Veritas NetBackup™ Cloud Administrator's Guide
- About NetBackup cloud storage
- About the cloud storage
- About the Amazon S3 cloud storage API type
- About protecting data in Amazon for long-term retention
- Protecting data using Amazon's cloud tiering
- About Microsoft Azure cloud storage API type
- About OpenStack Swift cloud storage API type
- Configuring cloud storage in NetBackup
- Scalable Storage properties
- Cloud Storage properties
- About the NetBackup CloudStore Service Container
- About the NetBackup media servers for cloud storage
- Configuring a storage server for cloud storage
- NetBackup cloud storage server properties
- Configuring a storage unit for cloud storage
- Changing cloud storage disk pool properties
- Monitoring and Reporting
- Operational notes
- Troubleshooting
- About unified logging
- About legacy logging
- Troubleshooting cloud storage configuration issues
- Troubleshooting cloud storage operational issues
Troubleshooting failures due to missing Amazon IAM permissions
If the AWS credential provided in NetBackup cloud configuration does not have S3 or Glacier related permission, you could see failures or errors at various stages of configuration, backup, and restore.
Some error messages are clearly described and identifiable in the NetBackup Administrator console, while others are vague.
Amazon displays the AccessDeniedException
error message. To decipher this error message, you need to check the log files to check for the missing permission.
List Vault or List Bucket permission (
glacier:ListVaults
) missing.The following error is displayed:
This error occurs while creating a storage server. If you are using the CLI, tpcommand to add credential fails.
Check the
tpcommand
logs for AccessDeniedException, for example,amazon: Json: {"code":" ","type":"Client","message":"User: arn:aws:iam::326221795898:user/Readonly_user is not authorized to perform: glacier:ListVaults on resource: arn:aws:glacier:ap-south-1:326221795898:vaults/"} 16:17:52.139 [7388.4424] <2> magmavm1.abc.xyz.qwe.com: AmzVaultApi: json_string({"code":"AccessDeniedException","type":"Client","message":"User: arn:aws:iam::326221795898:user/Readonly_user is not authorized to perform: glacier:ListVaults on resource: arn:aws:glacier:ap-south-1:326221795898:vaults/"}) 16:17:52.139 [7388.4424] <16> magmavm1.abc.xyz.qwe.com:
Create Vault or Create Bucket permission (glacier:CreateVault or glacier:DescribeVault) missing.
The following error is displayed:
This error occurs while creating a disk pool using the NetBackup Administrator console. If you are using the CLI, nbdevconfig command fails.
Check the
nbrrms
log for AccessDeniedException, for example,amazon_raw:: AmzVaultApi: Error: server error code , User: arn:aws:iam::326221795898:user/Readonly_user is not authorized to perform: glacier:CreateVault on resource: arn:aws:glacier:ap-south-1:326221795898:vaults/fail-to-create, httpcode [403] returning [2060037],11:STS Service,1Post Archive or S3 Object permission missing - backup will fail in activity monitor.
Upload archives permission (glacier:UploadArchive) missing.
The following error is displayed:
This error occurs while backing up archives. The backup jobs fail with permission error.
Check the
bptm
log for details, for example,"code":" ","type":"Client","message":"User: arn:aws:iam::3234415151:user/XYZ is not authorized to perform: glacier:UploadArchive on resource: LSTR-gtwy-00076(debug).
Retrieve job after archive permission (glacier:InitiateJob) missing.
The following error is displayed:
This errors occurs after you start a restore.
Check the
bptm
log for details, for example,"code":" ","type":"Client","message":"User: arn:aws:iam::3234415151:user/XYZ is not authorized to perform: glacier:InitiateJob on resource: LSTR-gtwy-00076(debug).
Retrieve Archive or retrieve Object permission missing (glacier:GetJobOutput) missing.
The following error is displayed:
This missing permission causes the restore job to be in incomplete state if NetBackup cannot download archives after posting jobs.
Check the
bptm
log for details, for example,"code":" ","type":"Client","message":"User: arn:aws:iam::3234415151:user/XYZ is not authorized to perform: glacier:GetJobOutput on resource: LSTR-gtwy-00076(debug).
Delete Archive or Delete Object permission (glacier:DeleteArchive) missing.
The following error is displayed:
This missing permission causes the image cleanup or image expiry process to fail.
Check the
bpdm
log for details, for example,"code":" ","type":"Client","message":"User: arn:aws:iam::3234415151:user/XYZ is not authorized to perform: glacier:DeleteArchive on resource: LSTR-gtwy-00076(debug).