Protecting data in Amazon Glacier for long-term retention
To protect your data for long-term retention you can back up the data to Amazon (AWS) Glacier using NetBackup. Using NetBackup, you can create a storage server with Glacier storage class. During the backup process, NetBackup internally uses the Amazon's zero-day lifecycle policy to transition data to Glacier. AWS lifecycle policy is a lifecycle rule defined to transition objects to the Glacier storage class in 0 (zero) days after creation. The following diagram illustrates the configuration process:
To configure a cloud storage server for Amazon GLACIER storage class
- Configure the GLACIER storage class for amazon_glacier cloud storage server using the following command:
./csconfig cldinstance -as -in amazon.com -sts amazon_glacier -storage_class GLACIER
For information on the command, see Veritas NetBackup Commands Reference Guide.
- Configure the Amazon GLACIER cloud storage server.
- Create a disk pool using the Amazon bucket for GLACIER storage.
- Create a backup policy.
When you configure a storage server to transition data to Amazon Glacier, consider the following:
Ensure that Amazon Glacier is supported for the region to which the bucket belongs.
Ensure that the selected bucket does not have any existing Amazon lifecycle policy.
For restores, set the retrieval retention period to minimum 3 days.
You can reduce restore time by parallel restores. For this, you must backup using multi-streaming that creates multiple images at logical boundaries.
Workload Granular Revovery (GRT) or VMware Single File Restore (SFR), increases the timeout on the master, media, and client to more than 5 hours.
Consider the following limitations:
NetBackup Accelerator feature is not supported for policies of the storage units that are created for Amazon Glacier. Do not select the check box.
CloudCatalyst with Glacier is not supported.
When you run parallel restores from same set of data, critical info is displayed only for one restore job.
You can configure the GLACIER storage class only using the CLI.
During import of images:
Phase 1: Each image takes around 4 hours.
The total image duration = Number of images X 4 hours (approx).
Phase 2: For images without TIR fragments:
Time required for import = Number of fragments X 4 hours (approx).
You must have the following permissions:
Life cycle policy related permissions:
s3:PutLifecycleConfiguration
s3:GetLifecycleConfiguration
Object tagging permissions
s3:PutObjectTagging
Note:
The bucket owner has these permissions, by default. The bucket owner can grant these permissions to others by writing an access policy.
Also ensure that you also have the required IAM USER permissions. See Permissions required for Amazon IAM user.
More Information