[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eA highly privileged service account is temporarily used during the backup/recovery appliance deployment process, which is utilized to perform the installation.\u003c/p\u003e\n"],["\u003cp\u003eThe service account is granted specific roles and permissions in the target, VPC, and consumer projects, as detailed in the provided table, including project IAM admin, service account user, and Cloud KMS administration roles, among others.\u003c/p\u003e\n"],["\u003cp\u003eAfter the installation is complete, most of the granted permissions are removed, and only \u003ccode\u003eiam.serviceAccountUser\u003c/code\u003e and \u003ccode\u003eiam.serviceAccounts.actAs\u003c/code\u003e remain, along with two restricted Cloud KMS roles.\u003c/p\u003e\n"],["\u003cp\u003eCertain IAM permissions are also used for creating a firewall on the VPC project, but they are only needed during firewall creation.\u003c/p\u003e\n"],["\u003cp\u003eAll permissions granted during the deployment process are no longer required after the completion of installation, except those specified for daily operation.\u003c/p\u003e\n"]]],[],null,["# Backup and DR Service installation permissions and roles reference\n\nDuring the deployment process, a service account created on your behalf uses\nthese permissions for the duration of the deployment.\n\nThe service account uses these permissions to install the backup/recovery appliance\n-----------------------------------------------------------------------------------\n\nThe service account is highly privileged in the target, VPC project,\nand consumer projects during the installation. Most of these permissions are\nremoved as the installation progresses. The following table contains the roles\ngranted to the service account and the permissions needed within each role.\n\nAfter installation is finished, for daily operation on the workload project\n---------------------------------------------------------------------------\n\nAll of the permissions required for deployment and installation are removed\nexcept for `iam.serviceAccountUser` and `iam.serviceAccounts.actAs`. Two cloudkms\nroles needed for daily operation are added, restricted to a single key ring.\n\n`*` The `cloudkms` roles are on a single key ring. \n\n`**` The `cloudStorageOperator` role is on buckets with names that start with\nthe name of the backup/recovery appliance.\n\nPermissions used to create a firewall on the project\n----------------------------------------------------\n\nThese IAM permissions are used to create a firewall on the\nproject that owns the VPC only during firewall creation. \n\n compute.firewalls.create\n compute.firewalls.delete\n compute.firewalls.get\n compute.firewalls.list\n compute.firewalls.update\n compute.networks.list\n compute.networks.get\n compute.networks.updatePolicy\n\n**All other permissions are no longer needed after installation.**"]]
