Replicating a Vault Across Accounts

Scenarios

CBR allows you to replicate server backup vaults and SFS Turbo backup vaults across accounts. Server backup replicas can then be used to create images and provision servers in the destination region. SFS Turbo backup replicas can be used to create file systems in the destination region.

You can replicate backups in either of the following methods on the CBR console:

• Select a backup from the backup list and manually replicate it.
• Select a backup vault and manually replicate it. Alternatively, you can configure a replication policy to periodically replicate backups that have not been replicated or failed to be replicated to the destination region.

This section describes how to manually replicate a backup vault. For details about how to replicate a backup, see Replicating a Backup Across Accounts.

Constraints

• Only backups in server backup vaults and SFS Turbo backup vaults can be replicated across accounts for now.
• Backup data can be replicated to vaults in different regions, and backup replicas occupy the replication vault space.
• A server backup vault can be replicated only when it contains at least one backup that meets all the following conditions:
  1. It is an ECS backup.
  2. It contains system disk data.
  3. It is in the Available state.
• Replication is supported only for backups or vaults created in the source account. Replicated backups and vaults cannot be re-replicated. Backups replicated from other accounts can only be used to create images or SFS Turbo file systems.
• A backup vault can be replicated to different destination regions. For manual and policy-based vault replication, a vault can only be replicated to a destination region once. It cannot be replicated to that region again, even if its backups have been deleted.
• Backups can only be replicated across accounts to regions that support replication.
• Only replication vaults of the same type can be selected as destination vaults. For example, if you want to replicate cloud server backups across accounts, the target account needs to have a cloud server replication vault in the destination region.
• The permission to replicate a checkpoint (cbr:vaults:replicate) and the permission to import a backup (cbr:backups:import) must be granted to the source account.

Creating a Replication Vault with the Destination Account

1. Go to the Buy Server Backup Vault page.
2. Set the required parameters according to the descriptions in Creating a Server Backup. You can configure the other parameters based on service requirements. The following uses a server backup vault as an example. The operations for replicating SFS Turbo backups across accounts are similar.

   Table 1 Parameters for creating a replication vault with the destination account

   Parameter	Example Value	Description
   Protection Type	Replication	Backup: A server backup vault stores server backups. Replication (cross-region): A server replication vault stores replicas of server backups. If you select Replication (cross-region), you do not need to select a server. Select Replication (cross-region) for the vault.
   Cross-Account Replication	Enable	Specifies whether to enable cross-account replication. You can enable this function for cross-account replication. When cross-account replication is enabled, the source vault can be replicated to a target vault under another account, either in the same region or across regions.

3. Click Submit. Confirm the order details and complete the payment.
4. Go back to the Cloud Server Backups page. You can view the created vault in the vault list. The vault is in the Available state.
5. Click the vault name to go to the vault details page.
6. Copy the vault ID in the Basic Information area and provide it to the account that will initiate the replication.
   Figure 1 Destination replication vault ID
   

7. If the source account and target account are not in the same organization, go to the IAM console, create an agency with the required permissions (cbr:backups:get, cbr:backups:import, cbr:backups:delete, cbr:tasks:get, and cbr:vaults:get) for the source account, and provide the agency name to the source account.

Initiating a Cross-Account Replication from the Source Account

1. Log in to the CBR console. Click in the upper left corner and select a region.
2. On the Vaults tab, find the target vault.
3. Choose More > Create Replica in the Operation column of the vault.
   Figure 2 Initiating a cross-account replication

   

4. In the displayed dialog box, configure the parameters as described in Table 2.

   Table 2 Parameter description

   Parameter	Description
   Destination Region	Region where the vault will be replicated to. You do not need to select this option for cross-account replication. If you only need to replicate backups across regions, see Replicating a Vault Across Regions.
   Cross-Account Replication	Specifies whether to enable cross-account replication. You can enable this function for cross-account replication. When cross-account replication is enabled, the source vault can be replicated to a target vault under another account, either in the same region or across regions.
   Accounts In the Same Organization	Specifies whether the two accounts are in the same organization. Enable this function if you need to replicate backups across accounts in the same organization. If this function is not enabled, you need to enter the name of the agency granted by the target account to the current account for replication.
   Destination Replication Vault Identifier	Specifies the ID of the cross-account replication vault of the same type in the destination region. All backups will be replicated to the vault in the destination region. Replication traffic fees will be generated for the source region. Replicated backups take up space in the replication vault. The target account needs to provide the vault ID to the account that initiates the replication. You can click the target vault in the vault list to go to the vault details page and check the vault ID in the Basic Information area.
   Agency Name	Name of the agency granted by the target account to the source account for replication. If the source and destination accounts belong to different organizations, enter the name of the agency granted by the destination account to the source account.

5. Click OK.
6. After the replication is complete, you can switch to the destination region to view generated replicas. For details, see Viewing a Vault. You can then use replicas to create images or file systems.