Add docs for required minimal permissions of the fdbbackup and backup_agent #11724
+29
−0
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Result of foundationdb-pr-clang on Linux CentOS 7
|
Result of foundationdb-pr on Linux CentOS 7
|
Result of foundationdb-pr-clang-ide on Linux CentOS 7
|
Result of foundationdb-pr-clang-arm on Linux CentOS 7
|
Result of foundationdb-pr-macos-m1 on macOS Ventura 13.x
|
Result of foundationdb-pr-macos on macOS Ventura 13.x
|
Result of foundationdb-pr-cluster-tests on Linux CentOS 7
|
jzhou77
reviewed
Oct 22, 2024
| s3:ListMultipartUploadParts | ||
|
|
||
| Note: If you want that the ``backup_agent`` or ``fdbbackup`` can create a bucket, you have to add the ``s3:CreateBucket`` permission. | ||
| If you want to encrypt the data at rest in S3 you have to make sure that S3 is properly configured and that the `backup_agent` and `fdbbackup` have access to [KMS] |
There was a problem hiding this comment.
Do you intend to add links to [KMS]?
saintstack
reviewed
Nov 14, 2024
| @@ -61,6 +61,35 @@ By default, the FoundationDB packages are configured to start a single ``backup_ | |||
|
|
|||
| If instead you want to perform a backup to the local disk of a particular machine or machines which are not network accessible to the FoundationDB servers, then you should disable the backup agents on the FoundationDB servers. This is accomplished by commenting out all of the ``[backup_agent.<ID>]`` sections in :ref:`foundationdb.conf <foundationdb-conf>`. Do not comment out the global ``[backup_agent]`` section. Next, start backup agents on the destination machine or machines. Now, when you start a backup, you can specify the destination directory (as a Backup URL) using a local path on the destination machines. The backup agents will fetch data from the database and store it locally on the destination machines. | |||
|
|
|||
| Blobstore Access Permisions | |||
There was a problem hiding this comment.
Spelling of Permissions.
| Blobstore Access Permisions | ||
| =========== | ||
|
|
||
| If a remote blobstore like AWS S3 is used to store the backup data, you should ensure to restrict the backup agent permissions as much as possible. |
There was a problem hiding this comment.
Nit: This is core AWS philosophy, no? Maybe blame them?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See title. I think it would be useful for the community to see what permissions are required without going through the code (especially since the HTTP API is not a 1:1 mapping of the permissions).
Code-Reviewer Section
The general pull request guidelines can be found here.
Please check each of the following things and check all boxes before accepting a PR.
For Release-Branches
If this PR is made against a release-branch, please also check the following:
release-branchormainif this is the youngest branch)