To discover database instances, enable the Cloud SQL Admin and Cloud Resource Manager API in the project where service account is hosted.
Commvault requires a Google Cloud service account with the appropriate Identity and Access Management (IAM) permissions to protect Google Cloud Database SQL Server resources.
Permission Required for IAM
Cloud SQL Permissions
| Permission | Description |
|---|---|
| cloudsql.instances.get | View Cloud SQL instance details. |
| cloudsql.instances.list | List Cloud SQL instances. |
| cloudsql.instances.export | Export Cloud SQL instance data |
| cloudsql.instances.import | Import data into a Cloud SQL instance from an external source |
| cloudsql.instances.update | Modify settings of Cloud SQL instance |
| cloudsql.databases.list | List the databases in a Cloud SQL instance |
| cloudsql.databases.delete | Delete a database in a Cloud SQL instance |
Resource Manager Permissions
| Permission | Description |
|---|---|
| resourcemanager.projects.get | View Cloud SQL instance details. |
Storage Permissions
| Permission | Description |
|---|---|
| cloudsql.instances.list | List Cloud Storage buckets. |
| storage.buckets.get | Retrieve metadata and configuration for a bucket. |
| storage.buckets.create | Create a new Cloud Storage bucket. |
| storage.buckets.getIamPolicy | Retrieve the IAM policy for a bucket. |
| storage.buckets.setIamPolicy | Set the IAM policy for a bucket. |
| storage.objects.list | List objects inside a bucket. |
| storage.objects.get | Get an object metadata. |
| storage.objects.create | Create an object in a bucket. |
| storage.objects.delete | Delete an object from a bucket. |
| storage.objects.getIamPolicy | Get the IAM policy for a specific object. |
| storage.multipartUploads.create | Initiate multipart upload session for large object uploads. |
Permissions for the SQL Server Service Account
| Permission | Description |
|---|---|
| storage.objects.create | Create an object in a bucket. |
| storage.objects.list | List objects inside a bucket. |
| storage.objects.delete | Delete an object from a bucket. |
| storage.buckets.get | Get metadata and configuration for a bucket. |
For information about creating and assigning custom IAM roles, see the Google Cloud IAM documentation.