During restore operations, Commvault recreates or updates Google Cloud Storage resources and writes data back to Google Cloud Storage from backup data. The following permissions are required to perform these operations successfully.
Google Cloud Storage Bucket Permissions
| Permission |
Usage |
storage.buckets.create |
Create destination buckets when restoring to a bucket that does not exist. |
storage.buckets.get |
Read bucket configuration such as location, storage class, versioning, and lifecycle. |
storage.buckets.getIamPolicy |
Read bucket IAM policy. Required when validating or restoring bucket IAM permissions. |
storage.buckets.list |
Discover destination buckets within the project. |
storage.buckets.listEffectiveTags |
Read bucket tags inherited from folders or organizations. |
storage.buckets.listTagBindings |
Read resource tags directly attached to the bucket. |
storage.buckets.setIamPolicy |
Restore bucket IAM policy. |
storage.buckets.update |
Update bucket configuration when restoring bucket metadata. |
Google Cloud Storage Object Permissions
| Permission |
Usage |
storage.objects.create |
Upload restored objects. |
storage.objects.get |
Read existing object metadata. Used to validate overwrite behavior and destination state. |
storage.objects.list |
Enumerate existing objects in the destination bucket. |
storage.objects.delete |
Delete destination objects when overwrite is requested. |
storage.objects.update |
Update existing object metadata. Used when restoring object metadata. |
storage.objects.getIamPolicy |
Read object IAM policy. Required when restoring object IAM permissions. |
storage.objects.setIamPolicy |
Restore object IAM policy. |
Multipart Upload Permissions
| Permission |
Usage |
storage.multipartUploads.create |
Create multipart uploads for large object restores. |
storage.multipartUploads.abort |
Abort failed multipart uploads during cleanup. |