About MSDP cloud immutable (WORM) storage support
From NetBackup 9.1 release, we support cloud immutable (WORM) storage. Currently, we only support Amazon S3 WORM storage with S3 Object Lock. For more information about Amazon S3 Object Lock, see https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html.
Cloud administrator and Backup administrator need specific permissions to configure and use immutable storage. Cloud administrators need a set of permissions to manage the bucket and cloud volume in the cloud and backup administrators need permissions to manage backup data.
See AWS user permissions to create the cloud immutable volume.
Backup images can be locked in one of the following two retention modes:
Compliance mode
Users cannot overwrite or delete the data that is protected using the compliance mode for the defined retention period. Once you set a retention period for the data storage, you can extend it but cannot shorten it.
Governance mode (also known as enterprise mode)
Users require special permissions to disable the retention lock and then delete the image. Only the cloud administrator user can disable the retention lock and then the delete the image if required. You can use the governance mode to test the retention period behavior before you use compliance mode.
You can use Cloud immutable volume management tool to manage immutable cloud volume.
See About MSDP cloud admin command-line tool.
Immutable Cloud Volume (Cloud LSU) is a cloud volume with the following differences than normal cloud volumes:
The bucket is Object Lock enabled. It is created with the tool
msdpcldutil.The bucket policy is attached to the bucket to protect metadata objects of immutable cloud volume.
A retention range is defined for the cloud volume. The retention of any backup images must be in this range. NetBackup checks this condition when the backup policy is created. This range can be defined and changed with
msdpcldutil,The cloud volume has a live period which defines its lifetime. It provides a safety net so that the retention period of all data in it is restricted in the lifetime of cloud volume. When this live period expires, the volume will be down. You can use
msdpcldutilto extend the live period when the volume does not expire or resurrect the volume when it expires.