Google cloud storage user permissions to create the cloud immutable volume

MSDP follows the principle of the least privilege to provision and use S3 immutable storage.

You protect the data with the immutable storage by doing the resource management and using the resources. The resource management tasks such as creating or deleting buckets, enabling Object Lock on buckets are system-level tasks. Using the resource tasks such as running backup or restore jobs, which transfer the data to and from S3 immutable storage are user-level tasks.

These two tasks need different sets of permissions. The principal who has the first set of permissions is a cloud administrator, and the principal who has the second set of permissions is a backup administrator.

Cloud administrator needs the permissions to make immutable cloud storage configuration to manage cloud volumes.

"storage.buckets.create"
"storage.buckets.delete"
"storage.buckets.enableObjectRetention"
"storage.buckets.get"
"storage.buckets.list"
"storage.buckets.update"
"storage.objects.create"
"storage.objects.delete"
"storage.objects.get"
"storage.objects.list"
"storage.objects.overrideUnlockedRetention"
"storage.objects.setRetention"
"storage.objects.update"

Backup administrator needs the following permissions to configure immutable cloud LSU from the web UI and run data protection jobs such as backup, restore, duplication, replication, and so on.

"storage.buckets.get"
"storage.buckets.list"
"storage.objects.create"
"storage.objects.delete"
"storage.objects.get"
"storage.objects.list"
"storage.objects.overrideUnlockedRetention"
"storage.objects.setRetention"
"storage.objects.update"
"storage.multipartUploads.create"
"storage.multipartUploads.abort"
"storage.multipartUploads.listParts"
"storage.multipartUploads.list"