# Permissions Used for Google Cloud Database SQL Server Protection

To discover database instances, enable the Cloud SQL Admin and Cloud Resource Manager API in the project where service account is hosted.

Commvault requires a Google Cloud service account with the appropriate Identity and Access Management (IAM) permissions to protect Google Cloud Database SQL Server resources.

## Permission Required for IAM

### Cloud SQL Permissions

Permission | Description
--- | ---
cloudsql.instances.get | View Cloud SQL instance details.
cloudsql.instances.list | List Cloud SQL instances.
cloudsql.instances.export | Export Cloud SQL instance data
cloudsql.instances.import | Import data into a Cloud SQL instance from an external source
cloudsql.instances.update | Modify settings of Cloud SQL instance
cloudsql.databases.list | List the databases in a Cloud SQL instance
cloudsql.databases.delete | Delete a database in a Cloud SQL instance

### Resource Manager Permissions

Permission | Description
--- | ---
resourcemanager.projects.get | View Cloud SQL instance details.

### Storage Permissions

Permission | Description
--- | ---
cloudsql.instances.list | List Cloud Storage buckets.
storage.buckets.get | Retrieve metadata and configuration for a bucket.
storage.buckets.create | Create a new Cloud Storage bucket.
storage.buckets.getIamPolicy | Retrieve the IAM policy for a bucket.
storage.buckets.setIamPolicy | Set the IAM policy for a bucket.
storage.objects.list | List objects inside a bucket.
storage.objects.get | Get an object metadata.
storage.objects.create | Create an object in a bucket.
storage.objects.delete | Delete an object from a bucket.
storage.objects.getIamPolicy | Get the IAM policy for a specific object.
storage.multipartUploads.create | Initiate multipart upload session for large object uploads.

## Permissions for the SQL Server Service Account

Permission | Description
--- | ---
storage.objects.create | Create an object in a bucket.
storage.objects.list | List objects inside a bucket.
storage.objects.delete | Delete an object from a bucket.
storage.buckets.get | Get metadata and configuration for a bucket.

For information about creating and assigning custom IAM roles, see the Google Cloud IAM documentation.

×

Loading...