OCI permissions required by NetBackup Snapshot Manager
The table lists the required permissions.
Table:
Permissions | Description |
|---|---|
BOOT_VOLUME_BACKUP_CREATE | To take snapshots of the boot volume. |
BOOT_VOLUME_BACKUP_DELETE | To delete the snapshot of the boot volume as per policy. |
BOOT_VOLUME_BACKUP_INSPECT | To fetch the list of boot volume backup in the discovery. |
BOOT_VOLUME_BACKUP_READ | To create boot volume from backup. |
COMPARTMENT_INSPECT | To list availability domains, and to retrieve all the compartments in the tenancy. |
INSTANCE_ATTACH_VOLUME | To attach the volume to the instance while restore. |
INSTANCE_CREATE | To restore the instance. |
INSTANCE_DELETE | To create and delete the instance that is created for boot volume restore from backup copy. |
INSTANCE_DETACH_VOLUME | To detach volume after backup and restore operation. |
INSTANCE_IMAGE_INSPECT | To fetch the OS details of the instance. |
INSTANCE_INSPECT | To list various attachments like VNIC, volume, and so on. |
INSTANCE_POWER_ACTIONS | To stop or start the instance during parameterized restore. |
INSTANCE_READ | To list the instances in discovery and retrieve the details of the instance. |
INSTANCE_UPDATE | Update the tags attached on the instance. |
KEY_ASSOCIATE | To attach CMK in the parameterized restore. |
KEY_DISASSOCIATE | To detach the CMK in the parameterized restore. |
KEY_INSPECT | To list the keys in the vault. |
KEY_READ | To get the key details. |
NETWORK_SECURITY_GROUP_READ | List the network security group for parameterized restore. |
NETWORK_SECURITY_GROUP_UPDATE_MEMBERS | To attach a network security group to an instance. |
SUBNET_ATTACH | To launch the instance in a specific subnet. |
SUBNET_DETACH | To terminate the instance in a specific subnet. |
SUBNET_READ | To list subnets in parameterized restore. |
TAG_NAMESPACE_CREATE | To create the tag namespace for NetBackup Snapshot Manager. |
TAG_NAMESPACE_INSPECT | To check if the NetBackupSnapshot Manager tag namespace exists or not. |
TAG_NAMESPACE_USE | To create the tag in the NetBackupSnapshot Manager tag namespace. |
TENANCY_INSPECT | To get the details of the tenancy. |
VAULT_INSPECT | To list the vaults and retrieve the keys. |
VCN_READ | To get VCN details associated with the instance. |
VNIC_ASSOCIATE_NETWORK_SECURITY_GROUP | To associate the network security group while launching the instance. |
VNIC_ATTACH | To launch the instance. |
VNIC_ATTACHMENT_READ | To list the VNIC attachment. |
VNIC_CREATE | To associate VNIC to the instance while launching the instance. |
VNIC_DELETE | To delete the associated VNIC to delete the instance. |
VNIC_READ | To fetch the VNIC information associated with the instance. |
VOLUME_ATTACHMENT_CREATE | To attach the volume after restore. |
VOLUME_ATTACHMENT_DELETE | To attach the volume after restore. |
VOLUME_ATTACHMENT_INSPECT | To detach the volume after backup and restore. |
VOLUME_BACKUP_CREATE | To take snapshots of the volume. |
VOLUME_BACKUP_DELETE | To delete the snapshot of the volume as per policy. |
VOLUME_BACKUP_INSPECT | To retrieve the list of volume backups during discovery. |
VOLUME_BACKUP_READ | List volume backups during the discovery. |
VOLUME_CREATE | To create volumes during restore. |
VOLUME_DELETE | To delete volumes during parameterized restore if the availability domain is changed. |
VOLUME_INSPECT | To list volumes during discovery. |
VOLUME_UPDATE | To update the tags and different attributes of the volume. |
VOLUME_WRITE | Create volume from snapshot. |
Here is an example of assigning permissions to the policy that you create. Here, nbsm-iam-role is the name of dynamic group and NetBackup Snapshot Manager is a part of that dynamic group
Allow dynamic-group nbsm-iam-role to inspect compartments in tenancy
Allow dynamic-group nbsm-iam-role to inspect instance-images in tenancy
Allow dynamic-group nbsm-iam-role to inspect vnic-attachments in tenancy
Allow dynamic-group nbsm-iam-role to inspect vaults in tenancy
Allow dynamic-group nbsm-iam-role to read vcns in tenancy
Allow dynamic-group nbsm-iam-role to use keys in tenancy
Allow dynamic-group nbsm-iam-role to use subnets in tenancy where any { request.permission='SUBNET_DETACH', request.permission='SUBNET_ATTACH', request.permission='SUBNET_READ' }
Allow dynamic-group nbsm-iam-role to manage boot-volumes in tenancy where any { request.permission='BOOT_VOLUME_CREATE', request.permission='BOOT_VOLUME_DELETE', request.permission='BOOT_VOLUME_INSPECT', request.permission='BOOT_VOLUME_WRITE' }
Allow dynamic-group nbsm-iam-role to manage boot-volume-backups in tenancy where any { request.permission='BOOT_VOLUME_BACKUP_CREATE', request.permission='BOOT_VOLUME_BACKUP_DELETE', request.permission='BOOT_VOLUME_BACKUP_INSPECT', request.permission='BOOT_VOLUME_BACKUP_READ' }
Allow dynamic-group nbsm-iam-role to manage instances in tenancy where any { request.permission='INSTANCE_ATTACH_VOLUME', request.permission='INSTANCE_CREATE', request.permission='INSTANCE_DELETE', request.permission='INSTANCE_DETACH_VOLUME', request.permission='INSTANCE_INSPECT', request.permission='INSTANCE_READ', request.permission='INSTANCE_POWER_ACTIONS', request.permission='INSTANCE_UPDATE' }
Allow dynamic-group nbsm-iam-role to manage network-security-groups in tenancy where any { request.permission='NETWORK_SECURITY_GROUP_READ', request.permission='NETWORK_SECURITY_GROUP_UPDATE_MEMBERS' }
Allow dynamic-group nbsm-iam-role to manage tag-namespaces in tenancy where any { request.permission='TAG_NAMESPACE_CREATE', request.permission='TAG_NAMESPACE_USE', request.permission='TAG_NAMESPACE_INSPECT' }
Allow dynamic-group nbsm-iam-role to manage volumes in tenancy where any { request.permission='VOLUME_CREATE', request.permission='VOLUME_DELETE', request.permission='VOLUME_INSPECT', request.permission='VOLUME_WRITE', request.permission='VOLUME_UPDATE' }
Allow dynamic-group nbsm-iam-role to manage volume-attachments in tenancy where any { request.permission='VOLUME_ATTACHMENT_CREATE', request.permission='VOLUME_ATTACHMENT_DELETE', request.permission='VOLUME_ATTACHMENT_INSPECT' }
Allow dynamic-group nbsm-iam-role to manage volume-backups in tenancy where any { request.permission='VOLUME_BACKUP_CREATE', request.permission='VOLUME_BACKUP_DELETE', request.permission='VOLUME_BACKUP_INSPECT', request.permission='VOLUME_BACKUP_READ' }
Allow dynamic-group nbsm-iam-role to manage vnics in tenancy where any { request.permission='VNIC_ASSOCIATE_NETWORK_SECURITY_GROUP', request.permission='VNIC_ATTACH', request.permission='VNIC_CREATE', request.permission='VNIC_DELETE', request.permission='VNIC_READ' }
Allow dynamic-group nbsm-iam-role to use key-delegate in tenancy