Required User permissions
Permissions required by the Virtualization (per DB type)
DB type / platform | Source (Golden Image) | Destination (VDB) |
Oracle on-prem | SYSDBA (ALTER DATABASE BEGIN/END BACKUP, ALTER SYSTEM SWITCH LOGFILE, RMAN incr-copy via rman target /) + SELECT_CATALOG_ROLE for v$/dba_* discovery + EXECUTE DBMS_METADATA | SYSDBA (STARTUP, RMAN restore/recover, OPEN RESETLOGS, RENAME FILE, ALTER USER/PROFILE, orapwd, nid) |
Oracle RDS | Master user + EXECUTE on rdsadmin.rdsadmin_rman_util / rdsadmin_s3_tasks / rds_file_util / rdsadmin_util; SELECT on rdsadmin.rds_configuration, dba_directories, v$* | (VDB is on-prem-style → same as Oracle on-prem SYSDBA) |
PostgreSQL | Superuser — pg_backup_start/pg_backup_stop (or pg_start/stop_backup), pg_wal_replay_pause/resume, pg_read_file, COPY … TO. Native-backup path also needs the REPLICATION role + pg_hba.conf replication line (pg_basebackup -C --slot=accelario)† | Superuser — ALTER SYSTEM SET, ALTER USER … PASSWORD, ALTER/DROP SUBSCRIPTION, pg_ctl promote |
MySQL on-prem | XtraBackup: RELOAD, PROCESS, LOCK TABLES, REPLICATION CLIENT, BACKUP_ADMIN (8.0+) | Self-provisioned — mysqld --initialize-insecure then Loki runs CREATE USER … GRANT ALL … WITH GRANT OPTION (no pre-existing grant needed) |
MySQL RDS/Aurora | Master: RELOAD, REPLICATION CLIENT/SLAVE, SELECT on performance_schema. Replica: REPLICATION CLIENT + CALL mysql.rds_stop/start_replication + SELECT+BACKUP_ADMIN for mysqlsh dumpInstance | (same self-provisioned intermediate) |
SQL Server on-prem | sysadmin in practice (sp_configure+xp_cmdshell, RECONFIGURE, BACKUP DATABASE, RESTORE HEADERONLY/FILELISTONLY, VIEW SERVER STATE) | sysadmin (CREATE DATABASE, ALTER DATABASE ADD/REMOVE FILE, SET OFFLINE/ONLINE, CREATE LOGIN/USER, ALTER ROLE db_owner) |
SQL Server RDS | AWS rds_backup_operator role — EXEC msdb.dbo.rds_backup_database / rds_tlog_backup_copy_to_S3 / rds_task_status, SELECT rds_fn_list_tlog_backup_metadata, VIEW SERVER STATE | sysadmin on the on-prem VDB |
SQL Server Azure MI | db_backupoperator + ALTER ANY CREDENTIAL (CREATE CREDENTIAL … SHARED ACCESS SIGNATURE, BACKUP … TO URL, RESTORE FILELISTONLY FROM URL) — sysadmin in practice on MI | sysadmin on the on-prem VDB |