Linking a Yandex Cloud Backup policy to a VM automatically

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

1. Create a service account named backup-sa.

   yc iam service-account create --name backup-sa
   

   Result:

   id: ajehb3tcdfa1********
   folder_id: b1g86q4m5vej********
   created_at: "2024-07-22T16:05:14.237381531Z"
   name: backup-sa
   

   For more information about the yc iam service-account create command, see the CLI reference.

2. Assign the service account the backup.editor role for the folder:

   yc resource-manager folder add-access-binding <folder_ID> \
     --role backup.editor \
     --subject serviceAccount:<service_account_ID>
   

   Result:

   done (3s)
   effective_deltas:
     - action: ADD
       access_binding:
         role_id: backup.editor
         subject:
           id: ajehb3tcdfa1********
           type: serviceAccount
   

   For more information about the yc resource-manager folder add-access-binding command, see the CLI reference.

To create a service account, use the create REST API method for the ServiceAccount resource or the ServiceAccountService/Create gRPC API call.

To assign the service account the backup.editor role for the folder, use the setAccessBindings method for the ServiceAccount resource or the ServiceAccountService/SetAccessBindings gRPC API call.

1. Create a cloud network named cloud-network:

   yc vpc network create cloud-network
   

   Result:

   id: enptrcle5q3d********
   folder_id: b1g9hv2loamq********
   created_at: "2024-06-08T09:25:03Z"
   name: cloud-network
   default_security_group_id: enpbsnnop4ak********
   

   For more information about the yc vpc network create command, see the CLI reference.

2. Create the cloud-network-ru-central1-d subnet in the ru-central1-d availability zone:

   yc vpc subnet create cloud-network-ru-central1-d \
     --zone ru-central1-d \
     --network-name cloud-network \
     --range 10.1.0.0/16
   

   Result:

   id: e9bnnssj8sc8********
   folder_id: b1g9hv2loamq********
   created_at: "2024-06-08T09:27:00Z"
   name: cloud-network-ru-central1-d
   network_id: enptrcle5q3d********
   zone_id: ru-central1-d
   v4_cidr_blocks:
   - 10.1.0.0/16
   

   For more information about the yc vpc subnet create command, see the CLI reference.

1. Create a cloud-network using the create REST API method for the Network resource or the NetworkService/Create gRPC API call.
2. Create the cloud-network-ru-central1-d subnet using the create REST API method for the Subnet resource or the SubnetService/Create gRPC API call.

Run the following command:

yc vpc security-group create backup-sg \
  --network-name network-1 \
  --rule direction=egress,port=80,protocol=tcp,v4-cidrs=[213.180.193.0/24] \
  --rule direction=egress,port=80,protocol=tcp,v4-cidrs=[213.180.204.0/24] \
  --rule direction=egress,port=443,protocol=tcp,v4-cidrs=[84.47.172.0/24] \
  --rule direction=egress,port=443,protocol=tcp,v4-cidrs=[84.201.181.0/24] \
  --rule direction=egress,port=443,protocol=tcp,v4-cidrs=[178.176.128.0/24] \
  --rule direction=egress,port=443,protocol=tcp,v4-cidrs=[213.180.193.0/24] \
  --rule direction=egress,port=443,protocol=tcp,v4-cidrs=[213.180.204.0/24] \
  --rule direction=egress,from-port=7770,to-port=7800,protocol=tcp,v4-cidrs=[84.47.172.0/24] \
  --rule direction=egress,port=8443,protocol=tcp,v4-cidrs=[84.47.172.0/24] \
  --rule direction=egress,port=44445,protocol=tcp,v4-cidrs=[51.250.1.0/24] \
  --rule direction=ingress,port=22,protocol=tcp,v4-cidrs=[0.0.0.0/0]

Result:

id: enp0v73fe8fs********
folder_id: b1g86q4m5vej********
created_at: "2024-07-22T20:17:43Z"
name: backup-sgg
network_id: enp3srbi9u49********
status: ACTIVE
rules:
- id: enpporsovuhj********
    direction: EGRESS
    ports:
      from_port: "80"
      to_port: "80"
    protocol_name: TCP
    protocol_number: "6"
    cidr_blocks:
      v4_cidr_blocks:
        - 213.180.193.0/24
- id: enp7p6asol5i********
    direction: EGRESS
    ports:
      from_port: "80"
      to_port: "80"
    protocol_name: TCP
    protocol_number: "6"
    cidr_blocks:
      v4_cidr_blocks:
        - 213.180.204.0/24
...
- id: enp36mip5nhe********
    direction: INGRESS
    ports:
      from_port: "22"
      to_port: "22"
    protocol_name: TCP
    protocol_number: "6"
    cidr_blocks:
      v4_cidr_blocks:
        - 0.0.0.0/0

For more information about the yc vpc security-group create command, see the CLI reference.

To create a security group, use the create REST API method for the SecurityGroup resource or the SecurityGroupService/Create gRPC API call.

1. Describe the configuration of the backup policy being created in the backup-policy-schema.json file.

   {
     "compression": "NORMAL",
     "format": "AUTO",
     "multiVolumeSnapshottingEnabled": true,
     "preserveFileSecuritySettings": true,
     "reattempts": {
       "enabled": true,
       "interval": {
         "type": "SECONDS",
         "count": "30"
       },
       "maxAttempts": "30"
     },
     "silentModeEnabled": true,
     "splitting": {
       "size": "1099511627776"
     },
     "vmSnapshotReattempts": {
       "enabled": true,
       "interval": {
         "type": "MINUTES",
         "count": "5"
       },
       "maxAttempts": "3"
     },
     "vss": {
       "enabled": true,
       "provider": "TARGET_SYSTEM_DEFINED"
     },
     "archive": {
       "name": "'[Machine Name]-[Plan ID]-[Unique ID]A'"
     },
     "performanceWindow": {
       "enabled": true
     },
     "scheduling": {
       "backupSets": [
         {
           "time": {
             "weekdays": [
               "FRIDAY"
             ],
             "repeatAt": [
               {
                 "hour": "3"
               }
             ],
             "type": "WEEKLY"
           }
         }
       ],
       "enabled": true,
       "maxParallelBackups": "2",
       "randMaxDelay": {
         "type": "MINUTES",
         "count": "30"
       },
       "scheme": "ALWAYS_INCREMENTAL",
       "weeklyBackupDay": "MONDAY"
     },
     "cbt": "ENABLE_AND_USE",
     "fastBackupEnabled": true,
     "quiesceSnapshottingEnabled": true
   }
   

2. Create a backup policy:

   yc backup policy create \
     --name daily-backup \
     --settings-from-file ./backup-policy-scheme.json
   

   Result:

   id: cdgo5vytuw57********
   name: daily-backup
   created_at: "2024-07-23T20:34:37Z"
   updated_at: "2024-07-23T20:34:37Z"
   enabled: true
   settings:
     compression: NORMAL
     format: AUTO
     multi_volume_snapshotting_enabled: true
     preserve_file_security_settings: true
     reattempts:
       enabled: true
       interval:
         type: SECONDS
         count: "30"
       max_attempts: "30"
     silent_mode_enabled: true
     splitting:
       size: "1099511627776"
     vm_snapshot_reattempts:
       enabled: true
       interval:
         type: MINUTES
         count: "5"
       max_attempts: "3"
     vss:
       enabled: true
       provider: TARGET_SYSTEM_DEFINED
     archive:
       name: '''[Machine Name]-[Plan ID]-[Unique ID]A'''
     performance_window:
       enabled: true
     retention: {}
     scheduling:
       backup_sets:
         - time:
             weekdays:
               - FRIDAY
             repeat_at:
               - hour: "3"
             type: WEEKLY
           type: TYPE_AUTO
       enabled: true
       max_parallel_backups: "2"
       rand_max_delay:
         type: MINUTES
         count: "30"
       scheme: ALWAYS_INCREMENTAL
       weekly_backup_day: MONDAY
     cbt: ENABLE_AND_USE
     fast_backup_enabled: true
     quiesce_snapshotting_enabled: true
   folder_id: b1g86q4m5vej********
   

   For more information about the yc backup policy create command, see the CLI reference.

To create a backup policy, use the create REST API method for the Policy resource or the PolicyService/Create gRPC API call.

1. Describe the custom metadata configuration in the user-data.yaml file:

   #cloud-config
   datasource:
    Ec2:
     strict_id: false
   ssh_pwauth: no
   users:
   - name: vm-user
     sudo: ALL=(ALL) NOPASSWD:ALL
     shell: /bin/bash
     ssh_authorized_keys:
     - <public_SSH_key>
   packages:
     - curl
     - perl
     - jq
   runcmd:
     - curl https://storage.yandexcloud.net/backup-distributions/agent_installer.sh | sudo bash
   

2. Save the daily-backup policy ID in the cloudbackup.json file:

   {"initialPolicies": ["<daily-backup_policy_ID>"]}
   

3. Run this command:

   yc compute instance create \
     --name backup-instance \
     --zone ru-central1-d \
     --network-interface subnet-name=cloud-network-ru-central1-d,security-group-ids=<backup-sg_security_group_ID>,ipv4-address=auto,nat-ip-version=ipv4 \
     --create-boot-disk image-folder-id=standard-images,image-family=ubuntu-2204-lts,size=15 \
     --metadata-from-file user-data=./user-data.yaml,cloudbackup=./cloudbackup.json \
     --service-account-name backup-sa
   

   For more information about the yc compute instance create command, see the CLI reference.

To create a VM, use the create REST API method for the Instance resource or the InstanceService/Create gRPC API call.

In the request body, specify:

• In the metadata field, the user-data object containing custom metadata configuration with a script to install a backup agent.
• In the cloudbackup field, the backup policy ID.

Use \n as a string separator:

{
  "folderId": "folder_ID",
  "name": "backup-instance",
  "zoneId": "ru-central1-d",
  "platformId": "standard-v3",
  "resourcesSpec": {
    "memory": "2147483648",
    "cores": "2"
  },
  "metadata": {
    "user-data": "#cloud-config\ndatasource:\nEc2:\n  strict_id: false\nssh_pwauth: no\nusers:\n- name: vm-user\n  shell: /bin/bash\n  sudo: ALL=(ALL) NOPASSWD:ALL\n  ssh-authorized-keys:\n  - <public_SSH_key>\npackages:\n  - curl\n  - perl\n  - jq\nruncmd:\n  - curl https://storage.yandexcloud.net/backup-distributions/agent_installer.sh | sudo bash",
    "cloudbackup": "{\"initialPolicies\": [\"policy_ID\"]}"
  },
  "bootDiskSpec": {
    "diskSpec": {
      "size": "16106127360",
      "imageId": "fd8ljvsrm3l1q2tgqji9"
    }
  },
  "networkInterfaceSpecs": [
    {
      "subnetId": "subnet_ID",
      "primaryV4AddressSpec": {
        "oneToOneNatSpec": {
          "ipVersion": "IPV4"
        }
      },
      "securityGroupIds": [
        "security_group_ID"
      ]
    }
  ],
  "serviceAccountId": "service_account_ID"
}