How to separate backup and recovery permissions - Cloud Backup

Cloud Backup lets you separate backup and recovery permissions. This improves the security of your data backups and helps you meet compliance requirements by preventing accidental operations or unauthorized access. This topic describes how to configure separate permissions for backup and recovery.

Background information

To prevent unauthorized or accidental operations, you can grant RAM permissions to a specific RAM user that limit their operations on the backup vault to only backup and recovery.

Separate backup and recovery permissions

Obtain the access policies that deny backup and recovery operations.

Log on to the Cloud Backup console.
In the navigation pane on the left, click Storage Vaults.
Find the target backup vault. In the Actions column, choose More > Modify Backup Vault.

In the RAM Permission Policy section of the Modify Backup Vault panel, find the policies that deny backup and recovery operations.

Policy to deny recovery/retrieval operations

Click the copy icon in the upper-left corner to copy the script. For example:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "hbr:CreateRestore",
                "hbr:CreateRestoreJob",
                "hbr:CreateHanaRestore",
                "hbr:CreateUniRestorePlan",
                "hbr:CreateSqlServerRestore"
            ],
            "Resource": [
                "acs:hbr:*:1178037424989531:vault/v-0000ryfi******piu",
                "acs:hbr:*:1178037424989531:vault/v-0000ryfi******piu/client/*"
            ]
        }
    ]
}

Note

v-0000ryfi******piu is the ID of the target backup vault.

Policy to deny backup/archive operations

Click the copy icon in the upper-left corner to copy the script. For example:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "hbr:CreateUniBackupPlan",
                "hbr:UpdateUniBackupPlan",
                "hbr:DeleteUniBackupPlan",
                "hbr:CreateHanaInstance",
                "hbr:UpdateHanaInstance",
                "hbr:DeleteHanaInstance",
                "hbr:CreateHanaBackupPlan",
                "hbr:UpdateHanaBackupPlan",
                "hbr:DeleteHanaBackupPlan",
                "hbr:CreateClient",
                "hbr:CreateClients",
                "hbr:UpdateClient",
                "hbr:UpdateClientSettings",
                "hbr:UpdateClientAlertConfig",
                "hbr:DeleteClient",
                "hbr:DeleteClients",
                "hbr:CreateJob",
                "hbr:UpdateJob",
                "hbr:CreateBackupPlan",
                "hbr:UpdateBackupPlan",
                "hbr:ExecuteBackupPlan",
                "hbr:DeleteBackupPlan",
                "hbr:CreateBackupJob",
                "hbr:CreatePlan",
                "hbr:UpdatePlan",
                "hbr:CreateTrialBackupPlan",
                "hbr:ConvertToPostPaidInstance",
                "hbr:KeepAfterTrialExpiration"
            ],
            "Resource": [
                "acs:hbr:*:1178037424989531:vault/v-0000ryfi******piu",
                "acs:hbr:*:1178037424989531:vault/v-0000ryfi******piu/client/*"
            ]
        }
    ]
}

Note

v-0000ryfi******piu is the ID of the target backup vault.

Log on to the RAM console and create custom policies.
For more information, see Create a custom policy.
Attach the custom policies that you created in Step 2 to different RAM users. This ensures that one RAM user is denied permission to perform backup operations, while the other is denied permission to perform recovery operations.