Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 2.15.0

Cloud Vault for Data Orchestration for Dell

Introduction​

Cloud Vault combines Golden Copy with S3-based object storage and Ransomware Defender's Zero Trust Backup API to create a next-generation cyber vault: an immutable, versioned copy of PowerScale data that can only be reached over the S3 protocol in steady state, with a rapid recovery path back to production.

Key Capabilities​

  • 3-2-1 alignment with S3-only access: the vault copy is reachable only through the S3 protocol during normal operation, reducing the attack surface compared to a file-protocol-accessible copy.
  • Rapid recovery time objective (RTO): recovery can be driven from PowerScale snapshots taken on the vault-side copy, rather than relying solely on S3 version-aware recall, which is significantly faster for bulk point-in-time recovery.
  • File versioning: S3 bucket versioning retains multiple versions of each object. On the PowerScale on-premises variant described below, versions are instead retained through PowerScale snapshots on the vault path, which use block-level differencing and are typically far more space-efficient than S3 bucket versioning, where each retained version consumes the full size of the file regardless of how many bytes changed.
  • Object Lock immutability: bucket-level Object Lock can be applied so vault data cannot be deleted or modified for a defined retention period.
  • Zero Trust Backup integration: Golden Copy can integrate with Ransomware Defender's Zero Trust Backup API so that replication to the vault automatically stops if the source data set is under active threat.

Prerequisites​

  • Cloud object storage (or on-premises S3-compatible storage) for the vault target.
  • Security Bundle subscription and Data Orchestration Bundle subscription.

Configuration Steps​

Enable Zero Trust API Integration with Ransomware Defender​

Configure Golden Copy with the Ransomware Defender (Eyeglass) IP address and an API token, following the same steps documented in Smart AirGap / Ransomware Defender Integration. This ensures backup jobs to the vault are automatically blocked if an active threat is detected on the source data.

Configure the Cloud Storage Bucket​

  1. Create the vault bucket following your storage provider's bucket creation steps.
  2. Configure bucket versioning and Object Lock retention as needed for your compliance requirements. See Compliance Guide for Object Lock configuration details.

Configure Golden Copy​

note

Delete handling must be configured globally on Golden Copy. Decide whether deleted files on the source should be deleted from the vault bucket during incrementals, or retained in the vault. See Sync Deleted Files During Incremental Jobs in the Configuration Guide.

  1. Log in to Golden Copy as ecaadmin.
  2. Add a folder definition targeting the vault bucket, using the storage target example matching your cloud provider from Adding Folders with the CLI.
  3. Run a full backup job to seed the vault copy.
  4. Configure an incremental schedule on the folder definition, timed to run before the scheduled snapshot on the vault cluster, so the snapshot captures a consistent post-sync state.
  5. Best practice: enable the Golden Copy cluster configuration backup feature, which exports shares, NFS exports, and quotas to JSON and stores a copy on the vault cluster. This provides a device-level restore path for cluster configuration alongside the data protection provided by the vault copy. See Export/import appliance configuration in the Configuration Guide.

On-Premises Variant: PowerScale as the S3 Vault Target​

Instead of a cloud or ECS S3 target, the vault bucket can be hosted directly on PowerScale's own S3 protocol service, giving a fully on-premises Cyber Vault built entirely on Golden Copy, Ransomware Defender, and PowerScale snapshots. This variant can also be paired with a secondary cloud storage copy for an offsite copy of the vault data.

Additional prerequisites for this variant:

  • PowerScale 9.x or later.
  • Golden Copy 1.1.7 or later with the Advanced license key.
  • Ransomware Defender 2.5.12 or later.

Configure the PowerScale bucket:

  1. Log in to PowerScale and create an S3 bucket (for example, /ifs/data/cybervaultdata).
  2. Create a set of S3 access keys associated with an Active Directory or local user.
  3. Create a daily snapshot on the same path used by the bucket, with a retention period matching your recovery point objective (RPO) — for example, a daily snapshot retained for 30 days.

Configure Golden Copy against the PowerScale bucket:

  1. Add a folder definition targeting the PowerScale S3 bucket, using --cloudtype ecs with the PowerScale S3 service endpoint and the IP pool serving the bucket for --endpoint-ips, following the same pattern as Adding Folders with the CLI.
  2. Run a full backup job to seed the vault bucket.
  3. Configure an incremental schedule on the folder definition timed to run before the scheduled snapshot on the vault path, so each snapshot captures a consistent post-sync state.

Recovery for this variant follows the same scenarios described below, using PowerScale snapshot retention on the vault path in place of S3 bucket versioning for point-in-time recovery.

Data Recovery Scenarios​

  • Scenario 1 — Read/write access to the vault snapshot: mount the vault path over SMB or NFS in read-only or read/write mode, and select a specific snapshot version to revert to a prior point in time, based on the vault cluster's snapshot retention settings.
  • Scenario 2 — Golden Copy recall: restore data to the source PowerScale using the Golden Copy recall feature, with full or partial recovery of any path prioritized as needed.
  • Scenario 3 — SyncIQ-based recovery: create SyncIQ policies on the vault cluster and use differential mode to copy only updated data back to the production cluster, or replicate to a new PowerScale cluster entirely.
  • Scenario 4 — Cluster configuration restore: if the configuration backup feature was enabled, copy the exported JSON files to the PowerScale cluster and use the appropriate import configuration commands to restore share, export, and quota configuration. Consult Dell support for the cluster-specific import steps.

Summary​

Cloud Vault provides a cyber vault on S3 storage capable of sharing data in a read-only state while enforcing immutability, combining Golden Copy's object copy engine, S3 Object Lock, and Ransomware Defender's Zero Trust Backup API into a single vault architecture.

See Also​