Object Storage Repositories
General Amazon S3 and S3 Compatible Object Storage Permissions
Consider the following:
- The permissions listed in the section for Amazon S3 and S3 Compatible are IAM policy actions. These may differ from the S3 API operation names used in the AWS SDK or API documentation. For more information, see AWS Documentation.
- Use the account that has access to Amazon buckets and folders.
- The ListAllMyBuckets permission is not required if you specify the bucket name explicitly at the Bucket step of the New Object Repository wizard.
Permissions for Amazon S3 or S3 compatible object storage depend on whether you use immutability and helper appliance settings.
|
Consider the following:
|
1. Immutability Disabled and Helper Appliance not Used
|
The following permissions are required to use Amazon S3 or S3 compatible object storage with immutability disabled. A helper appliance is not used for health check operations.
|
2. Immutability Disabled and New Helper Appliance Configured
|
The following permissions are required to use Amazon S3 or S3 compatible object storage with immutability disabled. For health check operations a new helper appliance is configured and the Amazon VPC, subnet and security group settings are set to (Create new) for the helper appliance settings.
|
3. Immutability Disabled and Helper Appliance Configured Beforehand
|
The following permissions are required to use Amazon S3 or S3 compatible object storage with immutability disabled. Amazon VPC, subnet and security group settings for a helper appliance are configured beforehand.
|
4. Immutability Enabled and Helper Appliance not Used
|
The following permissions are required to use Amazon S3 or S3 compatible object storage with immutability enabled. A helper appliance is not used for health check operations.
|
5. Immutability Enabled and New Helper Appliance Configured
|
The following permissions are required to use Amazon S3 or S3 compatible object storage with immutability enabled. For health check operations a new helper appliance is configured and the Amazon VPC, subnet and security group settings are set to (Create new) for the helper appliance settings.
|
6. Immutability Enabled and Helper Appliance Configured Beforehand
|
The following permissions are required to use Amazon S3 or S3 compatible object storage with immutability enabled. Amazon VPC, subnet and security group settings for a helper appliance are configured beforehand.
|
For more information on permissions, see AWS Documentation.
Amazon S3 Glacier and S3 Compatible with Data Archiving Object Storage Permissions
Permissions for Amazon S3 Glacier and S3 Compatible with data archiving depend on whether you use immutability and the archiver appliance settings:
1. Immutability Disabled and Archiver Appliance not Configured
|
The following permissions are required for Amazon S3 Glacier and S3 Compatible with data archiving object storage with immutability disabled. VPC, subnet and security group settings are set to (Create new) in the archiver appliance settings.
|
2. Immutability Disabled and Archiver Appliance Configured Beforehand
|
These permissions apply for Amazon S3 Glacier and S3 Compatible with data archiving object storage with immutability disabled. Amazon VPC, subnet and security group settings for an archiver appliance are configured beforehand.
|
3. Immutability Enabled and Archiver Appliance not Configured
|
The following permissions are required for Amazon S3 Glacier and S3 Compatible with data archiving object storage with immutability enabled. VPC, subnet and security group settings are set to (Create new) in the archiver appliance settings.
|
4. Immutability Enabled and Archiver Appliance Configured Beforehand
|
These permissions apply for Amazon S3 Glacier and S3 Compatible with data archiving object storage with immutability enabled. Amazon VPC, subnet and security group settings for an archiver appliance are configured beforehand.
|
Read-Only Permissions for Amazon S3 and S3 Compatible Object Storage
The following permissions are required to connect to Amazon S3 or S3 Compatible object storage from a second backup server when performing data recovery operations.
1. Immutability Enabled
|
These permissions apply for Amazon S3 or S3 compatible object storage with immutability enabled.
|
2. Immutability Disabled
|
These permissions apply for Amazon S3 or S3 compatible object storage with immutability disabled.
|
Batch Retrieval Permissions for Amazon S3 Glacier
The following permissions are required to perform standard accelerated retrieval that uses S3 Batch Operations:
|
"iam:GetRole", "iam:CreateRole", "iam:PutRolePolicy", "iam:DeleteRolePolicy", "iam:DeleteRole", "iam:PassRole", "s3:CreateJob", "s3:DescribeJob” |
Permissions for Amazon EBS Encryption
If you have EBS encryption enabled in Amazon EC2, specific permissions are required for a helper appliance to perform a health check of backup files in object storage and run the archiving job.
- You must grant this permission to the IAM user.
"ec2:GetEbsEncryptionByDefault" |
- You must grant the following permissions for the default encryption key to an IAM Role using a Key Policy.
|
"kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey", "kms:CreateGrant" |
Azure Archive Object Storage Permissions
The following permissions are required to use Azure Archive object storage.
|
{ "properties": { "roleName": "CUSTOM_ROLE_MINIMAL_PERMISSIONS", "description": "CUSTOM_ROLE_MINIMAL_PERMISSIONS", "assignableScopes": [ "/subscriptions/111111-1111-1111-0000-00000000000" ], "permissions": [ { "actions": [ "Microsoft.Authorization/*/read", "Microsoft.Compute/locations/*", "Microsoft.Compute/virtualMachines/*", "Microsoft.Compute/disks/read", "Microsoft.Compute/disks/write", "Microsoft.Compute/disks/delete", "Microsoft.Network/locations/*", "Microsoft.Network/networkInterfaces/*", "Microsoft.Network/networkSecurityGroups/join/action", "Microsoft.Network/networkSecurityGroups/read", "Microsoft.Network/networkSecurityGroups/write", "Microsoft.Network/networkSecurityGroups/delete", "Microsoft.Network/publicIPAddresses/join/action", "Microsoft.Network/publicIPAddresses/read", "Microsoft.Network/publicIPAddresses/write", "Microsoft.Network/publicIPAddresses/delete", "Microsoft.Network/virtualNetworks/read", "Microsoft.Network/virtualNetworks/write", "Microsoft.Network/virtualNetworks/subnets/join/action", "Microsoft.Storage/storageAccounts/listKeys/action", "Microsoft.Storage/storageAccounts/read", "Microsoft.Resources/deployments/*", "Microsoft.Resources/subscriptions/resourceGroups/read", "Microsoft.Resources/checkResourceName/action", "Microsoft.Resources/subscriptions/resourceGroups/write", "Microsoft.Resources/subscriptions/locations/read" ], "notActions": [], "dataActions": [], "notDataActions": [] } ] } } |
Google Cloud Object Storage Permissions
The following permissions are required to use Google Cloud Object Storage as an object storage repository.
1. General Permissions to Add Google Cloud Object Storage
|
The following permissions are required to use Google Cloud object storage.
Consider the following:
|
2. Permissions to Add Google Cloud Object Storage with Immutability
|
The following permissions are required to use Google Cloud object storage if you enable Immutability for it.
|
3. Read-Only Permissions for Google Cloud Object Storage
|
The following permissions are required to connect to Google Cloud object storage from a second backup server when performing data recovery operations.
|