Commvault Object Storage
You set up commvault object storage by linking cloud buckets to media servers with scoped keys. This lets your backup software write, read, and delete data blocks in cloud buckets. Most teams create a cloud account and add the keys to the backup console. When those roles are too wide, any user with console rights can delete backup files. How commvault object storage works Backup tools treat cloud buckets as deep pools for long-term files and snapshots. Instead of using local disk drives, the
Insecure Direct Object References (IDOR): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up commvault object storage by linking cloud buckets to media servers with scoped keys. This lets your backup software write, read, and delete data blocks in cloud buckets. Most teams create a cloud account and add the keys to the backup console. When those roles are too wide, any user with console rights can delete backup files.
How commvault object storage works
Backup tools treat cloud buckets as deep pools for long-term files and snapshots. Instead of using local disk drives, the backup server sends data blocks over the web. It uses standard web calls to write new blocks and read old ones.
To make this work, an admin creates a cloud role or key pair. The admin puts those keys into the backup media server console. The media server then uses that identity for every bucket action it runs.
Teams often separate hot tiers from cold tiers to save money on cloud bills. The server moves older blocks to cold buckets based on age rules. Every move, read, and delete task uses the same saved cloud key.
How to set up bucket roles and permissions
Start by creating a dedicated role in your cloud provider for the backup server. Scope this role so it only sees the exact buckets needed for backups. Do not give this role admin rights over other cloud buckets or servers.
Grant read, write, and list rights on the target backup buckets. If your retention plan deletes old data, add delete rights to the role too. For audit storage locks, allow the role to read and set lock dates on objects.
Next, log in to your backup console and add a new cloud library. Pick your cloud provider type and enter the bucket region and endpoint name. Paste the role details or static keys into the credential store and save them.
Run a quick test write from the media server to check the path. Check your cloud logs to see that the right role made the test call. Repeat this step for each new bucket tier you add to the system.
Insecure Direct Object References (IDOR): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What native storage setups solve and what they miss
Native bucket roles and console rules control which server or admin can log in. They also help teams group media servers and assign them to specific backup plans. This basic setup works well for routine automated night jobs.
Still, static keys saved in a console create a big operational gap. Once a media server or admin session starts, the cloud role allows every valid call. The setup decides who logs in, not what individual requests do in flight.
An admin fixing a bad backup job might log in to the media host. From that host, the admin can run raw commands or query backend catalog databases. Static cloud keys cannot tell an automated job apart from a manual shell command.
Shared admin accounts also make audit logs hard to read during a security review. You see that the backup role deleted objects, but not which person triggered it. Also, when engineers query backup metadata or logs, raw emails and phone numbers appear. Native storage permissions do not rewrite sensitive fields like card numbers or national IDs.
Teams also struggle to rotate static keys that sit inside multiple media servers. If you change a key in the cloud, you must update every server right away. If you miss one host, night backup jobs fail and alert the whole team.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
How do I limit what a backup server can do in a bucket?
Create a dedicated cloud role that only applies to your specific backup buckets. Grant only read, write, and list rights, and turn on object locks for safety.
Why are static cloud keys risky for backup servers?
Static keys stay valid until an admin changes them in both systems. Anyone who gets onto the media server can use those keys to read or delete backups.
How can teams protect sensitive data during backup troubleshooting?
Keep engineers off full admin roles and check every command or query in flight. Use data masking to rewrite emails, phone numbers, and card numbers in query results.