Configuring Google Cloud Storage Object Retention (Bucket Lock) for cloud-container storage pools

Edit online

Google Cloud Storage (GCS) Bucket Lock and Object Retention policies add an additional layer of protection for data that is stored in cloud‑container storage pools. These capabilities prevent objects from being modified or deleted during a specified retention period. Object Lock allows you to specify a fixed period during which an object remains immutable and cannot be overwritten or deleted. Object Retention helps organizations meet regulatory requirements that mandate Write Once Read Many (WORM) data protection.

Before you begin

Review the following requirements and restrictions before configuring GCS Object Retention for cloud‑container storage pools:

Database backup to cloud and retention to cloud storage pools are not supported in pools that use GCS Object Lock.
GCS buckets with enforced retention policies must be used by only one IBM Storage Protect storage pool. Do not share a locked bucket across multiple pools.
Container objects with referenced data at the end of the retention period will have their lock extended by the IBM Storage Protect server until all referenced data expires or is no longer required. Once expired, the container is deleted.
IBM Storage Protect policy settings are independent of the GCS lock duration.

About this task

GCS Object Retention (Bucket Lock) can be used with cloud‑container storage pools for:

Data ingested directly from clients
Data tiered from another storage pool

Object Lock must be enabled during bucket creation. Retention protection applies only after the IBM Storage Protect server writes data to the GCS bucket.

Remember: GCS Object Lock is supported only for new buckets and new cloud‑container storage pools. You cannot disable Object Lock on existing buckets.

GCS provides two retention modes similar to AWS Object Lock:

Retention Modes

Governance Mode: Users with specific IAM permissions can override retention settings to delete or modify protected objects.
Compliance Mode: No users, including administrators, can override the lock before retention expiration. (Not currently supported)

Warning: The IBM Storage Protect server clock must be synchronized with Google Cloud's clock. Significant time differences may cause failures in write and delete operations.

Tip: IBM Storage Protect uses Governance mode by default.

Procedure

To configure GCS Object Retention by using the command-line administrative client, complete the following steps:

Create a GCS bucket with Bucket Lock enabled

Use Google Cloud Console or CLI to create a bucket with Object Lock enabled.

Define the connection to the GCS bucket

DEFINE CONNECTION connection_name \
    cloudtype=google \
    bucketname=gcp_bucket_name \
    keylocation=gcp_key_location

Define the storage pool
```
DEFINE STGPOOL storage_pool_name \
    stgtype=cloud \
    connection=connection_name \
    enableclouddatalock=yes \
    clouddatalockduration=duration_in_days
```
Important:
- Once enableclouddatalock is set to Yes, it cannot be changed back to No.
- The clouddatalockduration must be 1 day or more for production environments.
- The IBM Storage Protect server verifies that the lock configuration matches between the storage pool and the GCS bucket.

Define a storage pool directory for cloud cache

DEFINE STGPOOLDIR storage_pool_name directory_path

What to do next

Once the configuration is complete, the storage pool is ready to receive data. Containers are locked when they are written to the GCS bucket and remain locked as long as they are referenced by IBM Storage Protect clients.

You can view key lock status information with QUERY STGPOOL command. The QUERY STGPOOL command displays:

Cloud Data Locking status
Cloud Data Lock Duration