Create a Secure Data Vault for Backup Products

Objectives

• Create a Object Storage bucket configured for backup workloads
• Enable immutability (WORM) to protect backup data from modification or deletion
• Configure context-based restrictions to limit access to authorized networks and services
• Retrieve the credentials and connection information that are required by your backup product

Architecture

The secure data vault architecture consists of:

• Object Storage bucket - The storage target for backup data
• Immutability policy - WORM (Write Once Read Many) protection preventing data modification
• Context-based restrictions - Network and service-based access controls
• Service credentials - HMAC keys (Access Key and Secret Key) for S3-compatible access

Using the console

1. Log in to the IBM Cloud console.
2. Navigate to your Object Storage instance from the Resource list.
3. Click Create bucket.
4. Select Customize your bucket.
5. Configure the bucket settings.
   1. Bucket name: Enter a unique, descriptive name (for example, company-backup-vault-prod).
   2. Resiliency: Select Cross Region or Regional based on your requirements.
   3. Location: Choose a location close to your backup infrastructure.
   4. Storage class: Select Standard for frequently accessed backups or Vault for long-term retention.
6. Click Create bucket.

Using the CLI

ibmcloud cos bucket-create \
  --bucket company-backup-vault-prod \
  --ibm-service-instance-id <your-cos-instance-crn> \
  --region us-south \
  --class standard

You can find your IBM Cloud Object Storage instance CRN in the IBM Cloud console under the Service credentials section of your Object Storage instance.

Understanding retention periods

Object Storage immutability uses three retention period settings:

Enable immutability by using the console

1. Navigate to your backup bucket in the Object Storage console.
2. Click the Configuration tab.
3. Scroll to Immutable Object Storage and click Add retention policy.
4. Configure the retention periods.
   1. Minimum retention period: Set based on your shortest backup retention requirement (for example, 7 days).
   2. Default retention period: Set to your standard backup retention (for example, 30 days).
   3. Maximum retention period: Set to your longest retention requirement (for example, 365 days or 7 years for compliance).
5. Click Save.

Enable immutability by using the CLI

ibmcloud cos bucket-protection-configuration-put \
  --bucket company-backup-vault-prod \
  --protection-configuration '{
    "status": "Retention",
    "minimum_retention": {"days": 7},
    "default_retention": {"days": 30},
    "maximum_retention": {"days": 365}
  }'

Plan your access rules

Before configuring CBR, identify the following:

• Backup server IP addresses or subnets: The network ranges where your backup software runs
• Private or public endpoint access: Prefer private endpoints for production workloads
• Service-to-service access: Whether other IBM Cloud services need access

Create a network zone

A network zone defines the allowed source networks for access.

1. Navigate to Context-based restrictions in the IBM Cloud console.
2. Click Create zone.
3. Enter a descriptive name (for example, backup-infrastructure-zone).
4. Add allowed network sources.
   1. IP addresses: Add your backup server IPs (for example, 10.240.0.0/24).
   2. VPC: Select your VPC if backup servers run in IBM Cloud.
   3. Service references: Add any IBM Cloud services that need access.
5. Click Create.

Create a CBR rule

1. Navigate to Context-based restrictions rules.
2. Click Create rule.
3. Configure the rule.
   1. Description: Restrict backup bucket to authorized infrastructure.
   2. Service: Select Cloud Object Storage.
   3. Scope: Select your Object Storage instance and the specific backup bucket.
   4. Contexts: Add the network zone that you created.
   5. Enforcement: Start with Report-only to test, then switch to Enabled.
4. Click Create.

Test your CBR rules thoroughly in report-only mode before enabling enforcement. Check the Activity Tracker logs to verify that legitimate backup traffic is matching the rules.

CBR rule by using the CLI

# Create a network zone
ibmcloud cbr zone-create \
  --name backup-infrastructure-zone \
  --addresses 10.240.0.0/24,10.241.0.0/24

# Create a CBR rule for the backup bucket
ibmcloud cbr rule-create \
  --description "Restrict backup bucket access" \
  --service-name cloud-object-storage \
  --resource-attributes "accountId=<account-id>,serviceName=cloud-object-storage,resource=company-backup-vault-prod" \
  --zone-id <zone-id> \
  --enforcement-mode enabled

Using the console

1. Navigate to your Object Storage instance in the IBM Cloud console.
2. Click Service credentials in the left navigation.
3. Click New credential.
4. Configure the credential.
   1. Name: Enter a descriptive name (for example, veeam-backup-credentials).
   2. Role: Select Writer for backup operations (or Manager if the backup product needs to manage bucket settings).
   3. HMAC Credential: Toggle to On (this is critical for S3 compatibility).
5. Click Add.
6. Expand the new credential to view the details.

Using the CLI

ibmcloud resource service-key-create veeam-backup-credentials Writer \
  --instance-name my-cos-instance \
  --parameters '{"HMAC": true}'

Retrieve HMAC credentials

After creating the service credential, expand it to find the HMAC keys:

{
  "apikey": "...",
  "cos_hmac_keys": {
    "access_key_id": "1a2b3c4d5e6f7g8h9i0j",
    "secret_access_key": "AbCdEfGhIjKlMnOpQrStUvWxYz1234567890abcd"
  },
  "endpoints": "https://control.cloud-object-storage.cloud.ibm.com/v2/endpoints",
  "iam_apikey_description": "...",
  "resource_instance_id": "crn:v1:bluemix:public:cloud-object-storage:global:..."
}

Record the following values for your backup product configuration:

Store your Secret Key securely. It cannot be retrieved again after the credential is created.

Find your endpoint

1. Navigate to your bucket in the Object Storage console.
2. Click the Configuration tab.
3. Scroll to Endpoints to see the available endpoints for your bucket's location.

Endpoint types

Common endpoint URLs

Regional endpoints (US South example):

Cross Region endpoints (US example):

For a complete list of endpoints, see Endpoints and storage locations.

Required configuration values

Gather the following information before configuring your backup product:

IBM Storage Defender Data Protect

IBM Storage Defender Data Protect supports cloud tiering and archiving to S3-compatible storage including Object Storage. The configuration process involves registering an external S3 target and creating protection policies.

For detailed configuration steps, refer to the IBM Storage Defender Redbook, which covers Data Protect versions 7.1.1 and later.

Veeam Backup & Replication

Veeam Backup & Replication supports Object Storage as an S3-compatible object storage target. Use the New Object Storage Repository wizard to add your Object Storage bucket.

For complete documentation, see Adding S3 Compatible Object Storage in the Veeam Help Center.

Commvault

Commvault supports Object Storage as an S3-compatible cloud storage target. You can configure it through the Command Center for backup and archive operations.

For complete documentation, see Getting Started with IBM Cloud Object Storage and Configuration for IBM Cloud Object Storage in the Commvault documentation.

Test backup operations

1. Create a small test backup job in your backup product.
2. Run the backup and verify that it completes successfully.
3. Verify that the backup data appears in your Object Storage bucket.

Verify immutability

1. Attempt to delete a recently backed-up object directly in the Object Storage console.
2. The deletion should be denied with a retention policy error.
3. Verify in the Activity Tracker that the deletion attempt was logged.

Verify that CBR is working

1. Check Activity Tracker for any denied requests from outside your approved network zones.
2. Attempt access from a nonapproved network to verify it's blocked (if safe to do so).
3. Review CBR rule evaluations in the IBM Cloud console.

Security recommendations

• Use private endpoints: Route backup traffic over the IBM Cloud private network when possible.
• Rotate credentials regularly: Create new HMAC credentials periodically and update your backup product.
• Monitor with Activity Tracker: Enable Activity Tracker to log all bucket operations.
• Apply least privilege: Grant only the minimum required IAM roles to backup credentials.
• Enable versioning: Consider enabling versioning for more protection against overwrites.

Immutability recommendations

• Align retention with backup policies: Set a minimum retention to match your shortest backup retention requirement.
• Plan for compliance: If subject to regulations (HIPAA, SEC, GDPR), set retention periods accordingly.
• Test recovery procedures: Regularly test that you can restore from immutable backups.

Performance recommendations

• Choose the appropriate storage class: Use Standard for active backups, Vault or Cold Vault for archives.
• Enable transfer acceleration: For large backups over long distances, consider Aspera high-speed transfer.
• Right-size concurrent connections: Most backup products allow tuning concurrent upload streams.

Object Storage documentation

• Object Storage documentation
• Immutable Object Storage
• Context-based restrictions
• Service credentials and HMAC
• Endpoints and storage locations
• Activity Tracker integration
• S3 Object Lock

Backup product documentation

• IBM Storage Defender Redbook: Data Management Service and Data Protect
• IBM Storage Defender Data Protect documentation
• Veeam: Adding S3 Compatible Object Storage
• Veeam: S3 Compatible Storage Considerations and Limitations
• Commvault: Getting Started with IBM Cloud Object Storage
• Commvault: Configuration for IBM Cloud Object Storage
• Commvault: Adding IBM Cloud Object Storage Repository