[question] for restoring snapshot using `CreateBackupRestoreJob`

[qlik-aditya]

hello, I am trying to restore a snapshot I created from a project's cluster to a different project's cluster. I have two clients, source and target. both clients have set the API like this:

// source project
sourcePublicKey := os.Getenv("MONGO_PUBLIC_SOURCE")
sourcePrivateKey := os.Getenv("MONGO_PRIVATE_SOURCE")
// target project
targetPublicKey := os.Getenv("MONGO_PUBLIC_TARGET")
targetPrivateKey := os.Getenv("MONGO_PRIVATE_TARGET")

which I then use to create source and target clients.

type MongoClient struct {
	PublicAPIKey  string
	PrivateAPIKey string
	SDK           *admin.APIClient
	Logger        *slog.Logger
}
func NewMongoClient(logger *slog.Logger, publicKey, privateKey string) (*MongoClient, error) {
	sdk, err := admin.NewClient(admin.UseDigestAuth(publicKey, privateKey))
	if err != nil {
		return nil, fmt.Errorf("failed to create MongoDB client: %w", err)
	}

	return &MongoClient{
		PublicAPIKey:  publicKey,
		PrivateAPIKey: privateKey,
		SDK:           sdk,
		Logger:        logger,
	}, nil
}

sourceClient, err := NewMongoClient(logger, sourcePublicKey, sourcePrivateKey)
if err != nil {
	return fmt.Errorf("failed to create source MongoDB client: %w", err)
}

targetClient, err := NewMongoClient(logger, targetPublicKey, targetPrivateKey)
if err != nil {
	return fmt.Errorf("failed to create target MongoDB client: %w", err)
}

I ran the snapshot restoration from source project cluster, using the sourceClient:

backpSnap, backupResp, err := mc.SDK.CloudBackupsApi.TakeSnapshots(ctx, projectID, sourceCluster, &admin.DiskBackupOnDemandSnapshotRequest{
	RetentionInDays: toInt(7),
	Description:     toString("backup test job"),
}).Execute()
if err != nil {
	log.Fatal(err)
}

for {
	backupGet, _, _ := mc.SDK.CloudBackupsApi.GetClusterBackupSnapshot(ctx, projectID, sourceCluster, *backpSnap.Id).Execute()

	if *backupGet.Status == "completed" {
		mc.Logger.Info("✅ snapshot created", fmt.Sprintf("status for %s", sourceCluster), *backupGet.Status)
		mc.Logger.Info("⏳ starting snapshot restore", "cluster", targetCluster)

		// this fails:  HTTP 403 Forbidden (Error code: "CANNOT_RESTORE_TO_TARGET") Detail: Cannot restore with insufficient permission on source snapshot or target cluster
		restoreJob, restoreResp, err := mc.SDK.CloudBackupsApi.CreateBackupRestoreJob(ctx, projectID, sourceCluster, &admin.DiskBackupSnapshotRestoreJob{
			SnapshotId:        backpSnap.Id,
			TargetClusterName: toString(targetCluster),
			TargetGroupId:     toString(targetID),
			DeliveryType:      "automated",
		}).Execute()
		if err != nil {
			log.Fatal(err)
		}
		break
	}

	mc.Logger.Info("⏳ snapshot status", "waiting for completion", "check 10s", sourceCluster, targetCluster)

	time.Sleep(10 * time.Second)
}

snapshot creation is success but restoration from source project cluster to target cluster project fails:

HTTP 403 Forbidden (Error code: "CANNOT_RESTORE_TO_TARGET") Detail: Cannot restore with insufficient permission on source snapshot or target cluster

TLDR; how to restore a snapshot from different projects? I would appreciate any help. thanks.

[github-actions]

Thanks for opening this issue. The ticket CLOUDP-365833 was created for internal tracking.

[lantoli]

Thanks @qlik-aditya , according to the error message, it looks like you're using a target API Key with insufficient permissions to restore the snapshot in the target cluster.

Please review the permissions. It's likely that either it doesn't have permissions to access the snapshot or doesn't have permissions to use it in the target cluster.

[qlik-aditya]

Thanks @qlik-aditya , according to the error message, it looks like you're using a target API Key with insufficient permissions to restore the snapshot in the target cluster.

Please review the permissions. It's likely that either it doesn't have permissions to access the snapshot or doesn't have permissions to use it in the target cluster.

thanks for your reply. restoration has to be done from target or source? when I use target API for restoration, I cannot run restore from target. note that both APIs are created from their respective project and both are on different projects:

POST: HTTP 401 Unauthorized (Error code: "USER_CANNOT_ACCESS_GROUP") Detail: User cannot access this group. Reason: Unauthorized. Params: [], BadRequestDetail:

I have given Project Owner to both API keys.

[lantoli]

Project and group are synonymous so your last error message is that the API Key doesn't have access to the project.
Try to create and use an org-level API Key that has permissions to both projects.