google Cloud projects. |