Controlar o acesso ao console de gerenciamento do appliance com o IAM

Esta página descreve os papéis e as permissões do IAM necessários para Google Cloud o Backup e DR. Ao adicionar novos principais ao seu projeto, é possível usar uma política de gerenciamento de identidade e acesso (IAM) para conceder a esse principal um ou mais papéis do IAM. Cada papel do IAM contém permissões que concedem aos principais acesso para realizar ações específicas em recursos específicos. Para uma lista de referência das permissões de IAM que se aplicam ao Backup e DR, consulte Permissões do IAM para o Backup e DR.

Como o IAM controla o acesso

Se um principal (um usuário, grupo ou conta de serviço) chamar uma Google Cloud API, ele precisará ter as permissões apropriadas do IAM para usar o recurso. Para conceder as permissões necessárias a um principal, atribua um papel do IAM a ele. Saiba mais sobre os principais no IAM.

Tipos de papéis do IAM

O Backup e DR tem papéis predefinidos que são permissões agrupadas para serem atribuídas a diferentes princípios. Os usuários também podem definir papéis personalizados que podem ter uma combinação de permissões individuais para conceder acesso à execução de um fluxo de trabalho ou ação específica do Backup e DR.

Permissões do IAM

Com elas, os usuários podem realizar ações específicas em recursos específicos. Elas podem ser agrupadas para formar papéis. Cada permissão se refere a uma ação específica que o usuário pode realizar ou ao acesso que ele tem.

Permissões no nível do projeto e do recurso

As permissões podem ser concedidas no nível do projeto ou do recurso. Por exemplo, um administrador de Backup e DR pode optar por conceder apenas determinadas permissões no nível de um bucket do Cloud Storage em vez de todo o projeto, dependendo da política. A concessão de papéis no nível do recurso não afeta os papéis concedidos no nível do projeto e vice-versa.

Papéis predefinidos do IAM para o Backup e DR

O Backup e DR tem um conjunto de papéis predefinidos do IAM que são descritos nesta página. Também é possível criar papéis personalizados que contenham subconjuntos de permissões mapeadas diretamente para suas necessidades.

A tabela a seguir descreve papéis do IAM associados ao Backup e DR e lista as permissões que estão contidas em cada papel. A descrição de cada permissão está listada na seção Permissão do IAM para o Backup e DR.

Role	Permissions
Backup and DR Admin (roles/backupdr.admin) Provides full access to all Backup and DR resources.	backupdr.backupPlanAssociations.* backupdr.backupPlanAssociations.createForAlloydbCluster backupdr.backupPlanAssociations.createForCloudSqlInstance backupdr.backupPlanAssociations.createForComputeDisk backupdr.backupPlanAssociations.createForComputeInstance backupdr.backupPlanAssociations.createForFilestoreInstance backupdr.backupPlanAssociations.deleteForAlloydbCluster backupdr.backupPlanAssociations.deleteForCloudSqlInstance backupdr.backupPlanAssociations.deleteForComputeDisk backupdr.backupPlanAssociations.deleteForComputeInstance backupdr.backupPlanAssociations.deleteForFilestoreInstance backupdr.backupPlanAssociations.fetchForAlloydbCluster backupdr.backupPlanAssociations.fetchForCloudSqlInstance backupdr.backupPlanAssociations.fetchForComputeDisk backupdr.backupPlanAssociations.fetchForComputeInstance backupdr.backupPlanAssociations.fetchForFilestoreInstance backupdr.backupPlanAssociations.getForAlloydbCluster backupdr.backupPlanAssociations.getForCloudSqlInstance backupdr.backupPlanAssociations.getForComputeDisk backupdr.backupPlanAssociations.getForComputeInstance backupdr.backupPlanAssociations.getForFilestoreInstance backupdr.backupPlanAssociations.list backupdr.backupPlanAssociations.triggerBackupForAlloydbCluster backupdr.backupPlanAssociations.triggerBackupForCloudSqlInstance backupdr.backupPlanAssociations.triggerBackupForComputeDisk backupdr.backupPlanAssociations.triggerBackupForComputeInstance backupdr.backupPlanAssociations.triggerBackupForFilestoreInstance backupdr.backupPlanAssociations.updateForAlloydbCluster backupdr.backupPlanAssociations.updateForCloudSqlInstance backupdr.backupPlanAssociations.updateForComputeDisk backupdr.backupPlanAssociations.updateForComputeInstance backupdr.backupPlanAssociations.updateForFilestoreInstance backupdr.backupPlanRevisions.* backupdr.backupPlanRevisions.get backupdr.backupPlanRevisions.list backupdr.backupPlans.* backupdr.backupPlans.create backupdr.backupPlans.delete backupdr.backupPlans.get backupdr.backupPlans.list backupdr.backupPlans.update backupdr.backupPlans.useForAlloydbCluster backupdr.backupPlans.useForCloudSqlInstance backupdr.backupPlans.useForComputeDisk backupdr.backupPlans.useForComputeInstance backupdr.backupPlans.useForFilestoreInstance backupdr.backupVaults.* backupdr.backupVaults.associate backupdr.backupVaults.create backupdr.backupVaults.createTagBinding backupdr.backupVaults.delete backupdr.backupVaults.deleteTagBinding backupdr.backupVaults.get backupdr.backupVaults.list backupdr.backupVaults.listEffectiveTags backupdr.backupVaults.listTagBindings backupdr.backupVaults.update backupdr.bvbackups.* backupdr.bvbackups.delete backupdr.bvbackups.fetchForCloudSqlInstance backupdr.bvbackups.fetchForComputeDisk backupdr.bvbackups.fetchForComputeInstance backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvbackups.restore backupdr.bvbackups.update backupdr.bvbackups.useReadOnlyForAlloydbCluster backupdr.bvbackups.useReadOnlyForCloudSqlInstance backupdr.bvbackups.useReadOnlyForFilestoreInstance backupdr.bvdataSources.* backupdr.bvdataSources.abandonBackup backupdr.bvdataSources.fetchAccessToken backupdr.bvdataSources.finalizeBackup backupdr.bvdataSources.get backupdr.bvdataSources.initiateBackup backupdr.bvdataSources.list backupdr.bvdataSources.remove backupdr.bvdataSources.setInternalStatus backupdr.bvdataSources.update backupdr.bvdataSources.useReadOnlyForAlloydbCluster backupdr.bvdataSources.useReadOnlyForCloudSqlInstance backupdr.compute.restoreFromBackupVault backupdr.dataSourceReferences.* backupdr.dataSourceReferences.fetchForAlloydbCluster backupdr.dataSourceReferences.fetchForCloudSqlInstance backupdr.dataSourceReferences.fetchForFilestoreInstance backupdr.dataSourceReferences.getForAlloydbCluster backupdr.dataSourceReferences.getForCloudSqlInstance backupdr.dataSourceReferences.getForFilestoreInstance backupdr.dataSourceReferences.list backupdr.locations.* backupdr.locations.get backupdr.locations.list backupdr.managementServers.* backupdr.managementServers.access backupdr.managementServers.accessSensitiveData backupdr.managementServers.assignBackupPlans backupdr.managementServers.backupAccess backupdr.managementServers.create backupdr.managementServers.createConnection backupdr.managementServers.createDynamicProtection backupdr.managementServers.createTagBinding backupdr.managementServers.delete backupdr.managementServers.deleteDynamicProtection backupdr.managementServers.deleteTagBinding backupdr.managementServers.get backupdr.managementServers.getDynamicProtection backupdr.managementServers.getIamPolicy backupdr.managementServers.list backupdr.managementServers.listDynamicProtection backupdr.managementServers.listEffectiveTags backupdr.managementServers.listTagBindings backupdr.managementServers.manageApplications backupdr.managementServers.manageBackupPlans backupdr.managementServers.manageBackupServers backupdr.managementServers.manageBackups backupdr.managementServers.manageClones backupdr.managementServers.manageExpiration backupdr.managementServers.manageHosts backupdr.managementServers.manageInternalACL backupdr.managementServers.manageJobs backupdr.managementServers.manageLiveClones backupdr.managementServers.manageMigrations backupdr.managementServers.manageMirroring backupdr.managementServers.manageMounts backupdr.managementServers.manageRestores backupdr.managementServers.manageSensitiveData backupdr.managementServers.manageStorage backupdr.managementServers.manageSystem backupdr.managementServers.manageWorkflows backupdr.managementServers.refreshWorkflows backupdr.managementServers.runWorkflows backupdr.managementServers.setIamPolicy backupdr.managementServers.testFailOvers backupdr.managementServers.viewBackupPlans backupdr.managementServers.viewBackupServers backupdr.managementServers.viewReports backupdr.managementServers.viewStorage backupdr.managementServers.viewSystem backupdr.managementServers.viewWorkflows backupdr.operations.* backupdr.operations.cancel backupdr.operations.delete backupdr.operations.get backupdr.operations.list backupdr.serviceConfig.initialize backupdr.trial.* backupdr.trial.end backupdr.trial.get backupdr.trial.subscribe cloudkms.keyHandles.* cloudkms.keyHandles.create cloudkms.keyHandles.get cloudkms.keyHandles.list cloudkms.operations.get cloudkms.projects.showEffectiveAutokeyConfig resourcemanager.projects.get resourcemanager.projects.list
Backupdr Editor (roles/backupdr.editor) Editor role for backupdr	backupdr.backupPlanAssociations.* backupdr.backupPlanAssociations.createForAlloydbCluster backupdr.backupPlanAssociations.createForCloudSqlInstance backupdr.backupPlanAssociations.createForComputeDisk backupdr.backupPlanAssociations.createForComputeInstance backupdr.backupPlanAssociations.createForFilestoreInstance backupdr.backupPlanAssociations.deleteForAlloydbCluster backupdr.backupPlanAssociations.deleteForCloudSqlInstance backupdr.backupPlanAssociations.deleteForComputeDisk backupdr.backupPlanAssociations.deleteForComputeInstance backupdr.backupPlanAssociations.deleteForFilestoreInstance backupdr.backupPlanAssociations.fetchForAlloydbCluster backupdr.backupPlanAssociations.fetchForCloudSqlInstance backupdr.backupPlanAssociations.fetchForComputeDisk backupdr.backupPlanAssociations.fetchForComputeInstance backupdr.backupPlanAssociations.fetchForFilestoreInstance backupdr.backupPlanAssociations.getForAlloydbCluster backupdr.backupPlanAssociations.getForCloudSqlInstance backupdr.backupPlanAssociations.getForComputeDisk backupdr.backupPlanAssociations.getForComputeInstance backupdr.backupPlanAssociations.getForFilestoreInstance backupdr.backupPlanAssociations.list backupdr.backupPlanAssociations.triggerBackupForAlloydbCluster backupdr.backupPlanAssociations.triggerBackupForCloudSqlInstance backupdr.backupPlanAssociations.triggerBackupForComputeDisk backupdr.backupPlanAssociations.triggerBackupForComputeInstance backupdr.backupPlanAssociations.triggerBackupForFilestoreInstance backupdr.backupPlanAssociations.updateForAlloydbCluster backupdr.backupPlanAssociations.updateForCloudSqlInstance backupdr.backupPlanAssociations.updateForComputeDisk backupdr.backupPlanAssociations.updateForComputeInstance backupdr.backupPlanAssociations.updateForFilestoreInstance backupdr.backupPlanRevisions.* backupdr.backupPlanRevisions.get backupdr.backupPlanRevisions.list backupdr.backupPlans.* backupdr.backupPlans.create backupdr.backupPlans.delete backupdr.backupPlans.get backupdr.backupPlans.list backupdr.backupPlans.update backupdr.backupPlans.useForAlloydbCluster backupdr.backupPlans.useForCloudSqlInstance backupdr.backupPlans.useForComputeDisk backupdr.backupPlans.useForComputeInstance backupdr.backupPlans.useForFilestoreInstance backupdr.backupVaults.associate backupdr.backupVaults.create backupdr.backupVaults.delete backupdr.backupVaults.get backupdr.backupVaults.list backupdr.backupVaults.listEffectiveTags backupdr.backupVaults.listTagBindings backupdr.backupVaults.update backupdr.bvbackups.* backupdr.bvbackups.delete backupdr.bvbackups.fetchForCloudSqlInstance backupdr.bvbackups.fetchForComputeDisk backupdr.bvbackups.fetchForComputeInstance backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvbackups.restore backupdr.bvbackups.update backupdr.bvbackups.useReadOnlyForAlloydbCluster backupdr.bvbackups.useReadOnlyForCloudSqlInstance backupdr.bvbackups.useReadOnlyForFilestoreInstance backupdr.bvdataSources.* backupdr.bvdataSources.abandonBackup backupdr.bvdataSources.fetchAccessToken backupdr.bvdataSources.finalizeBackup backupdr.bvdataSources.get backupdr.bvdataSources.initiateBackup backupdr.bvdataSources.list backupdr.bvdataSources.remove backupdr.bvdataSources.setInternalStatus backupdr.bvdataSources.update backupdr.bvdataSources.useReadOnlyForAlloydbCluster backupdr.bvdataSources.useReadOnlyForCloudSqlInstance backupdr.compute.restoreFromBackupVault backupdr.dataSourceReferences.* backupdr.dataSourceReferences.fetchForAlloydbCluster backupdr.dataSourceReferences.fetchForCloudSqlInstance backupdr.dataSourceReferences.fetchForFilestoreInstance backupdr.dataSourceReferences.getForAlloydbCluster backupdr.dataSourceReferences.getForCloudSqlInstance backupdr.dataSourceReferences.getForFilestoreInstance backupdr.dataSourceReferences.list backupdr.locations.* backupdr.locations.get backupdr.locations.list backupdr.managementServers.access backupdr.managementServers.accessSensitiveData backupdr.managementServers.assignBackupPlans backupdr.managementServers.backupAccess backupdr.managementServers.create backupdr.managementServers.createConnection backupdr.managementServers.createDynamicProtection backupdr.managementServers.delete backupdr.managementServers.deleteDynamicProtection backupdr.managementServers.get backupdr.managementServers.getDynamicProtection backupdr.managementServers.getIamPolicy backupdr.managementServers.list backupdr.managementServers.listDynamicProtection backupdr.managementServers.listEffectiveTags backupdr.managementServers.listTagBindings backupdr.managementServers.manageApplications backupdr.managementServers.manageBackupPlans backupdr.managementServers.manageBackupServers backupdr.managementServers.manageBackups backupdr.managementServers.manageClones backupdr.managementServers.manageExpiration backupdr.managementServers.manageHosts backupdr.managementServers.manageInternalACL backupdr.managementServers.manageJobs backupdr.managementServers.manageLiveClones backupdr.managementServers.manageMigrations backupdr.managementServers.manageMirroring backupdr.managementServers.manageMounts backupdr.managementServers.manageRestores backupdr.managementServers.manageStorage backupdr.managementServers.manageSystem backupdr.managementServers.manageWorkflows backupdr.managementServers.refreshWorkflows backupdr.managementServers.runWorkflows backupdr.managementServers.testFailOvers backupdr.managementServers.viewBackupPlans backupdr.managementServers.viewBackupServers backupdr.managementServers.viewReports backupdr.managementServers.viewStorage backupdr.managementServers.viewSystem backupdr.managementServers.viewWorkflows backupdr.operations.* backupdr.operations.cancel backupdr.operations.delete backupdr.operations.get backupdr.operations.list backupdr.serviceConfig.initialize backupdr.trial.* backupdr.trial.end backupdr.trial.get backupdr.trial.subscribe resourcemanager.projects.get resourcemanager.projects.list
Backup and DR Viewer (roles/backupdr.viewer) Provides read-only access to all Backup and DR resources.	backupdr.backupPlanAssociations.fetchForAlloydbCluster backupdr.backupPlanAssociations.fetchForCloudSqlInstance backupdr.backupPlanAssociations.fetchForComputeDisk backupdr.backupPlanAssociations.fetchForComputeInstance backupdr.backupPlanAssociations.fetchForFilestoreInstance backupdr.backupPlanAssociations.getForAlloydbCluster backupdr.backupPlanAssociations.getForCloudSqlInstance backupdr.backupPlanAssociations.getForComputeDisk backupdr.backupPlanAssociations.getForComputeInstance backupdr.backupPlanAssociations.getForFilestoreInstance backupdr.backupPlanAssociations.list backupdr.backupPlanRevisions.* backupdr.backupPlanRevisions.get backupdr.backupPlanRevisions.list backupdr.backupPlans.get backupdr.backupPlans.list backupdr.backupVaults.get backupdr.backupVaults.list backupdr.backupVaults.listEffectiveTags backupdr.backupVaults.listTagBindings backupdr.bvbackups.fetchForCloudSqlInstance backupdr.bvbackups.fetchForComputeDisk backupdr.bvbackups.fetchForComputeInstance backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvdataSources.get backupdr.bvdataSources.list backupdr.dataSourceReferences.* backupdr.dataSourceReferences.fetchForAlloydbCluster backupdr.dataSourceReferences.fetchForCloudSqlInstance backupdr.dataSourceReferences.fetchForFilestoreInstance backupdr.dataSourceReferences.getForAlloydbCluster backupdr.dataSourceReferences.getForCloudSqlInstance backupdr.dataSourceReferences.getForFilestoreInstance backupdr.dataSourceReferences.list backupdr.locations.* backupdr.locations.get backupdr.locations.list backupdr.managementServers.access backupdr.managementServers.backupAccess backupdr.managementServers.get backupdr.managementServers.getDynamicProtection backupdr.managementServers.getIamPolicy backupdr.managementServers.list backupdr.managementServers.listDynamicProtection backupdr.managementServers.listEffectiveTags backupdr.managementServers.listTagBindings backupdr.managementServers.viewBackupPlans backupdr.managementServers.viewBackupServers backupdr.managementServers.viewReports backupdr.managementServers.viewStorage backupdr.managementServers.viewSystem backupdr.managementServers.viewWorkflows backupdr.operations.get backupdr.operations.list backupdr.trial.get resourcemanager.projects.get resourcemanager.projects.list
Backup and DR AlloyDB Operator (roles/backupdr.alloydbOperator) Allows a Backup and DR service account to discover and backup AlloyDB clusters.	alloydb.operations.get
Backup and DR Backup Config Viewer (roles/backupdr.backupConfigViewer) Provides read access to resource backup config. Resource backup config has the metadata of a Google Cloud resource that can be backed up, along with its backup configurations.	backupdr.locations.list backupdr.resourceBackupConfigs.* backupdr.resourceBackupConfigs.fetch backupdr.resourceBackupConfigs.get backupdr.resourceBackupConfigs.list
Backup and DR Backup User (roles/backupdr.backupUser) Allows the user to apply existing backup plans. This role cannot create backup plans or restore from a backup.	backupdr.backupPlanAssociations.* backupdr.backupPlanAssociations.createForAlloydbCluster backupdr.backupPlanAssociations.createForCloudSqlInstance backupdr.backupPlanAssociations.createForComputeDisk backupdr.backupPlanAssociations.createForComputeInstance backupdr.backupPlanAssociations.createForFilestoreInstance backupdr.backupPlanAssociations.deleteForAlloydbCluster backupdr.backupPlanAssociations.deleteForCloudSqlInstance backupdr.backupPlanAssociations.deleteForComputeDisk backupdr.backupPlanAssociations.deleteForComputeInstance backupdr.backupPlanAssociations.deleteForFilestoreInstance backupdr.backupPlanAssociations.fetchForAlloydbCluster backupdr.backupPlanAssociations.fetchForCloudSqlInstance backupdr.backupPlanAssociations.fetchForComputeDisk backupdr.backupPlanAssociations.fetchForComputeInstance backupdr.backupPlanAssociations.fetchForFilestoreInstance backupdr.backupPlanAssociations.getForAlloydbCluster backupdr.backupPlanAssociations.getForCloudSqlInstance backupdr.backupPlanAssociations.getForComputeDisk backupdr.backupPlanAssociations.getForComputeInstance backupdr.backupPlanAssociations.getForFilestoreInstance backupdr.backupPlanAssociations.list backupdr.backupPlanAssociations.triggerBackupForAlloydbCluster backupdr.backupPlanAssociations.triggerBackupForCloudSqlInstance backupdr.backupPlanAssociations.triggerBackupForComputeDisk backupdr.backupPlanAssociations.triggerBackupForComputeInstance backupdr.backupPlanAssociations.triggerBackupForFilestoreInstance backupdr.backupPlanAssociations.updateForAlloydbCluster backupdr.backupPlanAssociations.updateForCloudSqlInstance backupdr.backupPlanAssociations.updateForComputeDisk backupdr.backupPlanAssociations.updateForComputeInstance backupdr.backupPlanAssociations.updateForFilestoreInstance backupdr.backupPlanRevisions.* backupdr.backupPlanRevisions.get backupdr.backupPlanRevisions.list backupdr.backupPlans.get backupdr.backupPlans.list backupdr.backupPlans.useForAlloydbCluster backupdr.backupPlans.useForCloudSqlInstance backupdr.backupPlans.useForComputeDisk backupdr.backupPlans.useForComputeInstance backupdr.backupPlans.useForFilestoreInstance backupdr.backupVaults.get backupdr.backupVaults.list backupdr.bvbackups.fetchForCloudSqlInstance backupdr.bvbackups.fetchForComputeDisk backupdr.bvbackups.fetchForComputeInstance backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvdataSources.get backupdr.bvdataSources.list backupdr.dataSourceReferences.* backupdr.dataSourceReferences.fetchForAlloydbCluster backupdr.dataSourceReferences.fetchForCloudSqlInstance backupdr.dataSourceReferences.fetchForFilestoreInstance backupdr.dataSourceReferences.getForAlloydbCluster backupdr.dataSourceReferences.getForCloudSqlInstance backupdr.dataSourceReferences.getForFilestoreInstance backupdr.dataSourceReferences.list backupdr.locations.* backupdr.locations.get backupdr.locations.list backupdr.managementServers.access backupdr.managementServers.assignBackupPlans backupdr.managementServers.createDynamicProtection backupdr.managementServers.deleteDynamicProtection backupdr.managementServers.get backupdr.managementServers.getDynamicProtection backupdr.managementServers.list backupdr.managementServers.listDynamicProtection backupdr.managementServers.listEffectiveTags backupdr.managementServers.listTagBindings backupdr.managementServers.manageApplications backupdr.managementServers.manageBackups backupdr.managementServers.manageHosts backupdr.managementServers.viewBackupPlans backupdr.managementServers.viewReports backupdr.managementServers.viewStorage backupdr.managementServers.viewSystem backupdr.operations.get backupdr.operations.list resourcemanager.projects.get resourcemanager.projects.list
Backup and DR Backup Vault Accessor (roles/backupdr.backupvaultAccessor) Allows the Backup Appliance permissions to create and manage backups in a backup vault.	backupdr.backupVaults.get backupdr.backupVaults.list backupdr.bvbackups.delete backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvbackups.update backupdr.bvdataSources.abandonBackup backupdr.bvdataSources.fetchAccessToken backupdr.bvdataSources.finalizeBackup backupdr.bvdataSources.get backupdr.bvdataSources.initiateBackup backupdr.bvdataSources.list backupdr.bvdataSources.remove backupdr.bvdataSources.setInternalStatus backupdr.bvdataSources.update backupdr.operations.* backupdr.operations.cancel backupdr.operations.delete backupdr.operations.get backupdr.operations.list
Backup and DR Backup Vault Admin (roles/backupdr.backupvaultAdmin) Allows the Backup Appliance full administrative control of backup vault resources.	backupdr.backupVaults.* backupdr.backupVaults.associate backupdr.backupVaults.create backupdr.backupVaults.createTagBinding backupdr.backupVaults.delete backupdr.backupVaults.deleteTagBinding backupdr.backupVaults.get backupdr.backupVaults.list backupdr.backupVaults.listEffectiveTags backupdr.backupVaults.listTagBindings backupdr.backupVaults.update backupdr.bvbackups.delete backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvbackups.restore backupdr.bvbackups.update backupdr.bvdataSources.get backupdr.bvdataSources.list backupdr.bvdataSources.update backupdr.compute.restoreFromBackupVault backupdr.locations.* backupdr.locations.get backupdr.locations.list backupdr.operations.* backupdr.operations.cancel backupdr.operations.delete backupdr.operations.get backupdr.operations.list
Backup and DR Backup Vault Lister (roles/backupdr.backupvaultLister) Allows the Backup Appliance permission to list backup vaults in a given project.	backupdr.backupVaults.list
Backup and DR Backup Vault Viewer (roles/backupdr.backupvaultViewer) Allows read-only permissions to access backup vault resources and backups.	backupdr.backupVaults.get backupdr.backupVaults.list backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvdataSources.get backupdr.bvdataSources.list backupdr.operations.get backupdr.operations.list
Backup and DR Cloud SQL Operator (roles/backupdr.cloudSqlOperator) Allows a Backup and DR service account to discover and backup Cloud SQL instances.	cloudsql.instances.createBackupDrBackup cloudsql.instances.get
Backup and DR Cloud Storage Operator (roles/backupdr.cloudStorageOperator) Allows a Backup and DR service account to store and manage data (backups or metadata) in Cloud Storage.	storage.buckets.create storage.buckets.get storage.objects.create storage.objects.delete storage.objects.get storage.objects.list
Backup and DR Compute Engine Operator (roles/backupdr.computeEngineOperator) Allows a Backup and DR service account to discover, back up, and restore Compute Engine VM instances.	backupdr.managementServers.createConnection compute.addresses.list compute.addresses.use compute.addresses.useInternal compute.diskTypes.* compute.diskTypes.get compute.diskTypes.list compute.disks.create compute.disks.createSnapshot compute.disks.delete compute.disks.get compute.disks.list compute.disks.setLabels compute.disks.use compute.disks.useReadOnly compute.firewalls.list compute.globalOperations.get compute.images.create compute.images.delete compute.images.get compute.images.useReadOnly compute.instances.attachDisk compute.instances.create compute.instances.createTagBinding compute.instances.delete compute.instances.detachDisk compute.instances.get compute.instances.list compute.instances.listEffectiveTags compute.instances.pscInterfaceCreate compute.instances.setDeletionProtection compute.instances.setLabels compute.instances.setMetadata compute.instances.setServiceAccount compute.instances.setTags compute.instances.start compute.instances.stop compute.instances.updateDisplayDevice compute.instances.useReadOnly compute.machineTypes.* compute.machineTypes.get compute.machineTypes.list compute.networks.list compute.nodeGroups.get compute.nodeGroups.list compute.nodeTemplates.get compute.projects.get compute.regionOperations.get compute.regions.* compute.regions.get compute.regions.list compute.resourcePolicies.use compute.snapshots.create compute.snapshots.delete compute.snapshots.get compute.snapshots.setLabels compute.snapshots.useReadOnly compute.subnetworks.list compute.subnetworks.use compute.subnetworks.useExternalIp compute.zoneOperations.get compute.zones.list iam.serviceAccounts.actAs iam.serviceAccounts.get iam.serviceAccounts.list resourcemanager.projects.get resourcemanager.projects.list
Backup and DR Disk Operator (roles/backupdr.diskOperator) Allows a Backup and DR service account to store and manage data (backups or metadata) in Disk.	compute.disks.create compute.disks.createSnapshot compute.disks.createTagBinding compute.disks.get compute.disks.list compute.disks.setLabels compute.disks.useReadOnly compute.regionOperations.get compute.resourcePolicies.use compute.snapshots.setLabels compute.snapshots.useReadOnly compute.storagePools.use compute.zoneOperations.get
Backup and DR Filestore Operator ^Beta (roles/backupdr.filestoreOperator) Allows a Backup and DR service account to discover and backup Filestore instances.	file.backups.create file.instances.createCrossProjectBackup file.instances.get
Backup and DR Management Server Accessor (roles/backupdr.managementServerAccessor) Grants the Backup and DR management server access role to Backup Appliances.	backupdr.managementServers.createConnection
Backup and DR Mount User (roles/backupdr.mountUser) Allows the user to mount from a backup. This role cannot create a backup plan or restore from a backup.	backupdr.locations.* backupdr.locations.get backupdr.locations.list backupdr.managementServers.access backupdr.managementServers.get backupdr.managementServers.getDynamicProtection backupdr.managementServers.list backupdr.managementServers.listDynamicProtection backupdr.managementServers.listEffectiveTags backupdr.managementServers.listTagBindings backupdr.managementServers.manageApplications backupdr.managementServers.manageClones backupdr.managementServers.manageHosts backupdr.managementServers.manageLiveClones backupdr.managementServers.manageMirroring backupdr.managementServers.manageMounts backupdr.managementServers.manageWorkflows backupdr.managementServers.refreshWorkflows backupdr.managementServers.runWorkflows backupdr.managementServers.viewBackupPlans backupdr.managementServers.viewReports backupdr.managementServers.viewStorage backupdr.managementServers.viewSystem backupdr.managementServers.viewWorkflows backupdr.operations.get backupdr.operations.list resourcemanager.projects.get resourcemanager.projects.list
Backup and DR Restore User (roles/backupdr.restoreUser) Allows the user to restore or mount from a backup. This role cannot create a backup plan.	backupdr.backupVaults.get backupdr.backupVaults.list backupdr.bvbackups.fetchForCloudSqlInstance backupdr.bvbackups.fetchForComputeDisk backupdr.bvbackups.fetchForComputeInstance backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvbackups.restore backupdr.bvbackups.useReadOnlyForAlloydbCluster backupdr.bvbackups.useReadOnlyForCloudSqlInstance backupdr.bvbackups.useReadOnlyForFilestoreInstance backupdr.bvdataSources.get backupdr.bvdataSources.list backupdr.bvdataSources.useReadOnlyForAlloydbCluster backupdr.bvdataSources.useReadOnlyForCloudSqlInstance backupdr.compute.restoreFromBackupVault backupdr.dataSourceReferences.* backupdr.dataSourceReferences.fetchForAlloydbCluster backupdr.dataSourceReferences.fetchForCloudSqlInstance backupdr.dataSourceReferences.fetchForFilestoreInstance backupdr.dataSourceReferences.getForAlloydbCluster backupdr.dataSourceReferences.getForCloudSqlInstance backupdr.dataSourceReferences.getForFilestoreInstance backupdr.dataSourceReferences.list backupdr.locations.* backupdr.locations.get backupdr.locations.list backupdr.managementServers.access backupdr.managementServers.get backupdr.managementServers.getDynamicProtection backupdr.managementServers.list backupdr.managementServers.listDynamicProtection backupdr.managementServers.listEffectiveTags backupdr.managementServers.listTagBindings backupdr.managementServers.manageApplications backupdr.managementServers.manageClones backupdr.managementServers.manageHosts backupdr.managementServers.manageLiveClones backupdr.managementServers.manageMigrations backupdr.managementServers.manageMirroring backupdr.managementServers.manageMounts backupdr.managementServers.manageRestores backupdr.managementServers.manageWorkflows backupdr.managementServers.refreshWorkflows backupdr.managementServers.runWorkflows backupdr.managementServers.testFailOvers backupdr.managementServers.viewBackupPlans backupdr.managementServers.viewReports backupdr.managementServers.viewStorage backupdr.managementServers.viewSystem backupdr.managementServers.viewWorkflows backupdr.operations.get backupdr.operations.list resourcemanager.projects.get resourcemanager.projects.list
Backup and DR User (roles/backupdr.user) Provides access to management console. Granular Backup and DR permissions depend on ACL configuration provided by Backup and DR admin within the management console.	backupdr.backupPlanAssociations.createForComputeInstance backupdr.backupPlanAssociations.deleteForComputeInstance backupdr.backupPlanAssociations.updateForComputeInstance backupdr.managementServers.access backupdr.managementServers.backupAccess backupdr.managementServers.get backupdr.managementServers.getDynamicProtection backupdr.managementServers.getIamPolicy backupdr.managementServers.list backupdr.managementServers.listDynamicProtection backupdr.managementServers.listEffectiveTags backupdr.managementServers.listTagBindings backupdr.managementServers.viewBackupPlans backupdr.managementServers.viewBackupServers backupdr.managementServers.viewReports backupdr.managementServers.viewStorage backupdr.managementServers.viewSystem backupdr.managementServers.viewWorkflows backupdr.operations.get backupdr.operations.list backupdr.trial.get resourcemanager.projects.get resourcemanager.projects.list
Backup and DR User V2 (roles/backupdr.userv2) Provides full access to Backup and DR resources except deploying and managing backup infrastructure, expiring backups, changing data sensitivity and configuring on-premises billing.	backupdr.backupPlanAssociations.* backupdr.backupPlanAssociations.createForAlloydbCluster backupdr.backupPlanAssociations.createForCloudSqlInstance backupdr.backupPlanAssociations.createForComputeDisk backupdr.backupPlanAssociations.createForComputeInstance backupdr.backupPlanAssociations.createForFilestoreInstance backupdr.backupPlanAssociations.deleteForAlloydbCluster backupdr.backupPlanAssociations.deleteForCloudSqlInstance backupdr.backupPlanAssociations.deleteForComputeDisk backupdr.backupPlanAssociations.deleteForComputeInstance backupdr.backupPlanAssociations.deleteForFilestoreInstance backupdr.backupPlanAssociations.fetchForAlloydbCluster backupdr.backupPlanAssociations.fetchForCloudSqlInstance backupdr.backupPlanAssociations.fetchForComputeDisk backupdr.backupPlanAssociations.fetchForComputeInstance backupdr.backupPlanAssociations.fetchForFilestoreInstance backupdr.backupPlanAssociations.getForAlloydbCluster backupdr.backupPlanAssociations.getForCloudSqlInstance backupdr.backupPlanAssociations.getForComputeDisk backupdr.backupPlanAssociations.getForComputeInstance backupdr.backupPlanAssociations.getForFilestoreInstance backupdr.backupPlanAssociations.list backupdr.backupPlanAssociations.triggerBackupForAlloydbCluster backupdr.backupPlanAssociations.triggerBackupForCloudSqlInstance backupdr.backupPlanAssociations.triggerBackupForComputeDisk backupdr.backupPlanAssociations.triggerBackupForComputeInstance backupdr.backupPlanAssociations.triggerBackupForFilestoreInstance backupdr.backupPlanAssociations.updateForAlloydbCluster backupdr.backupPlanAssociations.updateForCloudSqlInstance backupdr.backupPlanAssociations.updateForComputeDisk backupdr.backupPlanAssociations.updateForComputeInstance backupdr.backupPlanAssociations.updateForFilestoreInstance backupdr.backupPlanRevisions.* backupdr.backupPlanRevisions.get backupdr.backupPlanRevisions.list backupdr.backupPlans.* backupdr.backupPlans.create backupdr.backupPlans.delete backupdr.backupPlans.get backupdr.backupPlans.list backupdr.backupPlans.update backupdr.backupPlans.useForAlloydbCluster backupdr.backupPlans.useForCloudSqlInstance backupdr.backupPlans.useForComputeDisk backupdr.backupPlans.useForComputeInstance backupdr.backupPlans.useForFilestoreInstance backupdr.backupVaults.associate backupdr.backupVaults.get backupdr.backupVaults.list backupdr.backupVaults.listEffectiveTags backupdr.backupVaults.listTagBindings backupdr.bvbackups.fetchForCloudSqlInstance backupdr.bvbackups.fetchForComputeDisk backupdr.bvbackups.fetchForComputeInstance backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvbackups.restore backupdr.bvbackups.useReadOnlyForAlloydbCluster backupdr.bvbackups.useReadOnlyForCloudSqlInstance backupdr.bvbackups.useReadOnlyForFilestoreInstance backupdr.bvdataSources.get backupdr.bvdataSources.list backupdr.bvdataSources.useReadOnlyForAlloydbCluster backupdr.bvdataSources.useReadOnlyForCloudSqlInstance backupdr.compute.restoreFromBackupVault backupdr.dataSourceReferences.* backupdr.dataSourceReferences.fetchForAlloydbCluster backupdr.dataSourceReferences.fetchForCloudSqlInstance backupdr.dataSourceReferences.fetchForFilestoreInstance backupdr.dataSourceReferences.getForAlloydbCluster backupdr.dataSourceReferences.getForCloudSqlInstance backupdr.dataSourceReferences.getForFilestoreInstance backupdr.dataSourceReferences.list backupdr.locations.* backupdr.locations.get backupdr.locations.list backupdr.managementServers.access backupdr.managementServers.assignBackupPlans backupdr.managementServers.backupAccess backupdr.managementServers.createDynamicProtection backupdr.managementServers.deleteDynamicProtection backupdr.managementServers.get backupdr.managementServers.getDynamicProtection backupdr.managementServers.getIamPolicy backupdr.managementServers.list backupdr.managementServers.listDynamicProtection backupdr.managementServers.listEffectiveTags backupdr.managementServers.listTagBindings backupdr.managementServers.manageApplications backupdr.managementServers.manageBackupPlans backupdr.managementServers.manageBackups backupdr.managementServers.manageClones backupdr.managementServers.manageHosts backupdr.managementServers.manageJobs backupdr.managementServers.manageLiveClones backupdr.managementServers.manageMigrations backupdr.managementServers.manageMirroring backupdr.managementServers.manageMounts backupdr.managementServers.manageRestores backupdr.managementServers.manageWorkflows backupdr.managementServers.refreshWorkflows backupdr.managementServers.runWorkflows backupdr.managementServers.testFailOvers backupdr.managementServers.viewBackupPlans backupdr.managementServers.viewBackupServers backupdr.managementServers.viewReports backupdr.managementServers.viewStorage backupdr.managementServers.viewSystem backupdr.managementServers.viewWorkflows backupdr.operations.get backupdr.operations.list backupdr.trial.get resourcemanager.projects.get resourcemanager.projects.list

Service agent roles

Service agent roles should only be granted to service agents.

Role

Permissions

Backup and DR Service Agent (roles/backupdr.serviceAgent) Grants the Backup and DR Service access to protect Compute Engine instances. Warning: Do not grant service agent roles to any principals except service agents.

alloydb.operations.get backupdr.backupPlanAssociations.createForComputeDisk backupdr.backupPlanAssociations.createForComputeInstance backupdr.backupPlanAssociations.deleteForComputeDisk backupdr.backupPlanAssociations.deleteForComputeInstance backupdr.backupPlanAssociations.updateForComputeDisk backupdr.backupPlanAssociations.updateForComputeInstance backupdr.operations.get cloudsql.instances.createBackupDrBackup cloudsql.instances.get compute.addresses.list compute.addresses.use compute.addresses.useInternal compute.diskTypes.* compute.diskTypes.get compute.diskTypes.list compute.disks.create compute.disks.createSnapshot compute.disks.createTagBinding compute.disks.delete compute.disks.get compute.disks.list compute.disks.setLabels compute.disks.use compute.disks.useReadOnly compute.firewalls.list compute.globalOperations.get compute.images.create compute.images.delete compute.images.get compute.images.useReadOnly compute.instances.attachDisk compute.instances.create compute.instances.createTagBinding compute.instances.delete compute.instances.detachDisk compute.instances.get compute.instances.list compute.instances.listEffectiveTags compute.instances.pscInterfaceCreate compute.instances.setDeletionProtection compute.instances.setLabels compute.instances.setMetadata compute.instances.setServiceAccount compute.instances.setTags compute.instances.start compute.instances.stop compute.instances.updateDisplayDevice compute.instances.useReadOnly compute.machineTypes.* compute.machineTypes.get compute.machineTypes.list compute.networks.list compute.nodeGroups.get compute.nodeGroups.list compute.nodeTemplates.get compute.projects.get compute.regionOperations.get compute.regions.* compute.regions.get compute.regions.list compute.resourcePolicies.use compute.snapshots.create compute.snapshots.delete compute.snapshots.get compute.snapshots.setLabels compute.snapshots.useReadOnly compute.storagePools.use compute.subnetworks.list compute.subnetworks.use compute.subnetworks.useExternalIp compute.zoneOperations.get compute.zones.list file.backups.create file.instances.createCrossProjectBackup file.instances.get file.operations.get iam.serviceAccounts.actAs iam.serviceAccounts.get iam.serviceAccounts.list netapp.operations.get netapp.volumes.createCrossProjectBackup netapp.volumes.get resourcemanager.projects.get resourcemanager.projects.list

Papéis básicos

Papéis básicos são aqueles para envolvidos no projeto que antecedem o IAM. Consulte Papéis básicos para mais detalhes.

Embora o Backup e DR seja compatível com os papéis básicos a seguir, use um dos papéis predefinidos sempre que possível. Os papéis básicos incluem permissões amplas que se aplicam a todos os seus Google Cloud recursos. Por outro lado, os papéis predefinidos do Backup e DR incluem permissões refinadas que se aplicam somente ao Backup e DR.

Papel do IAM básico	Descrição
Editor (roles/editor)	Dá acesso total a todos os recursos de Backup e DR.
Proprietário (roles/owner)	Dá acesso total a todos os recursos de Backup e DR.

Permissões do IAM para o Backup e DR

A tabela a seguir lista as permissões do IAM associadas ao Backup e DR. As permissões do IAM são agrupadas em papéis, e você atribui papéis a usuários e grupos.

A tabela a seguir lista a descrição de cada permissão do Backup e DR.

Nome da permissão	Descrição
backupdr.managementServers.manageClones	Concede permissões para criar e gerenciar clones de backups.
backupdr.managementServers.manageLiveClones	Concede permissões para criar e gerenciar LiveClones de backups.
backupdr.managementServers.manageMounts	Concede permissões para criar e gerenciar montagens ativas de backups.
backupdr.managementServers.manageRestores	Concede as permissões necessárias para restaurar de backups.
backupdr.managementServers.manageBackups	Concede permissões para realizar operações de backup: Backup agora.
backupdr.managementServers.viewSystem	Concede acesso para visualizar a configuração do dispositivo de backup/recuperação.
backupdr.managementServers.manageSystem	Concede permissões para configurar dispositivos de backup/recuperação e o gerenciador de relatórios.
backupdr.managementServers.viewStorage	Concede acesso para visualizar configurações de armazenamento e pool de discos.
backupdr.managementServers.manageStorage	Concede permissões para adicionar, modificar, remover e visualizar armazenamento e pools de discos.
backupdr.managementServers.viewBackupPlans	Concede acesso para visualizar planos de backup: modelos de backup e perfis de recursos.
backupdr.managementServers.assignBackupPlans	Concede permissões para atribuir planos de backup pré-configurados (modelos de backup e perfis de recursos) a aplicativos ou cargas de trabalho.
backupdr.managementServers.manageBackupPlans	Concede permissões para criar, modificar, excluir, visualizar e atribuir planos de backup: modelos de backup e perfis de recursos.
backupdr.managementServers.testFailOvers	Concede permissões para realizar testes de failover e excluir operações de teste de failover em um backup remoto do StreamSnap.
backupdr.managementServers.viewWorkflows	Concede acesso para visualizar fluxos de trabalho de backup e DR que automatizam o acesso para copiar dados no Backup e DR.
backupdr.managementServers.runWorkflows	Concede permissões para executar um fluxo de trabalho pré-configurado de backup e DR que automatiza o acesso para copiar dados no Backup e DR.
backupdr.managementServers.refreshWorkflows	Concede permissões para atualizar um clone criado por um fluxo de trabalho de backup e DR que automatiza o acesso para copiar dados no Backup e DR.
backupdr.managementServers.manageWorkflows	Concede permissões para adicionar, modificar, remover, executar e visualizar fluxos de trabalho de backup e DR que automatizam o acesso para copiar dados no Backup e DR.
backupdr.managementServers.manageMirroring	Concede permissões para realizar operações de failover, syncback, limpeza, failback, teste de failover e exclusão de teste de failover em um backup remoto do StreamSnap.
backupdr.managementServers.manageHosts	Concede permissões para adicionar, modificar, remover e visualizar hosts (máquinas físicas e virtuais).
backupdr.managementServers.manageApplications	Concede permissões para gerenciar todos os aspectos dos aplicativos, incluindo grupos lógicos e de consistência, executar backups sob demanda e exportar modelos.
backupdr.managementServers.manageSensitiveData	Concede as permissões necessárias para marcar aplicativos e backups como dados sensíveis ou não sensíveis.
backupdr.managementServers.accessSensitiveData	Concede acesso a aplicativos e backups marcados como sensíveis.
Concede as permissões necessárias para executar APIs do servidor de backup pelo console de gerenciamento do dispositivo.
backupdr.managementServers.manageExpiration	Concede as permissões necessárias para expirar backups.
Concede acesso ao console de gerenciamento do dispositivo e às APIs associadas.
backupdr.managementServers.onpremUsageUpload	Concede acesso a todos os endpoints necessários para fazer upload do uso para um adaptador on-premise.
backupdr.managementServers.viewReports	Concede acesso ao gerenciador de relatórios para executar relatórios e visualizar ou fazer o download da saída.
backupdr.managementServers.manageJobs	Concede permissões para cancelar jobs e modificar a prioridade deles.
backupdr.managementServers.manageMigrations	Concede permissões para gerenciar a migração de dados montados como uma etapa final em uma operação de restauração ou clonagem.

Permissões necessárias para usar a CMEK

Para informações sobre as permissões necessárias para usar a CMEK, consulte Chaves de criptografia gerenciadas pelo cliente (CMEK).