Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini memandu Anda cara membuat bucket penyimpanan Write Once Read Many (WORM) di lingkungan appliance yang terisolasi dari internet Google Distributed Cloud (GDC). Bagian ini mencakup prasyarat dan langkah-langkah untuk membuat bucket WORM dengan periode retensi yang ditentukan, dan untuk memberikan izin akses menggunakan binding peran. Informasi ini memungkinkan Anda menerapkan praktik retensi data dan keabadian yang ketat, sehingga memberikan penyimpanan data yang kuat dan sesuai untuk catatan dan kasus penggunaan seperti logging audit.
Halaman ini ditujukan untuk audiens seperti administrator IT dalam grup operator infrastruktur atau developer dalam grup operator aplikasi yang mengelola setelan retensi dan kepatuhan data untuk bucket penyimpanan di lingkungan yang terisolasi dari internet GDC.
Sebelum memulai
Namespace project mengelola resource bucket di server Management API. Anda
harus memiliki project untuk bekerja
dengan bucket dan objek.
Anda juga harus memiliki izin bucket yang sesuai untuk melakukan operasi berikut. Lihat Memberikan akses bucket.
Membuat bucket WORM
Bucket WORM memastikan bahwa tidak ada yang menimpa objek dan objek tersebut dipertahankan selama jangka waktu minimum. Logging audit adalah contoh kasus penggunaan untuk bucket WORM.
Lakukan langkah-langkah berikut untuk membuat bucket WORM:
Tetapkan periode retensi saat membuat bucket. Misalnya, bucket contoh berikut memiliki periode retensi 365 hari.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis page outlines the process for creating Write Once, Read Many (WORM) storage buckets within Google Distributed Cloud (GDC) air-gapped appliance.\u003c/p\u003e\n"],["\u003cp\u003eCreating a WORM bucket requires an existing project namespace to manage bucket resources within the admin cluster.\u003c/p\u003e\n"],["\u003cp\u003eWhen creating a WORM bucket, a retention period must be set to specify the minimum duration for which objects are retained and cannot be overwritten, exemplified by a 365-day retention in the provided example.\u003c/p\u003e\n"],["\u003cp\u003eAccess to WORM buckets is controlled via role assignments, such as \u003ccode\u003eproject-bucket-object-viewer\u003c/code\u003e for read-only access, and \u003ccode\u003eproject-bucket-object-admin\u003c/code\u003e for write access.\u003c/p\u003e\n"]]],[],null,["# Create storage WORM buckets\n\nThis page guides you through how to create Write Once Read Many (WORM) storage buckets in Google Distributed Cloud (GDC) air-gapped appliance environments. This covers the prerequisites and steps for creating a WORM bucket with a defined retention period, and for granting access permissions using role bindings. This information lets you enforce strict data retention practices and immutability, providing robust and compliant data storage for records and use cases like audit logging.\n\nThis page is for audiences such as IT administrators within the infrastructure operator group or developers within the application operator group who manage data retention and compliance settings for storage buckets in GDC air-gapped environments.\n\nBefore you begin\n----------------\n\nA project namespace manages bucket resources in the Management API server. You\nmust have a [project](/distributed-cloud/hosted/docs/latest/appliance/platform/pa-user/create-a-project) to work\nwith buckets and objects.\n\nYou must also have the appropriate bucket permissions to perform the following\noperation. See [Grant bucket access](/distributed-cloud/hosted/docs/latest/appliance/platform/pa-user/grant-obtain-storage-access#grant_bucket_access).\n\nCreate a WORM bucket\n--------------------\n\nA WORM bucket ensures that nothing else overwrites objects and it retains them for\na minimum period of time. Audit logging is an example use case for a WORM bucket.\n\nTake the following steps to create a WORM bucket:\n\n1. Set a retention period when creating the bucket. For example, the following\n example bucket has a retention period of 365 days.\n\n apiVersion: object.gdc.goog/v1\n kind: Bucket\n metadata:\n name: foo logging-bucket\n namespace: foo-service\n spec:\n description: \"Audit logs for foo\"\n storageClass: Standard\n bucketPolicy :\n lockingPolicy :\n defaultObjectRetentionDays: 365\n\n2. Grant the `project-bucket-object-viewer` role to all users who need read-only\n access:\n\n apiVersion: rbac.authorization.k8s.io/v1\n kind: RoleBinding\n metadata:\n namespace: foo-service\n name: object-readonly-access\n roleRef:\n kind: Role\n name: project-bucket-object-viewer\n apiGroup: rbac.authorization.k8s.io\n subjects:\n - kind: ServiceAccount\n namespace: foo-service\n name: foo-log-processor\n - kind: User\n name: bob@example.com\n apiGroup: rbac.authorization.k8s.io\n\n3. Grant the `project-bucket-object-admin` role to users who need to write\n content to the bucket:\n\n apiVersion: rbac.authorization.k8s.io/v1\n kind: RoleBinding\n metadata:\n namespace: foo-service\n name: object-write-access\n roleRef:\n kind: Role\n name: project-bucket-object-viewer\n apiGroup: rbac.authorization.k8s.io\n subjects:\n - kind: ServiceAccount\n namespace: foo-service\n name: foo-service-account"]]
