To back up and restore

When backing up to and/or restoring from AWS S3, YBA and DB nodes must be able to write to and read from the S3 storage bucket.

To grant the required access, you can do one of the following:

• Provide a service account with the following permissions.
• Create the EC2 VM instances (for both the YBA VM and the DB nodes VMs) with an IAM role with the required permissions.

The following permissions are required:

"s3:DeleteObject",
"s3:PutObject",
"s3:GetObject",
"s3:ListBucket",
"s3:GetBucketLocation"

The Access key ID and Secret Access Key for the service account are used when creating a backup storage configuration for S3.

When backing up to and/or restoring from GCP GCS, YBA and database nodes must be able to write to and read from the GCS storage bucket.

To grant the required access, create a GCP service account with IAM roles for cloud storage with the following permissions:

roles/storage.admin

The credentials for this account (in JSON format) are used when creating a backup storage configuration for GCS.

For database clusters deployed to GKE, you can alternatively assign the appropriate IAM roles to the YugabyteDB Anywhere VM and the YugabyteDB nodes.

When backing up to and/or restoring from Azure Storage, YBA and DB nodes must be able to write to and read from the storage blob.

To grant the required access, create a Shared Access Signature (SAS) token with the permissions as shown in the following illustration.

The Connection string and SAS token are used when creating a backup storage configuration for Azure.