Backup Permissions Used for Google Cloud Storage Protection

During backup operations, Commvault discovers Google Cloud Storage resources, reads bucket and object data, and stores backup data. The following permissions are required to perform these operations successfully.

Core Google Cloud Storage Permissions

Permission	Usage
`storage.buckets.get`	Read bucket configuration such as location, storage class, lifecycle, labels, and versioning.
`storage.buckets.getIamPolicy`	Read bucket IAM policy. Required when bucket IAM permissions are included in the backup.
`storage.buckets.list`	Discover all buckets in the Google Cloud project.
`storage.buckets.listEffectiveTags`	Read effective resource tags inherited from folders or organizations.
`storage.buckets.listTagBindings`	Read resource tags directly attached to the bucket.
`storage.objects.get`	Read object metadata and download object contents.
`storage.objects.getIamPolicy`	Read object IAM policy. Required when object IAM permissions are included in the backup.
`storage.objects.list`	Enumerate all objects within a bucket.

Resource Manager Permissions

Permission	Usage
`resourcemanager.projects.get`	Read project metadata. Used to resolve the project number and identify the backup target.

Hybrid Scan - Cloud Storage Inventory Permissions

These permissions are required only when using Hybrid Scan. These permissions allow Commvault to create and manage Cloud Storage Inventory configurations used for full scans of large datasets.

Permission	Usage
`storageinsights.reportConfigs.create`	Create Cloud Storage Inventory report configurations.
`storageinsights.reportConfigs.delete`	Delete Cloud Storage Inventory report configurations during cleanup.
`storageinsights.reportConfigs.get`	Read Cloud Storage Inventory report configurations.
`storageinsights.reportConfigs.list`	List Cloud Storage Inventory report configurations.
`storageinsights.reportConfigs.update`	Update Cloud Storage Inventory report configurations.

Hybrid Scan - Pub/Sub Permissions

Required only when using Hybrid Scan incremental backups. Commvault deploys a Pub/Sub and BigQuery event processing stack to capture Cloud Storage events.

Permission	Usage
`pubsub.topics.create`	Create Pub/Sub topics used for Cloud Storage event notifications.
`pubsub.topics.get`	Read Pub/Sub topic configuration.
`pubsub.topics.list`	List Pub/Sub topics.
`pubsub.topics.attachSubscription`	Attach subscriptions to Pub/Sub topics.
`pubsub.topics.getIamPolicy`	Read Pub/Sub topic IAM policy. Required before granting Cloud Storage permission to publish events.
`pubsub.topics.setIamPolicy`	Update Pub/Sub topic IAM policy. Used to allow the Cloud Storage service account to publish events.
`pubsub.subscriptions.create`	Create Pub/Sub subscriptions.
`pubsub.subscriptions.get`	Read Pub/Sub subscription configuration.
`pubsub.subscriptions.list`	List Pub/Sub subscriptions.

Hybrid Scan - BigQuery Permissions

Required only when using Hybrid Scan. Commvault uses BigQuery to store and query Cloud Storage events.

Permission	Usage
`bigquery.datasets.create`	Create the BigQuery dataset used to store Cloud Storage events.
`bigquery.datasets.get`	Read the BigQuery dataset to determine whether it already exists.
`bigquery.tables.create`	Create the events table used to receive Cloud Storage notifications.
`bigquery.tables.get`	Read table metadata when validating or reusing existing tables.
`bigquery.tables.getIamPolicy`	Read the table IAM policy before granting Pub/Sub write access.
`bigquery.tables.setIamPolicy`	Update the table IAM policy to allow the Pub/Sub service account to write Storage Events into the table.
`bigquery.jobs.create`	Create BigQuery jobs used to execute queries, monitor long-running operations, and export query results.
`bigquery.tables.export`	Export query results to the staging bucket.

Hybrid Scan - Bigtable Permissions

Required only when using Hybrid Scan with Bigtable-based event tracking.

Permission	Usage
`bigtable.instances.get`	Read Bigtable instance metadata.
`bigtable.tables.readRows`	Read rows from Bigtable tables.

Staging Bucket Management Permissions

Required only when Commvault manages the staging bucket used for Cloud Storage Inventory reports and BigQuery query results.

Permission	Usage
`storage.buckets.create`	Create the Commvault staging bucket.
`storage.buckets.update`	Update staging bucket configuration. Used when enabling bucket notifications and configuring lifecycle rules.
`storage.buckets.delete`	Delete the staging bucket during cleanup.
`storage.objects.create`	Create temporary objects such as inventory reports and exported BigQuery query results in the staging bucket.
`storage.objects.delete`	Delete temporary inventory reports and exported query results.

Google Cloud API Management Permissions

Required only when Commvault automatically verifies and enables the Google Cloud APIs required for Hybrid Scan.

Permission	Usage
`serviceusage.services.get`	Read whether required Google Cloud APIs are enabled.
`serviceusage.services.enable`	Enable required Google Cloud APIs when they are not already enabled.

IAM Permissions

Required for Google Cloud managed service identity operations used by Hybrid Scan infrastructure.

Permission	Usage
`iam.serviceAccounts.get`	Read service account metadata. Required by Google Cloud managed service identity workflows.
`iam.serviceAccounts.list`	List service accounts. Required by Google Cloud managed service identity workflows.

Cloud Monitoring Permissions

Used to monitor cloud resources and backup operations.

Permission	Usage
`monitoring.timeSeries.list`	Read Cloud Monitoring time series metrics.