topic Multi-admin-verification query - any way to exclude application accounts? in ONTAP Discussions

Multi-admin-verification query - any way to exclude application accounts?

SW1 — Wed, 11 Dec 2024 14:04:41 GMT

Commvault is triggering ontap snapshot creation/deletion via AIQUM. with MAV rule "volume snapshot delete" this creates an approval request instead of just deleting it. I am wondering if there is any way to exclude this account from this rule. so something like operation="volume snapshot delete" and query="-requested-user=!<AIQUM account>".

For the query options I have not found any documentation.

Re: Multi-admin-verification query - any way to exclude application accounts?

liu — Thu, 12 Dec 2024 07:30:02 GMT

Only one MAV rule can be created per operation; for example, you cannot make multiple volume-snapshot-delete rules. Any desired rule constraints must be contained within one rule.

Manage protected operation rules

Re: Multi-admin-verification query - any way to exclude application accounts?

SW1 — Thu, 12 Dec 2024 10:51:42 GMT

This is clear to me. using the query option you can make sure snaphot delete operations will not require additional approval for volumes matching a pattern:

rule create -operation="volume snapshot delete" -query="-volume !CC_CVLT*"

with this rule deleting snapshots will trigger an approval request only for volumes not starting with this pattern. I would like to know if this can also be done with requested user but I have not found any detailed documentation for available options.