This document explains how to apply a Backup and DR Service backup plan to yourCompute Engine instance when you create the instance using theGoogle Cloud console.

Use Backup and DR Service backup plans to create rule-based and indelible backupsof your Compute Engine instances and then store those backups in asecure and isolated storage locations.

Backup and DR backup plans let you define advanced backup strategiesto store your Compute Engine instances in secure storage locationscalled backup vaults. Using the backup plan applied to your instance,you can create scheduled or on-demand backups of your instance in abackup vault.

Before you begin

• Enable the Backup and DR Service API where the Compute Engine instances are located.

  Enable the API

• Create a backup vault
• Create a backup plan
• Set up Log Analytics on your bucket to monitorBackup and DR backup jobs.

Required roles

• To get the permissions that you need to create an instance and apply a backup plan during itscreation, ask your administrator to grant you the following IAM roles:

  • To create the instance:Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1) on the project for the Compute Engine instance
  • To configure scheduled backups or run on-demand backups:
    • Backup and DR Backup User (roles/backupdr.backupUser) on the project for the backup vault
    • Viewer (roles/viewer) on the project for the backup vault

  For more information about granting roles, seeManage access to projects, folders, and organizations.

  You might also be able to get the required permissions throughcustom roles or otherpredefined roles.

• If you want to back up a Compute Engine instance to abackup vault that is in a different project than the instance, thenmake sure theBackup and DR Vault Service Agent for the backup vault has beengranted permission to access the instances in that project. (If thebackup vault and instance are in the same project, then thispermission is already granted by default.)

• To ensure that Backup and DR Vault Service Agent has the necessary permissions to back up a Compute Engine instance to abackup vault, ask your administrator to grant Backup and DR Vault Service Agent theBackup and DR Compute Engine Operator (roles/backupdr.computeEngineOperator) IAM role on the project for the Compute Engine instance.Important: You must grant this role to Backup and DR Vault Service Agent,not to your user account. Failure to grant the role to the correct principal might result in permission errors.

Create an instance that has a backup plan applied

To create an instance that has a backup plan applied, follow these steps in theGoogle Cloud console:

1. In the Google Cloud console, go to theCreate an instance page.

   Go to Create an instance

   If prompted, select your project and clickContinue.

   TheCreate an instance page appears and displays theMachine configuration pane.

2. In theName field, specify a name for your instance. For moreinformation, seeResource naming convention.

3. In theRegion field, specify the region where you want your instance.

4. Optional: In theZone field, select a zone for this instance.

   The default selection isAny. If you don't change this defaultselection, then Google automatically chooses a zone for you based onmachine type and availability.

5. To specify a backup plan for this instance, do the following:

   1. In the navigation menu, clickOS and storage. TheOperating system and storage pane appears.

      Important: If you see aData protection pane in the navigation menu,clickData protection instead ofOS and storage and thencontinue with the remaining steps. For more information, see theFebruary 14, 2025 release note.

   2. In theBackup plan section, clickSelect a plan.

   3. In theSelect a backup plan pane that appears, do the following:

      1. Verify that theProject field has the same project name whereyour backup plans exist. If not, select the correct project.
      2. In theBackup plan name column, click the name of the back planthat you want to use.
      3. To confirm your choice of backup plan and return to theOperating system and storage pane, clickApply.

6. Optional. Specify any other configuration parameters of your choice. Formore information about custom configuration options, seeCreate and start an instance.

7. To create and start the VM, clickCreate.

What's next

• Learn how to use your instance's backup plan toschedule or create backups in a backup vault.
• Learn how torestore an instance from a backup vault.
• Learn how tochange the backup plan that's applied to an instance(Preview).