This page explains how to choose, view, and change the option for a project'sdefault backup setting. This page might also help you choose which backupsetting you want to select when creating an instance.

When you create a Compute Engine instance in the Google Cloud console, you canspecify the method that you want to use to back up your data. Thedefault backup setting is a project-wide Compute Engine setting thatspecifies which method is preselected by default when you create an instance inthe Google Cloud console. For example, you can configure the default backup settingto help encourage a project to use your preferred method for automaticallybacking up data.

Before you begin

• To learn about the options that you can use to back up data, seeData protection options. Specifically, this page discusses options for automatically scheduled backups, especiallybackup plans for backup vaults andsnapshot schedules.

Pricing

Some of the backup options incur additional costs when you create an instance.For more information, see the pricing for each option inUnderstand and choose the default backup settingin this document.

Required roles

To get the permissions that you need to choose, view, and change the default backup setting, ask your administrator to grant you the following IAM roles on your project:

• View and change the default backup setting:Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1)
• If you want to use backup plans and need to enable the Backup and DR API:Service Usage Admin (roles/serviceusage.serviceUsageAdmin)

For more information about granting roles, seeManage access to projects, folders, and organizations.

These predefined roles contain the permissions required to choose, view, and change the default backup setting. To see the exact permissions that are required, expand theRequired permissions section:

Required permissions

The following permissions are required to choose, view, and change the default backup setting:

• View and change the Compute Engine settings and metadata for the project:
  • compute.projects.setCommonInstanceMetadata
  • compute.projects.get
• Enable APIs:
  • serviceusage.services.enable
  • serviceusage.services.get

You might also be able to get these permissions withcustom roles or otherpredefined roles.

Important: Unless you configure your project to use theno backups optionby default, you need to also make sure each user that you want to be able tocreate instances has sufficient permissions to back up instances. For example,make sure each user has the Compute Instance Admin (v1)(roles/compute.instanceAdmin.v1) role. For more information, see therequirements listed for each option inUnderstand and choose the default backup settingin this document.

Understand and choose the default backup setting

The default backup setting for a project determines which backup method, if any,is automatically selected when you use theCreate an instance page in the Google Cloud console.Specifically, the default backup setting determines the backup method that isautomatically selected inBack up your data section in theData protection pane.

For reference, theBack up your data section lets you select which backupmethod, if any, to use for your data as follows:

• Back up the instance using a backup plan for a backup vault.
• Back up the disks using a snapshot schedule.
• Don't use automatically scheduled backups.

Optionally, you can select a different option than the automatic selection.

Regardless of the default backup setting, if a backup method is selected,Compute Engine automatically selects a specific backup plan or aspecific snapshot schedule to use. Optionally, you can select a different backupplan or different snapshot schedule before you finish creating the instance.

Note: For more information about which backup plan or snapshot schedule isautomatically selected, seeOptions for the default backup setting.

Limitations for the default backup setting

The default backup setting has the following scope:

• The setting doesn't prevent users from selecting a different backup option.
• The setting affects the project; it's not user specific.

• The setting affects only theCreate an instance page in theGoogle Cloud console.

  • When you use any other method to create an instance, its data isautomatically backed up only if you configure it to.

  • The setting doesn't affect existing instances.

    Note: If you want to change how data is automatically backed up forexisting instances, you can learn how toconfigure backup plans for existing instancesandconfigure scheduled snapshots for existing disksinstead.

• This setting specifies only the type of backup option that's selected bydefault. It's not possible to customize the specific backup plan or specificsnapshot schedule that is selected by default. To use a specific backup planor snapshot schedule that isn't selected by default, select a different optionwhile you're creating the instance.

Options for the default backup setting

The options that you can use for the default backup setting are explained in thefollowing table. Specifically, you can directly choosebackup plan,snapshot schedule, orno backups, but until you choose a default backupsetting, your project uses apredefined behavior.

Options for the default backup setting
Predefined (No option is selected)	Use case: All projects use this behavior until youchange the default backup setting for your project or restore this behavior. Effect: Compute Engine automatically selects a default backup behavior that the project has enabled by using the following logic: If Backup and DR has already been enabled for the project, then the project uses the same behavior as selecting thebackup plan option. Otherwise, the project uses the same behavior as selecting thesnapshot schedule option. Requirements: See the requirements for thebackup plan andsnapshot schedule options respectively. Pricing: See the pricing for thebackup plan andsnapshot schedule options respectively.
Backup plan	Use case: We recommend this option for most projects. Review the use cases for the other options to see if your project is an exception. Caution: If your projectautomatically applies a backup plan to new instances by using tags, we recommend you use theno backups option. Otherwise, when instances use the default backup plan, the tag-based backup plan won't be applied to prevent redundancy. Effect: When you're creating a new instance, backup plans are selected by default to back up data. Specifically, the backup plan that is automatically selected is the default backup plan for the region that contains the instance. When you create an instance, Compute Engine automatically creates a default backup plan and default backup vault for the region as needed and if they don't already exist. Thedefault backup plan runs daily between midnight and 6:00 AM in the local timezone for the region, is stored in the default backup vault for the region, and each backup is retained for a maximum of 14 days. The default backup plan is nameddefault-compute-instance-plan-REGION. ReplaceREGION with the region that contains the instance; for example,us-central1. Thedefault backup vault has a minimum enforced retention period of 1 day. The default backup vault is nameddefault-vault-REGION. ReplaceREGION with the region that contains the instance; for example,us-central1. Requirements: To use this option, the project must have the Backup and DR API enabled. Roles required to enable APIs To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains theserviceusage.services.enable permission.Learn how to grant roles. Enable the API Make sure each user that you want to be able to create instances with this option has thepermissions required to apply a backup plan during instance creation. Backup plans are applied to an instance and its disks only when your configuration supports it. Whenever a user creates an instance that uses this backup plan, make sure the user verifies that the configuration complies with thelimitations for applying backup plans during instance creation. Pricing: Backup plans and vaults incur additional costs. For more information, seeBackup and DR pricing.
Snapshot schedule	Use case: We recommend this option only if any of the following are true for your project: You want to or already store backups in multi-regional locations. For more information about when to use multi-regional locations, seeSnapshot storage locations. You don't match the use case for theno backups option and can't meet the requirements forbackup plan option. Effect: When you're creating a new instance, snapshot schedules are selected by default to back up data. Specifically, the snapshot schedule that is selected by default varies. If the project already has compatible snapshot schedules, the automatic selection is the snapshot schedule that comes first in alphabetical order. Alternatively, if no compatible snapshot schedule exists, the automatic selection is a default snapshot schedule for the region that contains the instance. Compute Engine automatically creates the default snapshot schedule when needed. Thedefault snapshot schedule runs daily at 6:00 PM UTC, is located in the region that contains the instance, stores snapshots in themulti-region that contains the instance, and each snapshot is retained for a maximum of 14 days. The default snapshot schedule is nameddefault-schedule-1 for each region. Requirements: Make sure each user that you want to be able to create instances with this option has thepermissions required to attach a snapshot schedule to a disk. Snapshot schedules are applied to a disk only when your configuration supports it. Whenever a user creates an instance that uses snapshot schedules, make sure the user verifies that the configuration of the instance and each disk complies with thelimitations for snapshot schedules. Pricing: Snapshot schedules incur additional costs. For more information, seeCompute Engine disk snapshot pricing.
No backups	Use case: Use this option only when one or more of the following are true for your project: You're confident that you will have other options to recover your data if it's lost due to unforeseen events. For example, you already use tags to automatically apply backup plans, or you maintain replicated data in a separate location. You're confident that your data won't need to be recovered if it's lost. For example, you only use the project for experimental workloads. You can't meet the requirements for the other options. You can't incur the additional costs for the other options. Effect: When you're creating a new instance, data is not automatically backed up by default. Warning: If you don't back up or replicate your data and your data is deleted or corrupted for any reason, then you won't be able to recover that data. Requirements: This option doesn't have any requirements. Pricing: This option doesn't incur additional costs.

View the default backup setting for a project

To view the default backup setting for a project, do the following:

1. If you haven't already, open the project that you want to view settings forin the Google Cloud console.

   Go to project selector

2. In the Google Cloud console, go to theSettings page for Compute Engine.

   Go to Settings

   TheDefault data protection section displays the option that your projectuses for the default backup setting. If none of the radio buttons areselected, then your project uses thepredefined behavior.

Change the default backup setting for a project

To change the default backup setting for a project, do the following in theGoogle Cloud console:

1. Review the options for the default backup settingand decide which option you want to use.For the selected option, ensure that it matches your use case and that youmeet the requirements.

2. If you haven't already, open the project that you want to change settingsfor in the Google Cloud console.

   Go to project selector

3. Based on the option that you want to choose for the default backup setting,do one of the following:

   • If you want to choose thebackup plan,snapshot schedule, orno backups option, then complete the following steps:

     1. In the Google Cloud console, go to theSettings page forCompute Engine.

        Go to Settings

     2. ForDefault data protection, choose the new option.

     3. ClickSave.

   • If you want to revert to thepredefined behavior thatCompute Engine had automatically selected for the project,complete the steps toremove project metadatafor thegoogle-compute-default-data-protection metadata entry.

Update the default backup setting for all projects in an organization at once

If you want to set or update the default backup setting for all projects in anorganization at once, then you can't use the Google Cloud console. Instead,you can use gcloud CLI to update the setting in the project metadataand automate this update across all projects in the organization. To performthis automation, follow these steps:

1. Review the options for the default backup settingand decide which option you want to use.For the selected option, ensure that it matches your use case and that youmeet the requirements.

2. Create a script to automate running thegcloud compute project-info add-metadata commandfor all projects in the organization. Specify the--metadata google-compute-default-data-protection flag with the value ofthe option that you want to change the default backup setting to. Considerthe following examples:

   • To set or update the default backup setting across all projects in theorganization toNo backups, use the following command in your script:

     gcloud compute project-info add-metadata \--project=PROJECT_NAME \--metadata=google-compute-default-data-protection=NONE

   • To set or update the default backup setting across all projects in theorganization toBackup plan, use the following command in your script:

     gcloud compute project-info add-metadata \--project=PROJECT_NAME \--metadata=google-compute-default-data-protection=BACKUP

   • To set or update the default backup setting across all projects in theorganization toSnapshot schedule, use the following command in yourscript:

     gcloud compute project-info add-metadata \--project=PROJECT_NAME \--metadata=google-compute-default-data-protection=SNAPSHOT_SCHEDULES

   ReplacePROJECT_NAME with the name of the project.

   To learn more about setting and updating your project's metadata,seeSet and remove custom metadata.

What's next

• Learn how tocreate and start an instance.
• Learn how torestore an instance from a backup vault.
• Learn how torestore an instance from a snapshot.