This document provides information about how to change the backup plan that is
applied to your Compute Engine instance. You can change your instance's
backup plan to align your data protection strategy with your changing
operational requirements.
Backup and DR backup plans let you define advanced backup strategies
to store your Compute Engine instances in secure storage locations
called backup vaults. Using the backup plan applied to your instance,
you can create scheduled or on-demand backups of your instance in a
backup vault.
Before you begin
Enable the Backup and DR Service API where the Compute Engine instances are
located.
Set up Log Analytics on your bucket to monitor
Backup and DR backup jobs.
Required roles
To get the permissions that
you need to edit an instance's properties and change the associated
backup plan,
ask your administrator to grant you the
following IAM roles:
To edit the instance:
Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1)
on the project for the Compute Engine instance
To configure scheduled backups or run on-demand backups:
If you want to back up a Compute Engine instance to a
backup vault that is in a different project than the instance, then
make sure the
Backup and DR Vault Service Agent for the backup vault has been
granted permission to access the instances in that project. (If the
backup vault and instance are in the same project, then this
permission is already granted by default.)
To ensure that Backup and DR Vault Service Agent has the necessary
permissions to back up a Compute Engine instance to a
backup vault,
ask your administrator to grant Backup and DR Vault Service Agent the
Backup and DR Compute Engine Operator (roles/backupdr.computeEngineOperator)
IAM role on the project for the Compute Engine instance.
Change the backup plan applied to your instance
Your new backup plan must be from the same project and store the backup in the
same backup vault as your existing plan.
You can change your instance's backup plan by modifying the instance
configuration on the Trusted Cloud console, as follows:
In the Trusted Cloud console, go to the VM instances page.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-26 UTC."],[],[],null,["*** ** * ** ***\n\nThis document provides information about how to change the backup plan that is\napplied to your Compute Engine instance. You can change your instance's\nbackup plan to align your data protection strategy with your changing\noperational requirements.\n\nBackup and DR backup plans let you define advanced backup strategies\nto store your Compute Engine instances in secure storage locations\ncalled backup vaults. Using the backup plan applied to your instance,\nyou can create scheduled or on-demand backups of your instance in a\nbackup vault.\n\nBefore you begin\n\n- Enable the Backup and DR Service API where the Compute Engine instances are located.\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=backupdr.googleapis.com&_ga=2.145630134.30427899.1640890668-1982243420.1634228058)\n\n- [Create a backup vault](/backup-disaster-recovery/docs/cloud-console/backup-vault-create)\n- [Create a backup plan](/backup-disaster-recovery/docs/cloud-console/backup-plan-create)\n- Set up Log Analytics on your bucket to monitor Backup and DR backup jobs.\n\nRequired roles\n\n-\n\n To get the permissions that\n you need to edit an instance's properties and change the associated\n backup plan,\n\n ask your administrator to grant you the\n following IAM roles:\n\n - To edit the instance: [Compute Instance Admin (v1)](/iam/docs/roles-permissions/compute#compute.instanceAdmin.v1) (`roles/compute.instanceAdmin.v1`) on the project for the Compute Engine instance\n - To configure scheduled backups or run on-demand backups:\n - [Backup and DR Backup User](/iam/docs/roles-permissions/backupdr#backupdr.backupUser) (`roles/backupdr.backupUser`) on the project for the backup vault\n - [Viewer](/iam/docs/roles-overview#basic) (`roles/viewer`) on the project for the backup vault\n\n\n For more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\n You might also be able to get\n the required permissions through [custom\n roles](/iam/docs/creating-custom-roles) or other [predefined\n roles](/iam/docs/roles-overview#predefined).\n- If you want to back up a Compute Engine instance to a\n backup vault that is in a different project than the instance, then\n make sure the\n [Backup and DR Vault Service Agent](/iam/docs/service-agents#backup-and-dr-vault-service-agent) for the backup vault has been\n granted permission to access the instances in that project. (If the\n backup vault and instance are in the same project, then this\n permission is already granted by default.)\n\n-\n\n To ensure that Backup and DR Vault Service Agent has the necessary\n permissions to back up a Compute Engine instance to a\n backup vault,\n\n ask your administrator to grant Backup and DR Vault Service Agent the\n\n\n [Backup and DR Compute Engine Operator](/iam/docs/roles-permissions/backupdr#backupdr.computeEngineOperator) (`roles/backupdr.computeEngineOperator`)\n IAM role on the project for the Compute Engine instance.\n\n\n | **Important:** You must grant this role to Backup and DR Vault Service Agent, *not* to your user account. Failure to grant the role to the correct principal might result in permission errors.\n\n \u003cbr /\u003e\n\nChange the backup plan applied to your instance\n\nYour new backup plan must be from the same project and store the backup in the\nsame backup vault as your existing plan.\n\nYou can change your instance's backup plan by modifying the instance\nconfiguration on the Google Cloud console, as follows:\n\n1. In the Google Cloud console, go to the **VM instances** page.\n\n [Go to VM instances](https://console.cloud.google.com/compute/instances)\n2. Click the name of the instance whose backup plan you want to change.\n The instance details page appears for the selected instance.\n\n3. Click edit **Edit** .\n The **Edit** page appears for your instance.\n\n4. Navigate to the **Backup plan** section and then click **Change plan**.\n\n5. In the **Select a backup plan** pane that appears, do the following:\n\n 1. In the **Backup plan name** column, click the name of the back plan that you want to use.\n 2. To confirm your choice of backup plan and return to the **Edit** page, click **Apply**.\n6. To apply your backup plan and save your new instance configuration,\n click **Save**.\n\nWhat's next\n\n- Learn how to use your instance's backup plan to [schedule or create backups in a backup vault](/backup-disaster-recovery/docs/cloud-console/compute/compute-instance-backup).\n- Learn how to [restore an instance from a backup vault](/backup-disaster-recovery/docs/cloud-console/compute/compute-instance-restore)."]]