Skip to content

Commit 770d56d

Browse files
author
AbhishekMallick-MS
committed
added includes
1 parent 1b8ec9b commit 770d56d

8 files changed

+358
-0
lines changed

‎includes/blob-backup-configure-policy-cli.md

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
author: AbhishekMallick-MS
3+
ms.service: backup
4+
ms.topic: include
5+
ms.date: 05/30/2024
6+
ms.author: v-abhmallick
7+
---
8+
9+
Once the vault and policy are created, there are two critical points that you need to consider to protect all the Azure Blobs within a storage account.
10+
11+
- Key entities
12+
- Permissions
13+
14+
### Key entities
15+
16+
- **Storage account containing the blobs to be protected**: Fetch the Azure Resource Manager ID of the storage account that contains the blobs to be protected. This will serve as the identifier of the storage account. We'll use an example of a storage account named *CLITestSA*, under the resource group *blobrg*, in a different subscription present in the Southeast Asia region.
17+
18+
```azurecli-interactive
19+
"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx/resourcegroups/blobrg/providers/Microsoft.Storage/storageAccounts/CLITestSA"
20+
```
21+
22+
- **Backup vault**: The Backup vault requires permissions on the storage account to enable backups on blobs present within the storage account. The system-assigned managed identity of the vault is used for assigning such permissions.
23+
24+
### Assign permissions
25+
26+
You need to assign a few permissions via Azure RBAC to the created vault (represented by vault MSI) and the relevant storage account. These can be performed via Portal or PowerShell. Learn more about all the [related permissions](/azure/backup/blob-backup-configure-manage#grant-permissions-to-the-backup-vault-on-storage-accounts).

‎includes/blob-backup-create-policy-cli.md

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
---
2+
author: AbhishekMallick-MS
3+
ms.service: backup
4+
ms.topic: include
5+
ms.date: 05/30/2024
6+
ms.author: v-abhmallick
7+
---
8+
9+
To create a backup policy for blob vaulted backup, run the following commands:
10+
11+
1. To understand the inner components of a Backup policy for Azure Blobs backup, retrieve the policy template using the `az dataprotection backup-policy get-default-policy-template` command.
12+
13+
This command returns a default policy template for a given datasource type. Use this policy template to create a new policy.
14+
15+
2. Once you have saved the policy JSON with all the required values, proceed to create a new policy from the policy object using the `az dataprotection backup-policy create` command.
16+
17+
```azurecli-interactive
18+
Az dataprotection backup-policy create -g testBkpVaultRG –vault-name TestBkpVault -n BlobBackup-Policy –policy policy.json
19+
```
20+
21+
The following JSON is to configure a policy with *30 days retention* for *operational backup* and *30 days default retention* for *vaulted backup*. The vaulted backup is scheduled every day at *7:30 UTC*.
22+
23+
```json
24+
{
25+
"datasourceTypes": [
26+
"Microsoft.Storage/storageAccounts/blobServices"
27+
],
28+
"name": "BlobPolicy1",
29+
"objectType": "BackupPolicy",
30+
"policyRules": [
31+
{
32+
"isDefault": true,
33+
"lifecycles": [
34+
{
35+
"deleteAfter": {
36+
"duration": "P30D",
37+
"objectType": "AbsoluteDeleteOption"
38+
},
39+
"sourceDataStore": {
40+
"dataStoreType": "OperationalStore",
41+
"objectType": "DataStoreInfoBase"
42+
},
43+
"targetDataStoreCopySettings": []
44+
}
45+
],
46+
"name": "Default",
47+
"objectType": "AzureRetentionRule"
48+
},
49+
{
50+
"isDefault": true,
51+
"lifecycles": [
52+
{
53+
"deleteAfter": {
54+
"duration": "P30D",
55+
"objectType": "AbsoluteDeleteOption"
56+
},
57+
"sourceDataStore": {
58+
"dataStoreType": "VaultStore",
59+
"objectType": "DataStoreInfoBase"
60+
},
61+
"targetDataStoreCopySettings": []
62+
}
63+
],
64+
"name": "Default",
65+
"objectType": "AzureRetentionRule"
66+
},
67+
{
68+
"backupParameters": {
69+
"backupType": "Discrete",
70+
"objectType": "AzureBackupParams"
71+
},
72+
"dataStore": {
73+
"dataStoreType": "VaultStore",
74+
"objectType": "DataStoreInfoBase"
75+
},
76+
"name": "BackupDaily",
77+
"objectType": "AzureBackupRule",
78+
"trigger": {
79+
"objectType": "ScheduleBasedTriggerContext",
80+
"schedule": {
81+
"repeatingTimeIntervals": [
82+
"R/2023-06-28T07:30:00+00:00/P1D"
83+
],
84+
"timeZone": "UTC"
85+
},
86+
"taggingCriteria": [
87+
{
88+
"isDefault": true,
89+
"tagInfo": {
90+
"id": "Default_",
91+
"tagName": "Default"
92+
},
93+
"taggingPriority": 93
94+
}
95+
]
96+
}
97+
}
98+
]
99+
}
100+
101+
```

‎includes/blob-vaulted-backup-configure-policy-ps.md

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
author: AbhishekMallick-MS
3+
ms.service: backup
4+
ms.topic: include
5+
ms.date: 05/30/2024
6+
ms.author: v-abhmallick
7+
---
8+
9+
Once the vault and policy are created, there are two critical points that you need to consider to protect all the Azure Blobs within a storage account.
10+
11+
- Key entities
12+
- Permissions
13+
14+
### Key entities
15+
16+
- **Storage account containing the blobs to be protected**: Fetch the Azure Resource Manager ID of the storage account that contains the blobs to be protected. This will serve as the identifier of the storage account. We'll use an example of a storage account named *PSTestSA* under the resource group *blobrg* in a different subscription.
17+
18+
```azurepowershell-interactive
19+
$SAId = "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx/resourcegroups/blobrg/providers/Microsoft.Storage/storageAccounts/PSTestSA"
20+
```
21+
22+
- **Backup vault**: The Backup vault requires permissions on the storage account to enable backups on blobs present within the storage account. The system-assigned managed identity of the vault is used for assigning such permissions.
23+
24+
### Assign permissions
25+
26+
You need to assign a few permissions via Azure RBAC to the created vault (represented by vault MSI) and the relevant storage account. These can be performed via Portal or PowerShell. Learn more about all the [related permissions](/azure/backup/blob-backup-configure-manage#grant-permissions-to-the-backup-vault-on-storage-accounts).

‎includes/blob-vaulted-backup-create-policy-ps.md

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
author: AbhishekMallick-MS
3+
ms.service: backup
4+
ms.topic: include
5+
ms.date: 05/30/2024
6+
ms.author: v-abhmallick
7+
---
8+
9+
To create a backup policy for blob vaulted backup, run the following commands:
10+
11+
1. To retrieve the policy template, use the [Get-AzDataProtectionPolicyTemplate](/powershell/module/az.dataprotection/get-azdataprotectionpolicytemplate) command. This command returns a default policy template for a given datasource type. Use this policy template to create a new policy.
12+
13+
```azurepowershell
14+
$defaultPol = Get-AzDataProtectionPolicyTemplate -DatasourceType AzureBlob`
15+
```
16+
17+
2. To create a vaulted backup policy, define the schedule and retention for backups. The following commands create a backup policy with backup frequency every week on Friday and Tuesday at 10 AM and retention of three months.
18+
19+
```azurepowershell-interactive
20+
$schDates = @(
21+
22+
(
23+
24+
(Get-Date -Year 2023 -Month 08 -Day 18 -Hour 10 -Minute 0 -Second 0)
25+
26+
),
27+
28+
(
29+
30+
(Get-Date -Year 2023 -Month 08 -Day 22 -Hour 10 -Minute 0 -Second 0)
31+
32+
))
33+
34+
35+
$trigger = New-AzDataProtectionPolicyTriggerScheduleClientObject -ScheduleDays $schDates -IntervalType Weekly -IntervalCount 1
36+
37+
Edit-AzDataProtectionPolicyTriggerClientObject -Schedule $trigger -Policy $defaultPol
38+
39+
40+
$lifeCycleVault = New-AzDataProtectionRetentionLifeCycleClientObject -SourceDataStore VaultStore -SourceRetentionDurationType Months -SourceRetentionDurationCount 3
41+
42+
Edit-AzDataProtectionPolicyRetentionRuleClientObject -Policy $defaultPol -Name Default -LifeCycles $lifeCycleVault -IsDefault $true
43+
44+
New-AzDataProtectionBackupPolicy -SubscriptionId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -ResourceGroupName "resourceGroupName" -VaultName "vaultName" -Name "MyPolicy" -Policy $defaultPol
45+
```
46+
47+
48+
49+
50+

‎includes/blob-vaulted-backup-introduction.md

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
author: AbhishekMallick-MS
3+
ms.service: backup
4+
ms.topic: include
5+
ms.date: 05/30/2024
6+
ms.author: v-abhmallick
7+
---
8+
9+
[Azure Backup](../articles/backup/backup-overview.md) now allows you to configure both [operational](../articles/backup/blob-backup-overview.md?tabs=operational-backup) and [vaulted](../articles/backup/blob-backup-overview.md?tabs=vaulted-backup) backups to protect block blobs in your storage accounts.
10+
11+
Vaulted backup of blobs is a managed offsite backup solution that stores the backup data in a general v2 storage account, enabling you to protect your backup data against ransomware attacks or source data loss due to malicious or rogue admin.
12+
13+
With vaulted backup, you can:
14+
15+
- Define the backup schedule to create recovery points and the retention settings that determine how long the backups will be retained in the vault.
16+
- Configure and manage the vaulted and operational backups using a single backup policy.
17+
- Copy and store the backup data in the Backup vault, thus providing an offsite copy of data that can be retained for a maximum of 10 years.

‎includes/blob-vaulted-backup-prepare-request-ps.md

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
author: AbhishekMallick-MS
3+
ms.service: backup
4+
ms.topic: include
5+
ms.date: 05/30/2024
6+
ms.author: v-abhmallick
7+
---
8+
9+
Once all the relevant permissions are set, configure blob backup by running the following commands:
10+
11+
1. Create a new backup configuration object to specify the set of containers you want to back up. To back up all containers, pass the `-IncludeAllContainer` parameter. To back up specific containers, pass the list of containers to the `-VaultedBackupContainer` parameter.
12+
13+
```azurepowershell-interactive
14+
$backupConfig=New-AzDataProtectionBackupConfigurationClientObject -DatasourceType AzureBlob -IncludeAllContainer -StorageAccountResourceGroupName "StorageRG" -StorageAccountName "testpscmd"
15+
```
16+
17+
2. Prepare the relevant request by using the relevant vault, policy, storage account, and the backup configuration object created in the above step using the [Initialize-AzDataProtectionBackupInstance](/powershell/module/az.dataprotection/initialize-azdataprotectionbackupinstance) command.
18+
19+
```azurepowershell-interactive
20+
$instance=Initialize-AzDataProtectionBackupInstance -DatasourceType AzureBlob -DatasourceLocation $TestBkpVault.Location -PolicyId $blobBkpPol.Id -DatasourceId $SAId -BackupConfiguration $backupConfig
21+
```
22+
23+
3. Submit the request to protect the blobs within the storage account using the [New-AzDataProtectionBackupInstance](/powershell/module/az.dataprotection/new-azdataprotectionbackupinstance) command.
24+
25+
```azurepowershell-interactive
26+
New-AzDataProtectionBackupInstance -ResourceGroupName "StorageRG" -VaultName $TestBkpVault.Name -BackupInstance $instance
27+
```
28+
29+

‎includes/blob-vaulted-backup-restore-ps.md

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
author: AbhishekMallick-MS
3+
ms.service: backup
4+
ms.topic: include
5+
ms.date: 05/30/2024
6+
ms.author: v-abhmallick
7+
---
8+
9+
To restore from vaulted blob backup, run the following commands:
10+
11+
1. Fetch the backup instance for which you want to perform the restore.
12+
13+
```azurepowershell-interactive
14+
$instance = Get-AzDataProtectionBackupInstance -SubscriptionId "c3d3eb0c-9ba7-4d4c-828e-cb6874714034" -ResourceGroupName "StorageRG" -VaultName "contosobackupvault" -Name “abc”
15+
```
16+
17+
2. Fetch the recovery point you want to use for restoring the data.
18+
19+
```azurepowershell-interactive
20+
$rp = Get-AzDataProtectionRecoveryPoint -SubscriptionId "c3d3eb0c-9ba7-4d4c-828e-cb6874714034" -ResourceGroupName "StorageRG" -VaultName "contosobackupvault" -BackupInstanceName $instance.Name
21+
```
22+
23+
3. Use the [Initialize-AzDataProtectionRestoreRequest](/powershell/module/az.dataprotection/initialize-azdataprotectionrestorerequest) command to prepare the restore request with all the relevant details. The target resource ID is the ARM ID of the alternate storage account where the contents should be restored.
24+
25+
```azurepowershell-interactive
26+
$ResourceId="/subscriptions/xxxxxx /resourceGroups/StorageRG/providers/Microsoft.Storage/storageAccounts/xxxx "
27+
$restorerequest =Initialize-AzDataProtectionRestoreRequest -DatasourceType AzureBlob -SourceDataStore VaultStore -RestoreType AlternateLocation -BackupInstance $instance -RecoveryPoint $rp[0].Name -TargetResourceId $ResourceId
28+
```
29+
30+
4. To restore specific containers, pass the container list explicitly to the `-ContainersList` parameter and also pass the parameter -ItemLevelRecovery.
31+
32+
```azurepowershell-interactive
33+
$restorerequest = Initialize-AzDataProtectionRestoreRequest -DatasourceType AzureBlob -SourceDataStore VaultStore -RestoreType AlternateLocation -RecoveryPoint $rp[0].Name -TargetResourceId $ResourceId -ContainersList "test1" -RestoreLocation "eastus" -ItemLevelRecovery
34+
```
35+
36+
5. Trigger the restore with the restore request prepared in the above steps.
37+
38+
```azurepowershell-interactive
39+
Start-AzDataProtectionBackupInstanceRestore -BackupInstanceName $instance.Name -ResourceGroupName "StorageRG" -VaultName $TestBkpVault.Name -Parameter $restorerequest
40+
```
41+
42+
6. Restore specific blobs based on the prefix match in each container.
43+
44+
Learn [how to restore specific blobs from vaulted backup](/powershell/module/az.dataprotection/start-azdataprotectionbackupinstancerestore?view=azps-11.6.0&preserve-view=true#example-10-trigger-vaulted-backup-conatiners-itemlevelrestore-with-prefixmatch-for-azureblob).

‎includes/blob-vaulted-backup-restore-restapi.md

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
author: AbhishekMallick-MS
3+
ms.service: backup
4+
ms.topic: include
5+
ms.date: 05/30/2024
6+
ms.author: v-abhmallick
7+
---
8+
9+
### Fetch the relevant recovery point
10+
11+
To list all the available recovery points for a backup instance, use the list recovery points API.
12+
13+
```http
14+
GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DataProtection/backupVaults/{vaultName}/backupInstances/{backupInstanceName}/recoveryPoints?api-version=2021-07-01
15+
```
16+
17+
### Prepare the request body to perform restore from vaulted backup.
18+
19+
Following is the request body to restore container bash 2 from a vaulted backup.
20+
21+
```http
22+
{
23+
"objectType": "AzureBackupRecoveryPointBasedRestoreRequest",
24+
"sourceDataStoreType": "VaultStore",
25+
"restoreTargetInfo": {
26+
"objectType": "itemLevelRestoreTargetInfo",
27+
"recoveryOption": "FailIfExists",
28+
"dataSourceInfo": {
29+
"objectType": "Datasource",
30+
"resourceID": "/subscriptions/495944b2-66b7-4173-8824-77043bb269be/resourceGroups/Blob-Backup/providers/Microsoft.Storage/storageAccounts/azclitestrestore2",
31+
"resourceName": "azclitestrestore2",
32+
"resourceType": "Microsoft.Storage/storageAccounts",
33+
"resourceLocation": "not specified",
34+
"resourceUri": "/subscriptions/495944b2-66b7-4173-8824-77043bb269be/resourceGroups/Blob-Backup/providers/Microsoft.Storage/storageAccounts/azclitestrestore2",
35+
"datasourceType": "Microsoft.Storage/storageAccounts/blobServices",
36+
"resourceProperties": {}
37+
},
38+
"restoreCriteria": [
39+
{
40+
"objectType": "ItemPathBasedRestoreCriteria",
41+
"itemPath": "bash2",
42+
"isPathRelativeToBackupItem": true,
43+
"subItemPathPrefix": null
44+
}
45+
],
46+
"restoreLocation": "eastus2euap"
47+
},
48+
"recoveryPointId": "33fdef0e0e2e4594b63092ae9a56f58d"
49+
}
50+
```
51+
52+
If you want to restore blobs with specific prefixes, provide the list of prefixes as value for **subItemPathPrefix**. Here's an example to restore blobs starting with prefixes dd, ee, or ff in container2 of your backed-up storage account.
53+
54+
```http
55+
{
56+
"is_path_relative_to_backup_item": true,
57+
"item_path": "container2",
58+
"object_type": "ItemPathBasedRestoreCriteria",
59+
"sub_item_path_prefix": [
60+
"dd",
61+
"ee",
62+
"ff"
63+
]
64+
}
65+
```

0 commit comments

Comments
 (0)