NetBackup™ Snapshot Manager for Cloud 安装和升级指南

在 Microsoft Azure 上配置权限

NetBackup Snapshot Manager 必须有权访问 Microsoft Azure 资产，然后才能保护这些资产。您必须关联 NetBackup Snapshot Manager 用户可用于处理 Azure 资产的自定义角色。

以下是自定义角色定义（JSON 格式），它使 NetBackup Snapshot Manager 能够执行以下操作：

对于受支持的 PaaS 数据库，要使用托管标识执行发现、创建、删除、数据库身份验证和时间点还原操作（仅适用于 Azure SQL 和 Managed Instance 数据库），需要以下一组权限：

actions": [
	  "Microsoft.Authorization/*/read",
	  "Microsoft.Subscription/*/read",
	  "Microsoft.Resources/*/read",
	  "Microsoft.ManagedIdentity/*/read",
	  "Microsoft.Sql/*/read",
	  "Microsoft.Sql/servers/databases/write",
	  "Microsoft.Sql/servers/databases/delete",
	  "Microsoft.Sql/managedInstances/databases/write",
	  "Microsoft.Sql/managedInstances/databases/delete",
	  "Microsoft.DBforMySQL/servers/read",
	  "Microsoft.DBforMySQL/servers/databases/read",
	  "Microsoft.DBforMySQL/flexibleServers/read",
	  "Microsoft.DBforMySQL/flexibleServers/databases/read",
	  "Microsoft.DBforMySQL/servers/databases/write",
	  "Microsoft.DBforMySQL/flexibleServers/databases/write",
	  "Microsoft.DBforMySQL/servers/databases/delete",
	  "Microsoft.DBforMySQL/flexibleServers/databases/delete",
	  "Microsoft.DBforPostgreSQL/servers/databases/delete",
	  "Microsoft.DBforPostgreSQL/flexibleServers/databases/delete",
	  "Microsoft.DBforPostgreSQL/servers/databases/write",
	  "Microsoft.DBforPostgreSQL/flexibleServers/databases/write",
	  "Microsoft.DBforPostgreSQL/servers/read",
	  "Microsoft.DBforPostgreSQL/servers/databases/read",
	  "Microsoft.DBforPostgreSQL/flexibleServers/read",
   "Microsoft.Compute/virtualMachines/read",
	  "Microsoft.DBforPostgreSQL/flexibleServers/databases/read"
          ],

PaaS 工作负载所需的其他权限

"Microsoft.DBforMySQL/servers/read",
"Microsoft.DBforMySQL/servers/databases/read",
"Microsoft.DBforMySQL/flexibleServers/read",
"Microsoft.DBforMySQL/flexibleServers/databases/read",
"Microsoft.DBforPostgreSQL/servers/read",
"Microsoft.DBforPostgreSQL/servers/databases/read",
"Microsoft.DBforPostgreSQL/flexibleServers/read",
"Microsoft.DBforMariaDB/servers/read",       
"Microsoft.DBforMariaDB/servers/databases/read",
"Microsoft.DBforPostgreSQL/flexibleServers/databases/read",
"Microsoft.Sql/*/write",
"Microsoft.Sql/*/delete"

如果对 PaaS Azure SQL 和 Managed Instance 使用系统托管标识，请将同一组权限/规则应用于介质服务器和 Snapshot Manager。如果使用用户托管标识，请将同一用户托管标识挂接到介质服务器和 Snapshot Manager。

Azure Cosmos DB for NoSQL 所需的权限

"Microsoft.DocumentDB/databaseAccounts​/read",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/read",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/write",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/read",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/write",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/throughputSettings​/read"
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/throughputSettings​/write",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/storedProcedures​/read",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/storedProcedures​/write",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/triggers/read",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/triggers/write",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/userDefinedFunctions​/read",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/userDefinedFunctions​/write",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/throughputSettings/read",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/throughputSettings/write"

Azure Cosmos DB for MongoDB 所需的权限

"Microsoft.DocumentDB/databaseAccounts/mongodbDatabases​/read",
"Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/write",
"Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections​/read",
"Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections​/write",
"Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/delete",
"Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections/throughputSettings​/read",
"Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections/throughputSettings​/write",
"Microsoft.DocumentDB/databaseAccounts/listKeys/action"

Microsoft Azure 对象存储的发现、备份、还原和身份验证需要以下权限集

{
 "properties": {
     "roleName": "cosp_minimal",
     "description": "minimal permission required for ​cos protection.",
     "assignableScopes": [
         "/subscriptions/<Subsfription_ID>"
     ],
     "permissions": [
         {
           "actions": [
             "Microsoft.Storage/storageAccounts​/blobServices/read",
             "Microsoft.Storage/storageAccounts/​blobServices/containers/read",
             "Microsoft.Storage/storageAccounts/​blobServices/containers/write",
             "Microsoft.ApiManagement/service/*",
             "Microsoft.Authorization/*/read",
             "Microsoft.Resources/subscriptions/​resourceGroups/read",
             "Microsoft.Storage/storageAccounts/read"

           ],
           "notActions": [],
           "dataActions": [
             "Microsoft.Storage/storageAccounts/​blobServices/containers/blobs/write",
             "Microsoft.Storage/storageAccounts/​blobServices/containers/blobs/filter/action",
             "Microsoft.Storage/storageAccounts/​blobServices/containers/blobs/tags/write",
             "Microsoft.Storage/storageAccounts/​blobServices/containers/blob/read",
           ],
           "notDataActions": []
         }
     ]
   }
}

要使用 powershell 创建自定义角色，请执行 Azure 文档中提及的步骤。

例如：

New-AzureRmRoleDefinition -InputFile "C:\CustomRoles\ReaderSupportRole.json"

要使用 Azure CLI 创建自定义角色，请执行 Azure 文档中提及的步骤。

例如：

az role definition create --role-definition "~/CustomRoles/
ReaderSupportRole.json"

要使用此角色，请执行以下操作：