How to Set Up Impossible Cloud Storage as a Cloud-Container Storage Pool in IBM Storage Protect

Prerequisites

Before you begin, please ensure you have the following:

1. You have access to a storage account in the Impossible Cloud Storage Console (ICSC).
2. You have a working IBM Storage Protect server (integration was tested for version 8.1.18 or later) and access to either the Operations Center or the command-line administrative client (dsmadmc).
3. Time on the IBM Storage Protect server is synchronized with a reliable time source. A significant clock skew between the server and the cloud provider can cause connection, write, and delete operations to fail.

Step 1: Create a new bucket in Impossible Cloud

Login to your Impossible Cloud storage account and create a bucket from the buckets menu. Here is a link to the Impossible Cloud Storage documentation, which includes detailed instructions for creating a bucket.

If you plan to use the IBM Storage Protect S3 Object Lock feature for immutable, WORM-style backups, enable versioning and object lock when you create the bucket. Do not set a retention period at the bucket level — IBM Storage Protect will manage the lock duration for each container object.

Step 2: Generate access key and secret key

Login to your ICSC account and generate an access key and secret key pair for an IAM user with proper permissions.

The IAM user that owns the access key pair must have permission to read, write, and delete objects in the bucket you created in Step 1. If you enabled Object Lock on the bucket, the user also needs permission to manage object versions and retention settings.

Store the Access key and Secret key in your secrets manager / vault as you will need them in the next steps.

Step 3: Identify the correct S3 endpoint URL

IBM Storage Protect needs the S3 endpoint URL of the region in which you created the bucket in Step 1. You can find the right URL on your bucket details page in ICSC, or you can choose the correct S3 regional endpoint from our documentation.

Step 4: Configure the cloud-container storage pool

You can configure the storage pool either through the IBM Storage Protect Operations Center or through the command-line administrative client. Choose whichever path matches how you usually manage your server.

Option A - Using the Operations Center (Add Storage Pool wizard)

1. Sign in to the IBM Storage Protect Operations Center.
2. Go to Storage > Storage Pools and click + Storage Pool.
3. On the Identity page, enter a descriptive Name and Description for the pool, then click Next.
4. On the Type page, select Container-based storage and Off-premises cloud, then click Next.
5. On the Credentials page, enter the following values:
   • Cloud type: s3
   • Access key ID: the access key from Step 2
   • Secret access key: the secret key from Step 2
   • Existing bucket name: the bucket name from Step 1
   • URL: the full Impossible Cloud S3 endpoint URL from Step 3 (for example, https://eu-central-2.storage.impossibleapi.net)

1. Complete the remaining wizard pages (encryption, container directory / accelerator cache, etc.) according to your environment, and click Add Storage Pool.

Option B - Using the command-line administrative client (dsmadmc)

If you prefer the CLI, use cloudtype=S3 with the values from the previous steps. The basic flow is:

1. Define the cloud connection (Storage Protect 8.1.13+, required for Object Lock; recommended for all new deployments):

   DEFINE CONNECTION ic_connection cloudtype=s3 -
    bucketname=your_bucket_name -
    cloudurl=https://<region>.storage.impossibleapi.net -
    identity=your_access_key -
    password=your_secret_key

2. Define the storage pool. For a standard cloud-container storage pool:

   DEFINE STGPOOL ic_cloudpool stgtype=cloud connection=ic_connection

   (Optional): To enable Object Lock for immutable, WORM-style backups - only valid if the bucket was created with Object Lock in Step 1 - add the enableclouddatalock and clouddatalockduration parameters instead:

   DEFINE STGPOOL ic_cloudpool stgtype=cloud -
    connection=ic_connection -
    enableclouddatalock=yes -
    clouddatalockduration=number_of_days

    

3. Define a storage pool directory to be used as the local accelerator cache (cloud cache). Ensure that the IBM Storage Protect server instance user (default: tsminst1) owns this directory at the OS level. Without correct ownership, the pool will fail to write to the accelerator cache.

   DEFINE STGPOOLDIR ic_cloudpool /path/to/local/cloudcache

Step 5: Verify the configuration

You can confirm that IBM Storage Protect can reach the bucket and that the pool is healthy by running:

QUERY STGPOOL ic_cloudpool FORMAT=DETAILED

For Object Lock pools, look for the Cloud Data Locking and Cloud Data Lock Duration fields in the output. You can also view container details in the Operations Center under Storage > Storage Pools > [your pool] > Details > Containers.

Once the pool is verified, you can direct your existing management classes, copy groups, and policy domains at the new cloud-container storage pool and begin backing up data to Impossible Cloud.

References

• IBM Storage Protect — Preparing to configure a cloud-container storage pool with an Amazon S3 compatible device
• IBM Storage Protect — Configuring Amazon S3 Object Lock for cloud storage pools
• Impossible Cloud — S3 regional endpoints