Configuring immutable storage on IBM Cloud Object Storage and IBM Cloud Object Storage System for cloud storage pools

Edit online

You can configure the immutable storage feature on IBM Cloud® Object Storage System (on-premises) and IBM Cloud Object Storage (public cloud) to protect the data that is stored in the cloud-container storage pools. Immutable object storage enables the storage of objects by using a Write Once Read Many (WORM) model that prevents objects from being deleted and overwritten for a fixed amount of time. It adds another layer of protection against unintended changes and deletion of objects. Also, it helps you to meet regulatory requirements that need WORM models.

Before you begin

Review the following requirements and restrictions before you configure the immutable storage feature for cloud-container storage pools:
  • You cannot use storage pools configured for immutable storage to back up databases or retention to cloud storage pools in IBM Cloud Object Storage System nor IBM Cloud Object Storage.
  • If you enable immutable storage on an IBM Cloud Storage bucket, that bucket can be used by only one IBM Storage Protect storage pool.
  • Container objects that have referenced data at the end of the lock duration will have their lock extended until all the referenced data have expired or are no longer needed. The container object is deleted after the lock expires.
  • IBM Storage Protect policy is independent from the immutable storage duration.

About this task

Immutable storage feature for IBM Cloud Object Storage System and IBM Cloud Object Storage can be used with cloud-container storage pools for data that is directly ingested from a client or tiered from another storage pool. The immutable storage setting is enabled when you create the vault (bucket). This setting protects the data in cloud-container storage pools in either on-premises or public cloud. To know more about immutable object storage, refer to Use Immutable Object Storage
Remember: The immutable storage feature for IBM Cloud Object Storage System and IBM Cloud Object Storage is available only for new cloud container storage pools. This feature is not available for either retention sets or database backup to cloud.
Warning: The IBM Storage Protect server clock must be in synchronization with the cloud provider's clock. If there is a significant difference between the IBM Storage Protect clock and the cloud provider's clock, then this difference could result in connection, write operational and delete operation failure. This might include, but is not limited to, receiving message ANR4137E indicating that we cannot delete an object.

Procedure

To configure the immutable feature on IBM Cloud Object Storage System and IBM Cloud Object Storage by using the command-line administrative client, complete the following steps:

  1. If you use IBM Cloud Object Storage System, create a vault by using the following steps:
    1. Click Create Vault.
    2. Select the template and click Continue.
    3. Enter the Name and select Storage Efficiency or Performance under Vault Optimization.
    4. In the Protection section, select Enable in the Retention field.
    5. Specify the default Retention Duration as 1, the Minimum Duration as 0 and the Maximum Duration as the value you choose.
    6. Click Save.
    7. Click Deployment, specify the access pool, and click Update.
    8. Specify the user access from the Authorized Users section.
  2. Alternatively, to create a bucket on IBM Cloud Object Storage (public cloud), complete the following steps:
    1. Open IBM Cloud Console and click Create Bucket.
    2. Select Customize your bucket.
    3. Enter Bucket Name and select Resiliency.
    4. Select Storage Class.
    5. In the Retention policy section, click Add.
    6. Specify the Default Retention Period as 1, the Minimum Retention Period as 0 and the Maximum Retention Period as you choose.
    7. Click Save and then click Create Bucket.
  3. Issue the DEFINE CONNECTION command to define the IBM Storage Protect server's connection with the new vault (bucket). 
    DEFINE CONNECTION connection name cloudtype=s3 bucketname=bucket_name_from_step1 cloudURL=URL id=userid pa=password
  4. Issue the DEFINE STGPOOL command to define a storage pool. 
    DEFINE STGPOOL storage pool name stgtype=cloud connection=connection name enableclouddatalock=yes clouddatalockduration=duration in days
    Important: If the enableclouddatalock parameter is set to Yes, then it cannot be changed back to No. The clouddatalockduration parameter must be set to 7 days or more for production systems.
  5. Issue the DEFINE STGPOOLDIR command to add a storage pool directory to be used as the cloud cache. 
    DEFINE STGPOOLDIR storage pool name directory name

What to do next

The storage pool is ready to receive data after the immutable storage feature is configured. The cloud objects get locked when containers are moved into the IBM Cloud Object Storage bucket and remain locked as long as data is referenced by the IBM Storage Protect clients.

You can view the following information on the immutable storage status for cloud-container storage pools by using the QUERY STGPOOL command:
  • Cloud Data Locking: Indicates whether the storage pool is enabled for data locking.
  • Cloud Data Lock Duration: Indicates the number of days for which the cloud storage pool data remains locked.
You can also view the immutable storage status for storage pools by using the Operations Center. To view the details of a storage pool, complete the following steps:
  1. Sign on to the Operations Center.
  2. Go to Storage > Storage Pools. A list of configured storage pool appears.
  3. Select a storage pool and click Details.
    Tip: You can also double-click a storage pool to view its details.
  4. Select Containers. The information for each container in the storage pool appears.

Also, you can update the number of days for which the server retains the cloud-container storage pool data by using the clouddatalockduration parameter in the UPDATE STGPOOL command.