部署備份/復原裝置時，系統會自動建立預設 Google Cloud 憑證。這項憑證是根據專案中附加至設備的服務帳戶所建立。這項憑證可簡化探索及保護 Compute Engine 執行個體的程序，無須建立 OnVault 集區和服務帳戶。在管理控制台中，依序前往「管理」>「憑證」，即可在「Cloud 憑證」頁面中查看這個預設 Google Cloud 憑證。
「Cloud Credentials」(雲端憑證) 頁面會根據設備名稱顯示預設 Google Cloud 憑證。舉例來說，如果備份/還原設備的名稱是 ba-name，則顯示的預設服務帳戶名稱為 *ba-name@developer.gserviceaccount.com。值 project-id 是專案 ID。
您無法編輯或刪除這個預設 Google Cloud 憑證，只能查看。
預設 Google Cloud 憑證會指向自動建立的 OnVault 集區，而該集區會指向自動建立的 Cloud Storage 值區。Cloud Storage 值區會保留 VM 執行個體建立的 Cloud Storage 值區。Cloud Storage 值區會保留 VM 執行個體設定和中繼資料，並在執行階段自動建立，前提是備份範本已指派給 Compute Engine 執行個體。Cloud Storage 值區的位置取決於備份範本中設定的永久磁碟快照儲存位置或區域。
即使您變更執行個體的區域或多區域，或是在首次快照成功執行後套用政策覆寫，系統也會自動建立 OnVault 集區。因此，這項服務可確保永久磁碟資料和執行個體 VM 設定位於同一位置。
如果是預設的 Google Cloud 憑證，系統會自動將 IAM 角色 Backup and DR Cloud Storage Operator 指派給備份/復原設備所連結的服務帳戶。您必須手動指派 Backup and DR Compute Engine Operator IAM 角色，才能備份 Compute Engine 執行個體。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eThis page outlines how default cloud credentials, automatically generated for backup/recovery appliances version 11.0.2 or higher, simplify Compute Engine instance protection without manual OnVault pool and service account creation.\u003c/p\u003e\n"],["\u003cp\u003eDefault cloud credentials, based on the appliance's service account, link to auto-created OnVault pools and Cloud Storage buckets that store VM configuration and metadata, with storage bucket locations matching the persistent disk snapshot region.\u003c/p\u003e\n"],["\u003cp\u003eYou can add new cloud credentials for backup/recovery appliances, which requires creating an OnVault pool, selecting the appliance, and can be done using either the appliance's service account or a manually uploaded JSON key, depending on the appliance's software version.\u003c/p\u003e\n"],["\u003cp\u003eCloud credentials, once created, are validated by the management console and result in the automatic creation of a Cloud Storage pool and a resource profile, and can be modified with the credentials information or the addition of new appliances, depending on the version of the appliance.\u003c/p\u003e\n"],["\u003cp\u003eCloud credentials created with JSON keys can be replaced with appliance service account credentials by creating a new credential and updating the backup plan to use the new resource profile, but the old credentials cannot be deleted until all associated images expire.\u003c/p\u003e\n"]]],[],null,["# Google Cloud credentials for Backup and DR Service protection and data access\n\nThis page explains what default Google Cloud credentials are and how to add new\ncredentials for backup/recovery appliances in the management console.\n\nA Google Cloud credential is a pointer to a service account that allows the\nbackup/recovery appliance to access project resources like Compute Engine\nAPIs and Cloud Storage buckets to backup and recover Compute Engine instances.\n\nDuring the backup or recovery of Compute Engine instances, the\nbackup/recovery appliances use the service account in the credential to take\nsnapshots of the instances, and upload instance metadata (like VM configuration,\nnetwork, and tags) to a Cloud Storage bucket through an OnVault pool. If the\nappliance that created the instance snapshots is not available, you can access\nthe backups using a different appliance, through the metadata stored in the\nCloud Storage bucket. See [Import persistent disk snapshot images](/backup-disaster-recovery/docs/configuration/import-pdsnapshot-images).\n\nDefault Google Cloud credential\n-------------------------------\n\nDefault Google Cloud credential is created automatically when you deploy the\nbackup/recovery appliance. This credential is created\nbased on the service account attached to the appliance in a project. This\ncredential simplifies the process of discovering and protecting Compute Engine\ninstances without the need to create OnVault pool and service account. In the\nmanagement console, you can view this default Google Cloud credential in the\n**Cloud Credentials** page by navigating to **Manage** \\\u003e\n**Credentials**.\n\nThe default Google Cloud credential in the **Cloud Credentials** page is displayed\nbased on the appliance name. For example, if the\nname of the backup/recovery appliance is *ba-name* then the\ndefault service account name is displayed is\n\\*ba-name@developer.gserviceaccount.com.\nThe value *project-id* is the project ID.\nYou cannot edit or delete this default Google Cloud credential, you can only view it.\n\nThe default Google Cloud credential points to an\n[automatically created OnVault pool](/backup-disaster-recovery/docs/concepts/using-onvault-pools#auto-create)---which points to an automatically\ncreated Cloud Storage bucket. The Cloud Storage bucket holds VM instance\ncreated Cloud Storage bucket. The Cloud Storage bucket holds VM instance\nconfiguration and metadata and gets automatically created at run time, when a\nbackup template is assigned to a Compute Engine instance. The location of the\nCloud Storage bucket is determined based on the persistent disks snapshots\nstorage location or region as configured in the backup template.\n\nOnVault pools are created automatically even if you change the region or\nmulti-region of the instance or when the [policy override](/backup-disaster-recovery/docs/create-plan/policy-settings) is applied after\nthe first snapshot ran successfully. The service thus ensures that both the\npersistent disk data and the instance VM configuration are colocated.\n\nFor the default Google Cloud credential, the IAM role\n`Backup and DR Cloud Storage Operator` is automatically assigned to the service\naccount attached to the backup/recovery appliance. You need to manually assign\nthe IAM role `Backup and DR Compute Engine Operator` to back up the\nCompute Engine instances.\n\nView the corresponding Cloud Storage bucket of the appliance in the\nGoogle Cloud console by navigating to **Cloud Storage** \\\u003e **Buckets**.\n| **Note:** It's recommended not to use the automatically created storage bucket for any other purpose.\n\nThe storage bucket is created with the name\n*\\\u003cbackup/recovery-appliance-name\\\u003e-\\\u003crandom-string\\\u003e-\\\u003cregion/multi-region\\\u003e*\nin the same project where the appliance is deployed and has the following\nproperties set.\n\n- **Storage Class**: Standard\n- **Object Access Control**: Uniform\n- **Bucket Location**: Same as Persistent Disk snapshot location\n- **Object Versioning**: No object versioning or retention set on bucket\n- **Access**: No public access on the bucket\n\n | **Note:** The automatically created storage bucket uses a **Standard** storage class to hold the VM configuration and metadata and you're charged for a **Standard** storage class.\n\nAdd Google Cloud credentials\n----------------------------\n\nBackup and DR Service provides the ability to create a new Google Cloud credential if you\nstill want to manually create one for a backup/recovery appliance. To create\nnew Google Cloud credentials, first you need to create a new OnVault pool, see\n[OnVault pool](/backup-disaster-recovery/docs/concepts/using-onvault-pools) instructions.\n\n### Add Google Cloud credentials\n\nTo create a Google Cloud credential, you need to define the credential name and\nOnVault pool where you want to store the backup data. A service account\nis auto-filled based on the service account attached to the selected\nbackup/recovery appliance. [Create an OnVault](/backup-disaster-recovery/docs/concepts/using-onvault-pools#add_an_onvault_pool), if you don't have one.\n\nBefore adding the Google Cloud credential, assign the role\n`Backup and DR Compute Engine Operator` to the service account attached to the\nappliance.\n\nUse these instructions to add Google Cloud credential for backup/recovery appliances:\n\n1. Click **Manage** and select **Credentials** from the drop-down menu.\n\n The **Cloud Credentials** page opens listing all Google Cloud credentials managed by\n the management console if any credentials are already added.\n2. Click **Add Google Cloud Credentials**.\n\n3. In **Credential Name**, add a unique name that you want to identify the\n credential with.\n\n4. Select a **Default Zone**. The default zone is used to determine which zone\n to default to when discovering Compute Engine VMs in a project. You can\n also select a different zone during discovery.\n\n5. In the **Appliances** drop-down, select the appliance you want the\n credentials to be associated with. The **Service Account** field is\n automatically filled with the service account attached to that appliance.\n\n6. Select the OnVault pool. Pools are displayed based on the selected\n appliance. To add an OnVault pool, use the [OnVault Pool](/backup-disaster-recovery/docs/concepts/using-onvault-pools#add_an_onvault_pool) instructions.\n\n | **Note:** The OnVault drop-down does not display the auto-created pools. It's only offered for the [default Google Cloud credentials](#default).\n7. Click **Add**.\n\nThe management console sends a request to validate the Google Cloud credentials to the\nselected appliance. If validation succeeds, the credential is\nregistered. Google Cloud credentials creation leads to automatic creation of a\nCloud Storage pool and a resource profile with Google Cloud credential name as\nthe prefix.\n\nEdit Google Cloud credentials\n-----------------------------\n\nUse these instructions to edit an existing Google Cloud credential for the appliance:\n\n1. Click **Manage** and select **Credentials** from the drop-down menu. The **Cloud Credentials** page opens listing all credentials saved on appliances managed by the management console.\n2. Select the credential that you want to modify and then select **Edit** from the bottom right-hand corner of the page. The **Edit Credential** page opens. You can also right-click the credential and select **Edit** from the drop-down menu options.\n3. Update the name, default zone, organization attributes, and OnVault pool as needed.\n4. Click **Save** to apply the changes.\n\nDelete a Google Cloud credential\n--------------------------------\n\nBefore deleting the credentials, unprotect and remove all the applications\nand hosts discovered using this credential, and then delete it.\n\nUse these instructions to delete a Google Cloud credential.\n\n1. Click **Manage** and select **Credentials** from the drop-down menu.\n2. Right-click the required credentials and select **Delete**.\n3. Click **Confirm**.\n\nThe Backup and DR Compute Engine guide\n--------------------------------------\n\n- [Check for the Google Cloud credentials](/backup-disaster-recovery/docs/configuration/create-cloud-credentials)\n- [Discover and protect Compute Engine instances](/backup-disaster-recovery/docs/configuration/discover-and-protect-ce-inst)\n- [Mount backup images of Compute Engine instances](/backup-disaster-recovery/docs/access-data/mount-snapshot-images-of-cloud-instances)\n- [Restore a Compute Engine instance](/backup-disaster-recovery/docs/restore-data/restore-instance)\n- [Import Persistent Disk snapshot images](/backup-disaster-recovery/docs/configuration/import-pdsnapshot-images)"]]
