Configuring Azure Object Lock for cloud storage pools

Edit online

You can configure Azure Object Lock (based on Azure version-level immutability) to protect data stored in cloud-container storage pools. Azure Object Lock adds an additional layer of protection against accidental deletion or modification. It allows you to specify a retention period during which an object is locked and cannot be overwritten or deleted. This capability also helps meet regulatory requirements that mandate Write Once Read Many (WORM) storage.

Before you begin

Review the following requirements and restrictions before configuring Azure Object Lock for cloud-container storage pools:
  • Database backup to cloud and retention to cloud storage pools are not supported with Azure Object Lock enabled storage pools.
  • Azure containers must have Blob Versioning and version-level immutability enabled to support Azure Object Lock.
  • Azure containers with immutability support must be used by only one IBM Storage Protect storage pool. Do not share an Azure container configured Object Lock across multiple storage pools.
  • Cloud-container objects with referenced data at the end of the lock period will have their lock extended by the IBM Storage Protect server until all referenced data expires or is no longer needed. The cloud container object is deleted after the lock expires.
  • IBM Storage Protect policy is independent from the Object Lock duration.

About this task

Azure Object Lock can be used with cloud-container storage pools for data ingested directly from a client or for data tiered from another storage pool. Blob Versioning and version-level immutability support for Azure containers must be enabled during storage account creation in the Azure Portal. Data in cloud-container storage pools is protected only when the data is written to the Azure container by the IBM Storage Protect server.
Remember: Azure Object Lock is supported only for new cloud-container storage pools and new Azure containers. Existing Azure containers and storage pools are not supported.
Azure provides two immutability modes similar to AWS Object Lock:
  • UNLOCKED: Users with specific IAM or RBAC permissions can overwrite or delete protected object versions during the retention period.
  • LOCKED: No users can overwrite or delete protected object versions during the retention period. (Not currently supported )
Warning: The IBM Storage Protect server clock must be synchronized with the cloud provider's clock. Significant time differences between the IBM Storage Protect clock and the cloud provider's clock could result in connection, write and delete operation failures, including errors such as ANR4137E indicating an inability to delete an object.
Tip: IBM Storage Protect uses the UNLOCKED mode by default for Azure Object Lock containers.

Procedure

To configure Azure Object Lock using command-line administrative client, complete the following steps:

  1. In the Azure portal, create a storage account and enable Blob Versioning and Immutability support as described in Protecting Data with Azure Version-level immutability policies.
  2. Issue the following command to define the IBM Storage Protect server's connection with cloudURL and password pointing to the storage account created in Step 1. 
    DEFINE CONNECTION connection_name cloudtype=azure cloudURL=URL pa=sas_token
  3. Issue the following command to define a storage pool. 
    DEFINE STGPOOL storage_pool_name stgtype=cloud connection=connection_name enableclouddatalock=yes clouddatalockduration=duration in days
    Important:
    • Once enableclouddatalock is set to Yes, it cannot be changed back to No.
    • The clouddatalockduration must be 7 days or more for production environments.
    • The IBM Storage Protect server verifies that cloud data lock parameters are synchronized between the storage pool and the bucket.
  4. Issue the DEFINE STGPOOLDIR command to add a storage pool directory to be used as the cloud cache. 
    DEFINE STGPOOLDIR storage_pool_name directory_name

What to do next

After configuration, the storage pool is ready to receive data. Objects are locked when written to the Azure container and remain locked as long as they are referenced by IBM Storage Protect clients. You can view the following information on the Object Lock status for cloud-container storage pools by issuing the QUERY STGPOOL command:
  • Cloud Data Locking: Indicates whether the storage pool is enabled for data locking.
  • Cloud Data Lock Duration: Indicates the number of days for which the cloud storage pool data remains locked.
You can also view the Object Lock status for storage pools by using the IBM Storage Protect Operations Center. To view the details of a storage pool, complete the following steps:
  1. Sign on to the IBM Storage Protect Operations Center.
  2. Select Storage > Storage Pools.
  3. Select a storage pool and click Details.
    Tip: Double-click a storage pool to view its details.
  4. Select Containers to view container-specific information.

You can update the number of days for which the IBM Storage Protect server retains the cloud-container storage pool data by using the clouddatalockduration parameter in the UPDATE STGPOOL command. The IBM Storage Protect server retains new containers for the updated duration, and existing containers are extended accordingly when the lock duration is renewed.