Required vCenter Permissions for Clumio Connector VM Service Account

Purpose:

The Clumio Cloud Connector needs to be configured with a Clumio service account to allow for the inventory listing as well as backup/restore operations for VMs. 

This KB defines the minimum set of privileges required by the above vCenter Clumio service account for successful Clumio Cloud Connector operations. 

Requirements:

  • Privileges are added to vCenter Clumio Service Account and assigned at the vCenter level
  • Restricting / Whitelisting of resources at sub-vCenter level is currently not supported

Resolution:

Clumio currently supports the following vCenter versions, 

vCenter VersionESX/ESXi Version
6.76.7 Update 1 
6.56.5 Update 2 
6.06.0 Update 3 

Follow these steps to configure the required user privileges 

  1. Login to the vCenter console via vSphere Web Client.
  2. Navigate to Home > Administration

Screenshot1.png

  1. Navigate to Access Control > Roles and click the + symbol to create a new Role.

Screenshot2.png

  1. Provide a Role Name and assign the Privileges as mentioned in the below permissions matrix

Permissions Matrix:

Role Privileges in vCenter 6.7Role Privileges in vCenter 6.5Role Privileges in vCenter 6.0Required to deploy the Clumio Cloud ConnectorRequired for Clumio Cloud Connector to perform Backup/RestoreDescription
Cryptographic Operations PrivilegesCryptographic Operations PrivilegesNA   
Add diskAdd diskNAAdd a disk to an encrypted virtual machine.Required to back up and restore virtual machines using VMware VM-level encryption.
Direct accessDirect accessNAAccess encrypted resources.Required to up and restore virtual machines using VMware VM-level encryption.
EncryptEncryptNAEncrypt a virtual machine or a virtual machine disk.Required to back up and restore virtual machines using VMware VM-level encryption.
Register VMRegister VMNARegister an encrypted virtual machine with an ESXi host.Required to back up and restore virtual machines using VMware VM-level encryption.
      
Datastore PrivilegesDatastore PrivilegesDatastore Privileges   
Allocate spaceAllocate spaceAllocate space Allocate space on a datastore for a virtual machine, snapshot, clone, or virtual disk.
Browse datastoreBrowse datastoreBrowse datastore Browse files on a datastore. Used to locate virtual machine files on disk and verify that files exist.
Configure datastoreConfigure datastoreConfigure datastore Configure a datastore.
Low level file operationsLow level file operationsLow level file operations Perform read, write, delete, or rename operations for the datastore. Used to read virtual machine configuration files.
Remove fileRemove fileRemove file Delete files in the datastore.
Update virtual machine filesUpdate virtual machine filesUpdate virtual machine files Update file paths to virtual machines on a datastore.
      
Global PrivilegesGlobal PrivilegesGlobal Privileges   
DiagnosticsDiagnosticsDiagnostics Retrieve a list of diagnostic files, log header, binary files, or diagnostic bundle. Security note from VMware doc (Global Privileges): To avoid potential security breaches, limit this privilege to the vCenter Server Administrator role.
Disable methodsDisable methodsDisable methods Disable specific operations on objects managed by vCenter Server.
Enable methodsEnable methodsEnable methods Enable specific operations on objects managed by vCenter Server.
Manage custom attributesManage custom attributesManage custom attributes Add, remove, or rename custom field definitions. 
Set custom attributeSet custom attributeSet custom attribute View, create, or remove custom attributes for a managed object. 
      
vSphere Tagging PrivilegesvSphere Tagging PrivilegesNA   
Assign or Unassign vSphere tagAssign or Unassign vSphere tagNA Assign or unassign a tag for an object in the vCenter Server inventory.
Create vSphere tagCreate vSphere tagNA Create a tag for a restored virtual machine.
Create vSphere tag categoryCreate vSphere tag categoryNA Create a tag category.
Edit vSphere tagEdit vSphere tagNA Edit a tag.
Edit vSphere tag categoryEdit vSphere tag categoryNA Edit a tag category.
      
Network PrivilegesNetwork PrivilegesNetwork Privileges   
Assign networkAssign networkAssign network Assign a network to a virtual machine. Used to create a virtual machine on a network.
      
Resource PrivilegesResource PrivilegesResource Privileges   
Assign vApp to resource poolAssign vApp to resource poolAssign vApp to resource pool Assign a Clumio Cloud Connector to a resource pool.
Assign virtual machine to resource poolAssign virtual machine to resource poolAssign virtual machine to resource pool Assign/register a virtual machine to a resource pool during backups or when restoring to a resource pool.
      
vApp PrivilegesvApp PrivilegesvApp Privileges   
CreateCreateCreate Deploy the Clumio Cloud Connector.Required to manually deploy the Clumio Cloud Connector (CCC) OVF from S3.
ImportImportImport Import a Clumio Cloud Connector into vSphere.Required to manually deploy the Clumio Cloud Connector (CCC) OVF from S3.
vApp application configurationvApp application configurationvApp application configuration Modify the internal structure, including the product information and properties, of a Clumio Cloud Connector.Required to manually deploy the Clumio Cloud Connector (CCC) OVF from S3.
vApp instance configurationvApp instance configurationvApp instance configuration Modify the instance configuration, include the policies, of a Clumio Cloud Connector.Required to manually deploy the Clumio Cloud Connector (CCC) OVF from S3.
      
Virtual Machine / Configuration PrivilegesVirtual Machine / Configuration PrivilegesVirtual Machine / Configuration Privileges   
Acquire disk leaseDisk leaseDisk lease Perform disk lease operations for a virtual machine.
Add existing diskAdd existing diskAdd existing disk Add an existing virtual disk to a virtual machine.
Add new diskAdd new diskAdd new disk Create a new virtual disk to add to a virtual machine.
Add or remove deviceAdd or remove deviceAdd or remove device Add or remove any non-disk device. Used to add a SCSI controller or restore a non-disk device configuration.
Advanced configurationAdvancedAdvanced Add or modify advanced parameters in a virtual machine's configuration file.
Change CPU CountChange CPU CountChange CPU Count Change the number of virtual CPUs.
Change MemoryMemoryMemory Change the amount of memory allocated to the virtual machine.
Change SettingsSettingsSettings Change general virtual machine settings.
Change Swapfile placementSwapfile placementSwapfile placement Change the swapfile placement policy for a virtual machine.
Change resourceChange resourceChange resource Change the resource configuration of a set of virtual machine nodes in a given resource pool.
Configure Host USB deviceHost USB deviceHost USB device Attach a host-based USB device to a virtual machine.
Configure Raw deviceRaw deviceRaw device Add or remove a raw disk mapping or SCSI pass-through device, overriding other privileges for modifying raw devices, including connection states.
Configure managedByConfigure managedByConfigure managedBy Configure managedBy on a virtual machine.
Display connection settingsDisplay connection settingsDisplay connection settings Configure virtual machine remote console options.
Extend virtual diskExtend virtual diskExtend virtual disk Expand the size of a virtual disk.
Modify device settingsModify device settingsModify device settings Change the properties of an existing device.
Query Fault Tolerance compatibilityQuery Fault Tolerance compatibilityQuery Fault Tolerance compatibility Verifies if a virtual machine is compatible for fault tolerance.
Query unowned filesQuery unowned filesQuery unowned files Query unowned files.
Reload from pathReload from pathReload from path Change a virtual machine configuration path while preserving the identity of the virtual machine.
Remove diskRemove diskRemove disk Remove a virtual disk.
RenameRenameRename Rename a virtual machine or modify the associated notes for a virtual machine.
Reset guest informationReset guest informationReset guest information Edit the guest operating system information for a virtual machine.
Set annotationSet annotationSet annotation Add or edit a virtual machine annotation. 
Toggle disk change trackingDisk change trackingDisk change tracking Enable or disable change tracking for the virtual machine's disks.
Toggle fork parentToggle fork parentNA Enable or disable a VMFork parent.
Upgrade virtual machine compatibilityUpgrade virtual machine compatibilityUpgrade virtual machine compatibility Upgrade a virtual machine's virtual machine compatibility version (e.g., virtual hardware version).
      
Virtual Machine / Inventory PrivilegesVirtual Machine / Inventory PrivilegesVirtual Machine / Inventory Privileges   
Create from existingCreate from existingCreate from existing Create a virtual machine by cloning based on an existing virtual machine, or by deploying from a template.
Create newCreate newCreate new Create a virtual machine and the allocation of its resources.
RegisterRegisterRegister Add an existing virtual machine to a vCenter Server or host inventory.
RemoveRemoveRemove Delete a virtual machine and remove its underlying files from disk.
UnregisterUnregisterUnregister Unregister a virtual machine from a vCenter Server or host inventory.
      
Virtual machine / Interaction PrivilegesVirtual machine / Interaction PrivilegesVirtual machine / Interaction Privileges   
Console interactionConsole interactionConsole interaction Enable interaction with the virtual machine’s virtual mouse, keyboard, and screen.Required to manually configure the Clumio Cloud Connector (CCC) virtual machine instance after deployment.
Power offPower offPower offPower off a powered-on virtual machine. Powers down the guest operating system.
Power onPower onPower onPower on a powered-off virtual machine and resumes a suspended virtual machine.
ResetResetResetReset a virtual machine and reboot the guest operating system.
SuspendSuspendSuspendSuspend a powered-on virtual machine and places the guest in standby mode.
      
Virtual Machine / Provisioning PrivilegesVirtual Machine / Provisioning PrivilegesVirtual Machine / Provisioning Privileges   
Allow disk accessAllow disk accessAllow disk access Open a disk on a virtual machine for random read and write access. 
Allow read-only disk accessAllow read-only disk accessAllow read-only disk access Open a disk on a virtual machine for random read access.
Allow virtual machine downloadAllow virtual machine downloadAllow virtual machine download Perform read operations on files associated with a virtual machine. Examples of associated files include vmx, disks, logs, and NVRAM.
Clone templateClone templateClone template Clone a template.
Clone virtual machineClone virtual machineClone virtual machine Clone an existing virtual machine and allocate resources.
CustomizeCustomizeCustomize Customize a virtual machine's guest operating system without moving the virtual machine.
Modify customization specificationModify customization specificationModify customization specification Create, modify, or delete customization specifications.
Promote disksPromote disksPromote disks Perform promote operations on a virtual machine's disk.
Read customization specificationsRead customization specificationsRead customization specifications Read a customization specification.
      
Virtual Machine / Snapshot Management PrivilegesVirtual Machine / Snapshot Management PrivilegesVirtual Machine / Snapshot Management Privileges   
Create snapshotCreate snapshotCreate snapshot Create a snapshot from a virtual machine's current state.
Remove snapshotRemove snapshotRemove snapshot Remove a snapshot from the snapshot history.
Rename snapshotRename snapshotRename snapshot Change the name or description of a snapshot.
Revert to snapshotRevert to snapshotRevert to snapshot Set a virtual machine to the state it was in for a given snapshot.

Validation:

  • Deploy the Clumio Cloud Connector VM using the OVF and power it on.
  • Login to the Web Console of the Clumio Cloud Connector VM and provide the Clumio service account credentials.

Screenshot4.png

  • Upon applying changes you should get the following success message if the Clumio service account has been setup properly.

Screenshot5.png 

 

 

Contact [email protected] in case of any clarifications or questions.