About protecting data in Amazon Glacier vault
To protect your data for long-term retention with Amazon vault lock policy, you can back up the data to a vault in Amazon Glacier using NetBackup.
When you create a storage class using NetBackup, you specify a vault name and a region in which you want to create the vault.
You can use the Amazon vault lock policy to enforce compliance control on the vault or to make the vault a Write-Once-Read-Many (WORM) device. See the Amazon documentation for more information.
To configure a cloud storage server for GLACIER_VAULT storage class
- Configure the Amazon GLACIER vault cloud storage server.
See Configuring a storage server for cloud storage.
Note:
Each storage server is associated with only one region.
- Create a disk pool using the Amazon bucket for GLACIER storage.
See Configuring a disk pool for cloud storage.
Note:
If you cannot see the desired vault, it means either the vault does not have an S3 bucket in the same region as the vault region or the vault does not exist in the region corresponding to the storage server for which you are creating the disk pool.
- Use the Amazon console to create a vault lock policy. See the Amazon documentation for more information.
- Create a backup policy.
When you configure a storage server to backup data to a vault in Amazon Glacier, consider the following:
If you have configured immutable vault lock policy to deny the deletion of archives, Amazon Glacier vault does not allow deletion of archives till the archives are unlocked for deletion. Hence, the retention period configured for a backup policy must be greater than the vault lock period by at least two weeks or the maximum time taken to backup or duplicate data to GLACIER_VAULT with retries in your environment. Else, the image cleanup job on image expiry will fail. See Handling image cleanup failures for Amazon Glacier vault.
It is recommended you use a vault as a secondary target for backing up data.
If you plan to use the vault lock policy, ensure you create a vault for each retention level you want to use for the vault.
Use compression and incremental backups to reduce the size of the data stored per backup.
Select True Image Recovery option wherever possible to reduce time and cost for image imports.
To retrieve data sent to Glacier, there is an inherent time delay of around four hours per fragment of the backup image. For phase 2 of image imports, this time delay is prevalent for image(s) in the Glacier storage. However, if you enable in the policy, time spent for phase 2 imports reduces drastically from four hours to a few minutes per fragment. Phase 1 imports are faster, irrespective of whether is enabled or not for the policy.
See the NetBackup Administrator's Guide, Volume I to know more about supported workloads and file systems for .
See the NetBackup Administrator's Guide, Volume I to know more about the phases during image imports.
Consider the following limitations:
NetBackup Accelerator feature is not supported for policies of the storage units that are created for GLACIER_VAULT. Do not select the check box.
with is not supported.
Glacier endpoint for the Amazon GovCloud cloud provider (that is ) supports only secure mode of communication using the NetBackup storage class. Therefore, if you disable the option while you configure the Amazon GovCloud cloud storage with storage class, the configuration fails.
You must have the following permissions:
glacier:ListVaults
glacier:CreateVault
glacier:DescribeVault
glacier:UploadArchive
glacier:DeleteArchive
glacier:ListJobs
glacier:Describejob
glacier:InitiateJob
glacier:GetJobOutput
Also, ensure you have the required S3 related IAM USER permissions. See Permissions required for Amazon S3 cloud provider user.
For issues related to permissions, See Troubleshooting failures due to missing Amazon IAM permissions.