对于默认的 Google Cloud 凭据，系统会自动将 IAM 角色Backup and DR Cloud Storage Operator分配给附加到备份/恢复设备的相应服务账号。您需要手动分配 IAM 角色 Backup and DR Compute Engine Operator，才能备份 Compute Engine 实例。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eThis page outlines how default cloud credentials, automatically generated for backup/recovery appliances version 11.0.2 or higher, simplify Compute Engine instance protection without manual OnVault pool and service account creation.\u003c/p\u003e\n"],["\u003cp\u003eDefault cloud credentials, based on the appliance's service account, link to auto-created OnVault pools and Cloud Storage buckets that store VM configuration and metadata, with storage bucket locations matching the persistent disk snapshot region.\u003c/p\u003e\n"],["\u003cp\u003eYou can add new cloud credentials for backup/recovery appliances, which requires creating an OnVault pool, selecting the appliance, and can be done using either the appliance's service account or a manually uploaded JSON key, depending on the appliance's software version.\u003c/p\u003e\n"],["\u003cp\u003eCloud credentials, once created, are validated by the management console and result in the automatic creation of a Cloud Storage pool and a resource profile, and can be modified with the credentials information or the addition of new appliances, depending on the version of the appliance.\u003c/p\u003e\n"],["\u003cp\u003eCloud credentials created with JSON keys can be replaced with appliance service account credentials by creating a new credential and updating the backup plan to use the new resource profile, but the old credentials cannot be deleted until all associated images expire.\u003c/p\u003e\n"]]],[],null,["# Google Cloud credentials for Backup and DR Service protection and data access\n\nThis page explains what default Google Cloud credentials are and how to add new\ncredentials for backup/recovery appliances in the management console.\n\nA Google Cloud credential is a pointer to a service account that allows the\nbackup/recovery appliance to access project resources like Compute Engine\nAPIs and Cloud Storage buckets to backup and recover Compute Engine instances.\n\nDuring the backup or recovery of Compute Engine instances, the\nbackup/recovery appliances use the service account in the credential to take\nsnapshots of the instances, and upload instance metadata (like VM configuration,\nnetwork, and tags) to a Cloud Storage bucket through an OnVault pool. If the\nappliance that created the instance snapshots is not available, you can access\nthe backups using a different appliance, through the metadata stored in the\nCloud Storage bucket. See [Import persistent disk snapshot images](/backup-disaster-recovery/docs/configuration/import-pdsnapshot-images).\n\nDefault Google Cloud credential\n-------------------------------\n\nDefault Google Cloud credential is created automatically when you deploy the\nbackup/recovery appliance. This credential is created\nbased on the service account attached to the appliance in a project. This\ncredential simplifies the process of discovering and protecting Compute Engine\ninstances without the need to create OnVault pool and service account. In the\nmanagement console, you can view this default Google Cloud credential in the\n**Cloud Credentials** page by navigating to **Manage** \\\u003e\n**Credentials**.\n\nThe default Google Cloud credential in the **Cloud Credentials** page is displayed\nbased on the appliance name. For example, if the\nname of the backup/recovery appliance is *ba-name* then the\ndefault service account name is displayed is\n\\*ba-name@developer.gserviceaccount.com.\nThe value *project-id* is the project ID.\nYou cannot edit or delete this default Google Cloud credential, you can only view it.\n\nThe default Google Cloud credential points to an\n[automatically created OnVault pool](/backup-disaster-recovery/docs/concepts/using-onvault-pools#auto-create)---which points to an automatically\ncreated Cloud Storage bucket. The Cloud Storage bucket holds VM instance\ncreated Cloud Storage bucket. The Cloud Storage bucket holds VM instance\nconfiguration and metadata and gets automatically created at run time, when a\nbackup template is assigned to a Compute Engine instance. The location of the\nCloud Storage bucket is determined based on the persistent disks snapshots\nstorage location or region as configured in the backup template.\n\nOnVault pools are created automatically even if you change the region or\nmulti-region of the instance or when the [policy override](/backup-disaster-recovery/docs/create-plan/policy-settings) is applied after\nthe first snapshot ran successfully. The service thus ensures that both the\npersistent disk data and the instance VM configuration are colocated.\n\nFor the default Google Cloud credential, the IAM role\n`Backup and DR Cloud Storage Operator` is automatically assigned to the service\naccount attached to the backup/recovery appliance. You need to manually assign\nthe IAM role `Backup and DR Compute Engine Operator` to back up the\nCompute Engine instances.\n\nView the corresponding Cloud Storage bucket of the appliance in the\nGoogle Cloud console by navigating to **Cloud Storage** \\\u003e **Buckets**.\n| **Note:** It's recommended not to use the automatically created storage bucket for any other purpose.\n\nThe storage bucket is created with the name\n*\\\u003cbackup/recovery-appliance-name\\\u003e-\\\u003crandom-string\\\u003e-\\\u003cregion/multi-region\\\u003e*\nin the same project where the appliance is deployed and has the following\nproperties set.\n\n- **Storage Class**: Standard\n- **Object Access Control**: Uniform\n- **Bucket Location**: Same as Persistent Disk snapshot location\n- **Object Versioning**: No object versioning or retention set on bucket\n- **Access**: No public access on the bucket\n\n | **Note:** The automatically created storage bucket uses a **Standard** storage class to hold the VM configuration and metadata and you're charged for a **Standard** storage class.\n\nAdd Google Cloud credentials\n----------------------------\n\nBackup and DR Service provides the ability to create a new Google Cloud credential if you\nstill want to manually create one for a backup/recovery appliance. To create\nnew Google Cloud credentials, first you need to create a new OnVault pool, see\n[OnVault pool](/backup-disaster-recovery/docs/concepts/using-onvault-pools) instructions.\n\n### Add Google Cloud credentials\n\nTo create a Google Cloud credential, you need to define the credential name and\nOnVault pool where you want to store the backup data. A service account\nis auto-filled based on the service account attached to the selected\nbackup/recovery appliance. [Create an OnVault](/backup-disaster-recovery/docs/concepts/using-onvault-pools#add_an_onvault_pool), if you don't have one.\n\nBefore adding the Google Cloud credential, assign the role\n`Backup and DR Compute Engine Operator` to the service account attached to the\nappliance.\n\nUse these instructions to add Google Cloud credential for backup/recovery appliances:\n\n1. Click **Manage** and select **Credentials** from the drop-down menu.\n\n The **Cloud Credentials** page opens listing all Google Cloud credentials managed by\n the management console if any credentials are already added.\n2. Click **Add Google Cloud Credentials**.\n\n3. In **Credential Name**, add a unique name that you want to identify the\n credential with.\n\n4. Select a **Default Zone**. The default zone is used to determine which zone\n to default to when discovering Compute Engine VMs in a project. You can\n also select a different zone during discovery.\n\n5. In the **Appliances** drop-down, select the appliance you want the\n credentials to be associated with. The **Service Account** field is\n automatically filled with the service account attached to that appliance.\n\n6. Select the OnVault pool. Pools are displayed based on the selected\n appliance. To add an OnVault pool, use the [OnVault Pool](/backup-disaster-recovery/docs/concepts/using-onvault-pools#add_an_onvault_pool) instructions.\n\n | **Note:** The OnVault drop-down does not display the auto-created pools. It's only offered for the [default Google Cloud credentials](#default).\n7. Click **Add**.\n\nThe management console sends a request to validate the Google Cloud credentials to the\nselected appliance. If validation succeeds, the credential is\nregistered. Google Cloud credentials creation leads to automatic creation of a\nCloud Storage pool and a resource profile with Google Cloud credential name as\nthe prefix.\n\nEdit Google Cloud credentials\n-----------------------------\n\nUse these instructions to edit an existing Google Cloud credential for the appliance:\n\n1. Click **Manage** and select **Credentials** from the drop-down menu. The **Cloud Credentials** page opens listing all credentials saved on appliances managed by the management console.\n2. Select the credential that you want to modify and then select **Edit** from the bottom right-hand corner of the page. The **Edit Credential** page opens. You can also right-click the credential and select **Edit** from the drop-down menu options.\n3. Update the name, default zone, organization attributes, and OnVault pool as needed.\n4. Click **Save** to apply the changes.\n\nDelete a Google Cloud credential\n--------------------------------\n\nBefore deleting the credentials, unprotect and remove all the applications\nand hosts discovered using this credential, and then delete it.\n\nUse these instructions to delete a Google Cloud credential.\n\n1. Click **Manage** and select **Credentials** from the drop-down menu.\n2. Right-click the required credentials and select **Delete**.\n3. Click **Confirm**.\n\nThe Backup and DR Compute Engine guide\n--------------------------------------\n\n- [Check for the Google Cloud credentials](/backup-disaster-recovery/docs/configuration/create-cloud-credentials)\n- [Discover and protect Compute Engine instances](/backup-disaster-recovery/docs/configuration/discover-and-protect-ce-inst)\n- [Mount backup images of Compute Engine instances](/backup-disaster-recovery/docs/access-data/mount-snapshot-images-of-cloud-instances)\n- [Restore a Compute Engine instance](/backup-disaster-recovery/docs/restore-data/restore-instance)\n- [Import Persistent Disk snapshot images](/backup-disaster-recovery/docs/configuration/import-pdsnapshot-images)"]]
