title: "Commvault Bigtable Backup"
description: >
  Minimum IAM permissions required for Commvault to perform full (Parquet/Avro via
  Dataflow) and incremental (change-stream CDC via Dataflow) backups of Google Cloud
  Bigtable tables.
stage: "GA"
includedPermissions:

  # ── Bigtable: Instance & Cluster discovery ────────────────────────────────────────────
  - bigtable.instances.ping          # Connectivity check at job init before any Bigtable operation
  - bigtable.instances.get           # Read instance config/status (FetchInstanceMetadata, GetInstance)
  - bigtable.instances.list          # Enumerate instances for project-level and region-level backup content resolution
  - bigtable.instances.getIamPolicy  # Read instance IAM policy to back it up (stored in instance-level index metadata)
  - bigtable.instances.executeQuery  # Execute a query against a table to verify it is non-empty before deciding backup scope
  - bigtable.clusters.get            # Fetch per-cluster attributes (location, storage type, state) for region derivation
  - bigtable.clusters.list           # Discover cluster topology; derive GCP region from location string for Dataflow job placement

  # ── Bigtable: Table operations ────────────────────────────────────────────────────────
  - bigtable.tables.get              # Read table schema and column-family metadata (getTableMetadata)
  - bigtable.tables.list             # Enumerate tables for backup content selection (ListAllTables, FetchTablesForSubclient)
  - bigtable.tables.readRows         # Dataflow reads all table rows during full Parquet/Avro export
  - bigtable.tables.sampleRowKeys    # Dataflow samples row keys to split the table into parallel read shards
  - bigtable.tables.update           # Enable and configure change stream on the source table for incremental backup
  - bigtable.tables.getIamPolicy     # Read table IAM policy to back it up (GetBigtableTableIAMPolicy)
  - bigtable.tables.create           # Creating the metadata table for Incremental backups.
  - bigtable.tables.delete           # Deleting the metadata table for Incremental backups.
  - bigtable.tables.mutateRows       # Dataflow writes the change stream metadata to the metadata table during incremental backup
  # ── Dataflow: Job management ──────────────────────────────────────────────────────────
  - dataflow.jobs.create             # Launch Dataflow export pipeline (BigtableChangeStreamExport for full and incremental)
  - dataflow.jobs.get                # Poll Dataflow job state and monitor completion/failure
  - dataflow.jobs.list               # List all active Dataflow jobs to detect orphaned streaming exporters (CancelOrphanedStreamingJobs)
  - dataflow.jobs.updateContents     # Cancel orphaned streaming jobs from prior retries (CancelOrphanedStreamingJobs)
  - dataflow.shuffle.read            # Dataflow internal: read distributed intermediate data between pipeline stages
  - dataflow.shuffle.write           # Dataflow internal: write distributed intermediate data between pipeline stages
  - dataflow.jobs.cancel             # Cancel Dataflow jobs when needed (CancelOrphanedStreamingJobs/Incremental backups)

  # ── Cloud Storage: Bucket management ──────────────────────────────────────────────────
  - storage.buckets.create           # Create GCS staging/temp bucket if it does not already exist
  - storage.buckets.get              # Verify staging bucket existence and read its properties
  - storage.buckets.list             # List buckets when validating staging path accessibility
  - storage.buckets.update           # Configure bucket-level soft-delete policy on the staging/export bucket

  # ── Cloud Storage: Object operations ─────────────────────────────────────────────────
  - storage.objects.create           # Write Avro/Parquet export files, _PENDING.json and _DONE.json markers to GCS
  - storage.objects.get              # Read _DONE.json marker to verify export job completion
  - storage.objects.list             # Enumerate objects under the backup path (e.g. SET/*.avro, DEL/*.avro)
  - storage.objects.delete           # Clean up temp/staging objects after export job completes
  - storage.multipartUploads.create  # Upload large Avro/Parquet export files using GCS parallel composite uploads

  # ── GCP Resource Manager ─────────────────────────────────────────────────────────────
  - resourcemanager.projects.get     # Validate project access and read project metadata before backup operations

  # ── Compute: Region discovery ─────────────────────────────────────────────────────────
  - compute.regions.list             # List available GCP regions for Dataflow worker placement validation

  # ── Cloud Monitoring: Size estimation ────────────────────────────────────────────────
  - monitoring.timeSeries.list       # Query Bigtable table size metrics via Cloud Monitoring API for backup size estimation (GetSizeInfoForTables)

  # ── IAM: Dataflow worker identity ────────────────────────────────────────────────────
  - iam.serviceAccounts.actAs        # Required to launch Dataflow workers under the designated service account; without this GCP rejects job submission

  # ── KMS support (Commvault uses existing keys only; keys are never created) ────
  # NOTE: The actual CMEK encrypt/decrypt on Bigtable data is performed by the Bigtable
  # service agent (service-{project-number}@gcp-sa-bigtable.iam.gserviceaccount.com),
  # not by this role. Only key existence validation requires a permission here.
  - cloudkms.cryptoKeys.get          # Validate that the existing CMEK key is accessible before reading a CMEK-encrypted source table

  # ── App Profile backup (multi-cluster support) ───────────────────────────────
  - bigtable.appProfiles.get         # Read existing app profile configuration for backup
  - bigtable.appProfiles.list        # Enumerate app profiles for backup inventory

    # ── Dataflow worker role ────────────────────────────────────────────────
  - autoscaling.sites.readRecommendations		        # Read autoscaling recommendations for Dataflow worker autoscaling decisions
  - autoscaling.sites.writeMetrics		              # Write autoscaling metrics for Dataflow worker autoscaling decisions
  - autoscaling.sites.writeState		                # Write autoscaling state for Dataflow worker autoscaling decisions
  - compute.instanceGroupManagers.update            # Update instance group manager for Dataflow worker management
  - compute.instances.delete                        # Delete compute instances for Dataflow worker management
  - compute.instances.setDiskAutoDelete             # Set disk auto-delete for Dataflow worker instances
  - dataflow.streamingWorkItems.commitWork          # Commit work for Dataflow streaming workers
  - dataflow.streamingWorkItems.getData             # Get data for Dataflow streaming workers
  - dataflow.streamingWorkItems.getWork             # Get work for Dataflow streaming workers
  - dataflow.streamingWorkItems.getWorkerMetadata   # Get worker metadata for Dataflow streaming workers
  - dataflow.streamingWorkItems.ImportState         # Import state for Dataflow streaming workers
  - dataflow.workItems.lease                        # Lease work items for Dataflow workers
  - dataflow.workItems.sendMessage                  # Send messages for Dataflow workers
  - dataflow.workItems.update                       # Update work items for Dataflow workers
  - logging.logEntries.create                       # Create log entries for Dataflow workers
  - logging.logEntries.route                        # Route log entries for Dataflow workers
  - monitoring.timeSeries.create                    # Create monitoring time series for Dataflow workers