Backing up your buckets

IBM Cloud® Object Storage Backup gives users the ability to create point-in-time consistent backups of IBM Cloud Object Storage buckets that are resilient to attackers, accidental deletion or modification. It is a policy-driven service that allows for cross-account and cross-region backup of IBM Cloud Object Storage buckets.

Central to IBM Cloud Object Storage Backup is a new user-managed IBM Cloud Object Storage resource called a BackupVault. Backup vaults store backup data in a secure, unmodifiable manner that provides a high degree of data integrity. Backup vaults are provisioned within a IBM Cloud Object Storage instance alongside buckets, but are managed and behave differently than buckets.

Backups are generated by setting a BackupPolicy on an IBM Cloud Object Storage bucket that targets a BackupVault as a backup storage destination. When this policy is set IBM Cloud Object Storage will immediately begin syncing existing data from the bucket to the BackupVault. Any new data written to the bucket will continuously be synced to the BackupVault. Data sync occurs as long as the policy exists and is in an active state. This continuous backup approach allows users to restore objects from any point in time. IBM targets up to one hour for objects to sync to backup, which translates to a Recovery Point Objectives (RPO) of one hour or less.

When a BackupPolicy becomes active, a resulting RecoveryRange is created in the target BackupVault. The initial creation of a RecoveryRange requires that all the existing data on the source bucket is synced to the BackupVault. The time it takes for the RecoveryRange to be created depends on the amount of data stored in the source bucket. IBM Cloud Object Storage reports the status and % progress of the BackupPolicy while this initialization is in progress. Note that the resulting RecoveryRange is not visible until after it has been fully initialized.

Backup data in a BackupVault is represented as a list of recovery ranges. Each RecoveryRange defines a range in time for which point-in-time consistent backup coverage exists for a specific IBM Cloud Object Storage bucket. This range in time is reported as start and end times that are continuously updated as new data is backed up and old data is expired. The end time moves forward as new data is synced to the RecoveryRange by the source bucket's backup policy. The start time moves forward as the recovery range's retention configuration causes old data to be deleted.

When created, the RecoveryRange's lifespan is entirely dictated by its retention configuration and the status of the BackupPolicy A RecoveryRange is only fully deleted when the BackupPolicy is removed and the retention configuration on the RecoveryRange has deleted all the data, causing the start time to become equal to the end time.

The data in a recovery range can be written to a IBM Cloud Object Storage bucket through a Restore operation. When performing a restore, the point-in-time to restore-to must be specified, and must exist between the start and end times reported for the recovery range. This operation triggers IBM Cloud Object Storage to write data from the BackupVault to a destination bucket.

The time it takes for a restore operation to complete depends on the amount of data that must be transferred from the BackupVault to the target bucket. IBM Cloud Object Storage reports the status and % progress of the restore operation while it is in progress.

The objects restored represent the object versions that were current on the source bucket at the requested restore point-in-time. Only the current versions at the point-in-time are restored. No noncurrent versions are restored.

GET /backup_vaults/myBackupVault/recovery_ranges HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json
Host: config.cloud-object-storage.cloud.ibm.com

{
  "next": {
    "token": "SWYwNTZMflFmZUgheGNcNHMuIm9OMTFz",
    "href": "config.cloud-object-storage.cloud.ibm.com/v1/backup_vaults/mybackupvault/recovery_ranges?token=1znNRhmyheG-pm6mlMKFsoxcKXFnW1hgBb2_6ZReqHduL3rivfeBWHeyL-OaJvtfVZjKrgRVmODtOdVeQEXkKCxDWpA5hRWuv9WgTPR2eLIN9fbEaTxqdNO4dp0sQeHh4HO-13nTgRV_1QGiR1QFzREHX3wzquLn9o_1DZZAEP-vAY2V8d6BCA1z2krhpMfswKJ8r6UynUc0W5JHSH4auwJ6jC-h8sc8NEcQpHUx2Ep4oxebmtJMaycQSjLA3J2fdcYuysKq3YIcszDnPte0zwr25x5_GmBrxlgd2oesjfyTaLHfIg1g4TD0uH9m9aEAv"
  },
  "recovery_ranges": [
    {
      "recovery_range_id": "44d3dd41-d616-4d25-911a-9ef7fbf28aef",
      "source_resource_crn": "crn:v1:bluemix:public:cloud-object-storage:global:a1229395:8dfbcba4e6a740e3866020847e525436:bucket:sourcebucket",
      "backup_policy_name": "myBackupPolicy",
      "range_start_time": "2024-06-02T12:00:00.000Z",
      "range_end_time": "2024-06-03T12:00:00.000Z",
      "range_create_time": "2024-06-02T12:00:00.000Z",
      "retention": {
        "delete_after_days": 100
      }
    },
    {
      "recovery_range_id": "6ff0d31c-7583-4463-8ae5-208752f5769c",
      "source_resource_crn": "crn:v1:bluemix:public:cloud-object-storage:global:a1229395:8dfbcba4e6a740e3866020847e525436:bucket:sourcebucket",
      "backup_policy_name": "myBackupPolicy",
      "range_start_time": "2024-06-04T12:00:00.000Z",
      "range_end_time": "2024-06-05T12:00:00.000Z",
      "range_create_time": "2024-06-04T12:00:00.000Z",
      "retention": {
        "delete_after_days": 100
      }
    }
  ]
}

GET /backup_vaults/myBackupVault/recovery_ranges/44d3dd41-d616-4d25-911a-9ef7fbf28aef HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json
Host: config.cloud-object-storage.cloud.ibm.com

{
  "recovery_range_id": "6ff0d31c-7583-4463-8ae5-208752f5769c",
  "source_resource_crn": "crn:v1:bluemix:public:cloud-object-storage:global:a1229395:8dfbcba4e6a740e3866020847e525436:bucket:sourcebucket",
  "backup_policy_name": "myBackupPolicy",
  "range_start_time": "2024-06-04T12:00:00.000Z",
  "range_end_time": "2024-06-05T12:00:00.000Z",
  "range_create_time": "2024-06-04T12:00:00.000Z",
  "retention": {
    "delete_after_days": 100
  }
}