To protect Google Cloud Storage resources, Commvault requires a Google Cloud service account with the appropriate Identity and Access Management (IAM) permissions. The required permissions vary depending on whether the service account is used for backup operations or restore operations.
Google Cloud IAM permissions determine the actions that Commvault can perform on Google Cloud Storage resources. Depending on the operation, different permissions are required for backup and restore workflows.
For information about creating and assigning custom IAM roles in Google Cloud, see the Google Cloud IAM documentation.
Configure IAM Permissions for Google Cloud Storage Protection
Before You Begin
-
Open Google Cloud Shell in the Google Cloud console.
-
Sign in to your Google Cloud account, if prompted.
-
Download the following custom role definition files:
Create a Service Account and Custom IAM Roles
-
Set the active Google Cloud project.
gcloud config set project PROJECT_ID -
Enable required services on the current project.
gcloud services enable storage.googleapis.com gcloud services enable bigtable.googleapis.com gcloud services enable bigquery.googleapis.com gcloud services enable pubsub.googleapis.com gcloud services enable cloudresourcemanager.googleapis.com gcloud services enable iam.googleapis.com gcloud services enable serviceusage.googleapis.com gcloud services enable monitoring.googleapis.com gcloud services enable storageinsights.googleapis.com gcloud services enable cloudkms.googleapis.com gcloud services enable kmsinventory.googleapis.com -
Create a service account.
gcloud iam service-accounts create SERVICE_ACCOUNT_ID -
Create custom roles with the required permissions for different Commvault operations at project level.
gsutil cp gs://cvltexternalartifacts/terraform-templates/11.0/46/CU20/IAMPermissions/*.yaml . gcloud iam roles create Commvault_GoogleCloud_GCSBackupRole --project=PROJECT_ID \ --file=Commvault_GoogleCloud_GCSBackupRole.yaml gcloud iam roles create Commvault_GoogleCloud_GCSRestoreRole --project=PROJECT_ID \ --file=Commvault_GoogleCloud_GCSRestoreRole.yaml -
Grant your service account an IAM role on your project.
gcloud projects add-iam-policy-binding PROJECT_ID --verbosity=debug \ --member="serviceAccount:SERVICE_ACCOUNT_EMAIL_ADDRESS" \ --role=projects/PROJECT_ID/roles/Commvault_GoogleCloud_GCSBackupRole gcloud projects add-iam-policy-binding PROJECT_ID --verbosity=debug \ --member="serviceAccount:SERVICE_ACCOUNT_EMAIL_ADDRESS" \ --role=projects/PROJECT_ID/roles/Commvault_GoogleCloud_GCSRestoreRole -
Generate a private key file for the service account and download the JSON file.
gcloud iam service-accounts keys create KEY_FILE_NAME.json \ --iam-account=SERVICE_ACCOUNT_EMAIL_ADDRESS cloudshell download KEY_FILE_NAME.json -
Associate the service account with multiple projects (replace
PROJECT_IDwith the actual project name).gsutil cp gs://cvltexternalartifacts/terraform-templates/11.0/46/CU20/IAMPermissions/*.yaml . gcloud iam roles create Commvault_GoogleCloud_GCSBackupRole --project=PROJECT_ID \ --file=Commvault_GoogleCloud_GCSBackupRole.yaml gcloud iam roles create Commvault_GoogleCloud_GCSRestoreRole --project=PROJECT_ID \ --file=Commvault_GoogleCloud_GCSRestoreRole.yaml gcloud projects add-iam-policy-binding PROJECT_ID --verbosity=debug \ --member="serviceAccount:SERVICE_ACCOUNT_EMAIL_ADDRESS" \ --role=projects/PROJECT_ID/roles/Commvault_GoogleCloud_GCSBackupRole gcloud projects add-iam-policy-binding PROJECT_ID --verbosity=debug \ --member="serviceAccount:SERVICE_ACCOUNT_EMAIL_ADDRESS" \ --role=projects/PROJECT_ID/roles/Commvault_GoogleCloud_GCSRestoreRole
Placeholder Values
The following table describes the placeholders used in the command examples on this page.
|
Placeholder |
Description |
|---|---|
|
|
The ID of your Google Cloud project. |
|
|
The name of the service account to create. |
|
|
The email address of the service account. |
|
|
The name of the JSON key file to create. |