During backup operations, Commvault discovers Google Cloud Bigtable resources, reads table data, and stores backup data in Cloud Storage. The following permissions are required to perform these operations successfully.
Google Cloud Storage Permissions
| Permission | Usage |
|---|---|
storage.buckets.create * |
Create Cloud Storage buckets for backup operations. |
storage.buckets.get |
View Cloud Storage bucket metadata. |
storage.buckets.list |
List Cloud Storage buckets. |
storage.buckets.update |
Update Cloud Storage bucket configuration. |
storage.objects.create |
Create backup objects in Cloud Storage. |
storage.objects.get |
Read backup objects from Cloud Storage. |
storage.objects.list |
List objects in Cloud Storage buckets. |
storage.objects.delete |
Delete backup objects from Cloud Storage. |
storage.multipartUploads.create |
Initiate multipart uploads for large backup objects. |
* Required only when Automatically select staging path is enabled for the instance.
Cloud Bigtable Permissions
| Permission | Usage |
|---|---|
bigtable.instances.ping |
Verify connectivity to Cloud Bigtable instances. |
bigtable.instances.get |
View Cloud Bigtable instance details. |
bigtable.instances.list |
List Cloud Bigtable instances. |
bigtable.instances.getIamPolicy |
View the IAM policy for Cloud Bigtable instances. |
bigtable.instances.executeQuery |
Execute queries against Cloud Bigtable instances. |
bigtable.clusters.get |
View Cloud Bigtable cluster details. |
bigtable.clusters.list |
List Cloud Bigtable clusters. |
bigtable.tables.get |
View Cloud Bigtable table metadata. |
bigtable.tables.list |
List Cloud Bigtable tables. |
bigtable.tables.readRows |
Read Cloud Bigtable table data. |
bigtable.tables.sampleRowKeys |
Retrieve sampled row keys. |
bigtable.tables.update |
Update Cloud Bigtable table configuration. |
bigtable.tables.getIamPolicy |
View the IAM policy for Cloud Bigtable tables. |
bigtable.tables.create |
Create temporary tables required during backup operations. |
bigtable.tables.delete |
Delete temporary tables created during backup operations. |
bigtable.appProfiles.get |
View application profile details. |
bigtable.appProfiles.list |
List application profiles. |
bigtable.tables.mutateRows |
Write backup data to Cloud Bigtable tables. |
Dataflow Permissions
| Permission | Usage |
|---|---|
dataflow.jobs.create |
Create Dataflow jobs for backup operations. |
dataflow.jobs.get |
View Dataflow job status and details. |
dataflow.jobs.list |
List Dataflow jobs. |
dataflow.jobs.updateContents |
Update Dataflow job contents. |
dataflow.jobs.cancel |
Cancel Dataflow jobs. |
dataflow.shuffle.read |
Read Dataflow shuffle data. |
dataflow.shuffle.write |
Write Dataflow shuffle data. |
autoscaling.sites.readRecommendations |
Read autoscaling recommendations for Dataflow worker autoscaling decisions. |
autoscaling.sites.writeMetrics |
Write autoscaling metrics for Dataflow worker autoscaling decisions. |
autoscaling.sites.writeState |
Write autoscaling state for Dataflow worker autoscaling decisions. |
compute.instanceGroupManagers.update |
Update instance group managers for Dataflow worker management. |
compute.instances.delete |
Delete Dataflow worker instances. |
compute.instances.setDiskAutoDelete |
Set automatic disk deletion for Dataflow worker instances. |
dataflow.streamingWorkItems.commitWork |
Commit work for Dataflow streaming workers. |
dataflow.streamingWorkItems.getData |
Get data for Dataflow streaming workers. |
dataflow.streamingWorkItems.getWork |
Get work for Dataflow streaming workers. |
dataflow.streamingWorkItems.getWorkerMetadata |
Get worker metadata for Dataflow streaming workers. |
dataflow.streamingWorkItems.importState |
Import state for Dataflow streaming workers. |
dataflow.workItems.lease |
Lease work items for Dataflow workers. |
dataflow.workItems.sendMessage |
Send messages to Dataflow work items. |
dataflow.workItems.update |
Update Dataflow work items. |
logging.logEntries.create |
Create log entries for Dataflow workers. |
logging.logEntries.route |
Route log entries for Dataflow workers. |
monitoring.timeSeries.create |
Create monitoring time series for Dataflow workers. |
Cloud Monitoring Permissions
| Permission | Usage |
|---|---|
monitoring.timeSeries.list |
View monitoring metrics used during backup operations. |
Cloud KMS Permissions
| Permission | Usage |
|---|---|
cloudkms.cryptoKeys.get |
View Cloud KMS key metadata. |
IAM Permissions
| Permission | Usage |
|---|---|
iam.serviceAccounts.actAs |
Allow the service account to impersonate another service account during backup operations. |
Compute Engine Permissions
| Permission | Usage |
|---|---|
compute.regions.list |
List Compute Engine regions. |
Resource Manager permissions
| Permission | Usage |
|---|---|
resourcemanager.projects.get |
View Google Cloud project information. |