--- title: "To back up and restore" url: "https://docs.yugabyte.com/stable/yugabyte-platform/prepare/cloud-permissions/cloud-permissions-storage/" --- # To back up and restore Prepare your cloud for backup and restore using YugabyteDB Anywhere. Prepare your cloud for backup and restore using YugabyteDB Anywhere When backing up to and/or restoring from external cloud storage, generally speaking, both YugabyteDB Anywhere (YBA) and database nodes require permissions to write to and read from the external storage. When backing up to an NFS storage target, only database nodes need access to the NFS storage. - [On-premises](#onprem) - [AWS](#aws) - [GCP](#gcp) - [Azure](#azure) - [OCI](#oci) When backing up to and/or restoring from NFS storage, the NFS storage system must be configured to allow the following access: - The `yugabyte` user (and its UID) on the database cluster nodes needs to have read and write permissions for the NFS volume. - The NFS volume must be mounted on the database cluster nodes. (This guidance is intentionally repeated in [Prepare Servers for On-Premises provider](/stable/yugabyte-platform/prepare/server-nodes-software/software-on-prem-manual/ "Prepare Servers for On-Premises provider"), where it may be more suitable for some readers.) When backing up to and/or restoring from AWS S3 or S3-compatible storage, YBA and DB nodes must be able to write to and read from the S3 storage bucket. To grant the required access, you can do one of the following: - Provide a service account with the following permissions. - Create the EC2 VM instances (for both the YBA VM and the DB nodes VMs) with an IAM role with the required permissions. The following permissions are required: ```properties "s3:DeleteObject", "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:ListAllMyBuckets", "s3:GetBucketLocation" ``` The Access key ID and Secret Access Key for the service account are used when creating a backup [storage configuration](/stable/yugabyte-platform/back-up-restore-universes/configure-backup-storage/#amazon-s3 "storage configuration") for S3. | Save for later | To configure | |-----------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------| | Service account Access key ID and Secret Access Key | [Storage configuration](/stable/yugabyte-platform/back-up-restore-universes/configure-backup-storage/#amazon-s3 "Storage configuration") for S3 | When backing up to and/or restoring from GCP GCS, YBA and database nodes must be able to write to and read from the GCS storage bucket. To grant the required access, you can do one of the following: - Provide a GCP service account with [IAM roles for cloud storage](https://cloud.google.com/storage/docs/access-control/iam-roles "IAM roles for cloud storage") with the required permissions. - Create the VM instances (for both the YBA VM and the DB nodes VMs) with an IAM role that has the required permissions. The following permissions are required: ```sh roles/storage.admin ``` The credentials for this account (in JSON format) are used when creating a backup [storage configuration](/stable/yugabyte-platform/back-up-restore-universes/configure-backup-storage/#google-cloud-storage "storage configuration") for GCS. | Save for later | To configure | |----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------| | Service account JSON credentials | [Storage configuration](/stable/yugabyte-platform/back-up-restore-universes/configure-backup-storage/#google-cloud-storage "Storage configuration") for GCS | When backing up to and/or restoring from Azure Storage, YBA and DB nodes must be able to write to and read from the storage blob. ##### Shared Access Signature To grant the required access, create a [Shared Access Signature (SAS)](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview "Shared Access Signature (SAS)") token with the permissions as shown in the following illustration. ![Azure Shared Access Signature page](/images/yp/cloud-provider-configuration-backup-azure-generate-token.png "Azure Shared Access Signature page") The Connection string and SAS token are used when creating a backup [storage configuration](/stable/yugabyte-platform/back-up-restore-universes/configure-backup-storage/#azure-storage "storage configuration") for Azure. ##### Azure Managed Identity [EA](/stable/releases/versioning/#feature-maturity) YugabyteDB Anywhere supports Azure Managed Identity (IAM) authentication for backup storage configurations, providing an alternative to SAS tokens. Note that this feature is currently supported only for VM-based universes and via API. This requires configuring the VMs for YugabyteDB Anywhere and universe nodes with either a Managed Identity or Service Principal. For more information, refer to [Azure Managed Identity authentication](/stable/yugabyte-platform/back-up-restore-universes/configure-backup-storage/#azure-managed-identity-authentication "Azure Managed Identity authentication"). | Save for later | To configure | |-----------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------| | Azure storage Connection string and SAS token | [Storage configuration](/stable/yugabyte-platform/back-up-restore-universes/configure-backup-storage/#azure-storage "Storage configuration") for Azure | When backing up to and/or restoring from OCI Object Storage, YBA and DB nodes must be able to write to and read from the storage bucket. You can grant access in either of the following ways: - **S3-compatible credentials.** Create a [Customer Secret Key](https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingcredentials.htm#create-secret-key "Customer Secret Key") for an OCI user that can manage objects in the bucket (OCI Console: **Identity > Users > Customer Secret Keys**). Provide the Access Key, Secret Key, and S3-compatible host base (`.compat.objectstorage..oraclecloud.com`) when creating the backup [storage configuration](/stable/yugabyte-platform/back-up-restore-universes/configure-backup-storage/#oracle-cloud-infrastructure "storage configuration"). - **OCI IAM (instance principal).** The YugabyteDB Anywhere host and all universe nodes must belong to a dynamic group with object-storage access. Attach a policy to that dynamic group. Do not use an API signing key (User OCID, fingerprint, and PEM) for storage; those credentials are for the [OCI provider](/stable/yugabyte-platform/configure-yugabyte-platform/oci/ "OCI provider") and [OCI KMS](/stable/yugabyte-platform/prepare/cloud-permissions/cloud-permissions-ear/ "OCI KMS"), not backup storage. The following permissions are required: ```properties Allow group yba-admins to manage object-family in compartment Allow group yba-admins to inspect buckets in compartment ``` When using instance principal, replace `group yba-admins` with `dynamic-group `. | Save for later | To configure | |-----------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------| | Access Key and Secret Key (S3-compatible) or instance principal | [Storage configuration](/stable/yugabyte-platform/back-up-restore-universes/configure-backup-storage/#oracle-cloud-infrastructure "Storage configuration") for OCI | | Object Storage namespace and region | | | Bucket name | |