Permissions and roles for Backup Vault Restore of a postgreSQL flexible server

Öksüz, Enes 5

I am currently trying to use the Azure Backup Vault for our PostgreSQL flexible servers. I have followed this tutorial https://learn.microsoft.com/en-us/azure/backup/backup-azure-database-postgresql-flex-overview and provided the required permissions to my components. The backup works perfectly fine, i can create a backup, but I am encountering exceptions during the restore process. The permissions are detected correctly, otherwise a different error is shown, but still something seems to be missing. Unbenannt

SadiqhAhmed-MSFT 45,671 Reputation points Microsoft Employee

2024-08-09T20:36:57.27+00:00

Hi @Öksüz, Enes Greetings!

Sorry for the delayed response. Backup vault uses Managed Identity to access other Azure resources. To restore from backup, Backup vault’s managed identity requires a set of permissions on the target to be restored to. To restore the recovery point as files to a storage account, Backup vault's system assigned managed identity needs access on the target storage account as mentioned here.

You are getting "UserErrorMSIMissingPermissions" error while performing restore operation.

Reference link: Troubleshoot Azure Database for PostgreSQL - Flexible server backup (preview)

To successfully perform restore operations, you need to assign "Storage Blob Data Contributor" role on the target storage account.

For more details, refer to the document here - https://learn.microsoft.com/en-us/azure/backup/restore-azure-database-postgresql#restore-permissions-on-the-target-storage-account

Hope this helps. Let us know how it goes!

If the response helped, do "Accept Answer" and up-vote it
Svennes, Bjørn Terje 0 Reputation points

2024-09-27T10:45:03.41+00:00

I have the same issue. The backup vault's MSI has Storage Blob Data Contributor role assignment on the storage account, in addition to Reader on the resource group of the database and PostgreSQL Flexible Server Long Term Retention Backup Role on the database itself. Backup works fine, but restore fails with the same error as above.
SadiqhAhmed-MSFT 45,671 Reputation points Microsoft Employee

2024-09-27T14:40:00.8266667+00:00

@Svennes, Bjørn Terje For Restore: Storage Blob Data Contributor role on the target storage account is required. If you already have it assigned, then it is best to contact Azure technical support team for further assistance.
Svennes, Bjørn Terje 0 Reputation points

2024-09-27T14:43:24.3+00:00

Thank you @SadiqhAhmed-MSFT I will do that.
Svennes, Bjørn Terje 0 Reputation points

2024-10-08T13:02:03.04+00:00

For others with similar issues: The cause of our problem was that the storage account is using a private endpoint. The backup vault doesn't have line of sight then. We had to add it to the "Resource instances" list on the "Network" blade of the storage account so that it can get access. This solved the problem.
SadiqhAhmed-MSFT 45,671 Reputation points Microsoft Employee

2024-10-08T17:16:56.2466667+00:00

@Svennes, Bjørn Terje Thanks for sharing the solution that worked for you. This should be helpful to others on this community.

Share via

Permissions and roles for Backup Vault Restore of a postgreSQL flexible server

Your answer