This topic describes how you can set up a WORM (write once and read many) solution by
using IBM Storage Scale, Transparent cloud
tiering, and IBM Cloud® Object
Storage.
IBM Storage Scale provides the immutability feature where you
can associate a retention time with files, and any change or deletion of file data is prevented
during the retention time. You can configure an IBM Storage Scale fileset with an integrated Archive Manager (IAM) mode by using the mmchfileset
command. Files stored in such an immutable fileset can be set to immutable or append-only by using
standard POSIX or IBM Storage Scale commands. For more
information on immutability features available in IBM Storage Scale, see Immutability and appendOnly features.
After immutability feature is configured in IBM Storage Scale, you can ensure that files that are stored on the Object Storage are immutable by leveraging the
locked vault feature available in IBM Cloud Object
Storage.
Locked vaults enable storage vaults to be created and registered under the exclusive control of
an external gateway application.
IBM Cloud Object
Storage
stores objects received from the gateway application. The gateway authenticates to the
IBM Cloud Object
Storage Manager exclusively by using an RSA private key
and certificate that was configured to create a locked vault and registered only with the gateway.
After that, the normal S3 APIs can be used against the Accesser nodes by using the configured private key and certificate. Accesser API key and secret key for S3 API cannot be used for authentication or authorization. If a key is compromised, the gateway rotates keys by calling the Rotate Client Key Manager REST API. This API replaces the existing key and revokes the old certificates. A locked vault with data cannot be deleted by the
IBM Cloud Object
Storage Administrator, and its ACLs cannot be
changed. Additionally, it cannot be renamed or have proxy setting enabled. For more information
about locked vaults, see
IBM Cloud Object
Storage System
Locked Vault Guide.
Note: To configure WORM feature at the fileset
level, it is recommended to match the immutable filesets with immutable container pair sets on the
cloud.