[Yandex Cloud documentation](../../../index.md) > [Yandex Cloud Backup](../../index.md) > [Concepts](../index.md) > [Connecting resources to Cloud Backup](index.md) > Compute Cloud VM

# Connecting Yandex Compute Cloud VMs to Cloud Backup


To back up your [Yandex Compute Cloud](../../../compute/index.md) [instances](../../../compute/concepts/vm.md) in Cloud Backup, you need them connected to the service and properly set up.

For more information on connecting a Compute Cloud VM to Cloud Backup, see [Managing Yandex Compute Cloud VMs in Cloud Backup](../../operations/index.md#connect-vm).

For the Cloud Backup connection to work correctly, link to the VM a [service account](#sa) with the `backup.user` [role](../../security/index.md#backup-user) or higher and configure [network access](#vm-network-access).

{% note tip %}

You do not have to use a service account when creating a VM using the [management console](https://console.yandex.cloud). However, the user creating the VM must have the `backup.user` [role](../../security/index.md#backup-user) or higher for the folder in which the VM is created.

{% endnote %}

After connecting to Cloud Backup, [associate](../../operations/policy-vm/attach-and-detach-vm.md#attach-vm) your VM with a [backup policy](../policy.md).

{% note info %}

When initiating a backup, make sure the VM is running.

{% endnote %}

A policy can also be linked to a virtual machine when creating it. A policy is linked asynchronously after you create and initialize a VM, as well as install and configure a Cloud Backup agent. This may take up to 10-15 minutes. For more information on automatic linking of policies to VMs, see [Associating a Yandex Cloud Backup policy with a VM automatically](../../tutorials/vm-with-backup-policy/index.md).

## Supported Cloud Marketplace images with automatic installation of the Cloud Backup agent {#os}


The Cloud Backup agent is available for automatic installation on Compute Cloud VMs if you create your VMs using the following Cloud Marketplace images:

### Linux-based images {#linux}

* [CentOS 7](https://yandex.cloud/en/marketplace/products/yc/centos-7)
* [CentOS 7 OS Login](https://yandex.cloud/en/marketplace/products/yc/centos-7-oslogin)
* [CentOS Stream](https://yandex.cloud/en/marketplace/products/yc/centos-stream-8)
* [Debian 12](https://yandex.cloud/en/marketplace/products/yc/debian-12)
* [Ubuntu 16.04 LTS](https://yandex.cloud/en/marketplace/products/yc/ubuntu-16-04-lts)
* [Ubuntu 18.04 LTS](https://yandex.cloud/en/marketplace/products/yc/ubuntu-18-04-lts)
* [Ubuntu 18.04 LTS OS Login](https://yandex.cloud/en/marketplace/products/yc/ubuntu-1804-lts-oslogin)
* [Ubuntu 20.04 LTS](https://yandex.cloud/en/marketplace/products/yc/ubuntu-20-04-lts)
* [Ubuntu 20.04 LTS OS Login](https://yandex.cloud/en/marketplace/products/yc/ubuntu-2004-lts-oslogin)
* [Ubuntu 22.04 LTS](https://yandex.cloud/en/marketplace/products/yc/ubuntu-22-04-lts)
* [Ubuntu 22.04 LTS OS Login](https://yandex.cloud/en/marketplace/products/yc/ubuntu-2204-lts-oslogin)
* [Ubuntu 24.04 LTS](https://yandex.cloud/en/marketplace/products/yc/ubuntu-2404-lts-oslogin)

### Windows-based images {#windows}

* [Kosmos VM 2022 based on Windows Server Datacenter 2022](https://yandex.cloud/en/marketplace/products/fotonsrv/kosmosvm2022)
* [Kosmos VM 2019 based on Windows Server Datacenter 2019](https://yandex.cloud/en/marketplace/products/fotonsrv/kosmosvm2019)
* [Kosmos VM 2016 based on Windows Server Datacenter 2016](https://yandex.cloud/en/marketplace/products/fotonsrv/kosmosvm2016)
* [Kosmos VM RDS (5 licenses)](https://yandex.cloud/en/marketplace/products/fotonsrv/kos-5-rds)
* [Kosmos VM RDS (10 licenses)](https://yandex.cloud/en/marketplace/products/fotonsrv/kos-10-rds)
* [Kosmos VM RDS (50 licenses)](https://yandex.cloud/en/marketplace/products/fotonsrv/kos-50-rds)
* [Kosmos BD WEB 2019](https://yandex.cloud/en/marketplace/products/fotonsrv/kosmosbdweb2019)
* [Kosmos BD Standard 2019](https://yandex.cloud/en/marketplace/products/fotonsrv/kosmosbdstd2019)
* [Kosmos VM Visio Pro 2021](https://yandex.cloud/en/marketplace/products/fotonsrv/kosmosvisio)

{% note info %}

The OS must be installed from a public image (a Yandex Cloud Marketplace product). You can select the OS directly during VM creation or use an [image](../../../compute/concepts/image.md) or [disk snapshot](../../../compute/concepts/snapshot.md) of a different VM whose OS was also installed from a public image.

{% endnote %}

### Unaided installation on a supported operating system {#self-install}

You can manually install the Cloud Backup agent on a VM. For more information, see:

* [Guide for Linux](../../operations/connect-vm-linux.md)
* [Guide for Windows](../../operations/connect-vm-windows.md)

For a complete list of supported operating systems, see the [backup provider documentation](https://docs.cyberprotect.ru/ru-RU/CyberBackupCloud/21.06/user/#supported-operating-systems-and-environments.html).

If you have issues installing the Cloud Backup agent, [contact](https://center.yandex.cloud/support) support.

### Updating the operating system kernel {#os-kernel-update}

Updating the Linux [kernel](https://en.wikipedia.org/wiki/Linux_kernel) on a [resource](../index.md#protected-resources) connected to Cloud Backup may affect the performance of the Cloud Backup agent: it will not be able to create a backup of the resource or recover it from a backup.

This may affect the agent’s performance, since the SnapAPI module (developed by the [backup provider](../index.md#providers) for the agent to work with disks and built by the [DKMS framework](https://en.wikipedia.org/wiki/Dynamic_Kernel_Module_Support) for a specific Linux kernel) may not update after updating the kernel and may therefore cease to match the kernel version.

To restore the Cloud Backup agent’s performance affected by a Linux kernel update, you need to update the version of the Linux kernel headers DKMS refers to when building the SnapAPI module. Once the kernel header version matches the kernel version, DKMS will rebuild the SnapAPI module for the required Linux kernel version at the next start of the resource.

For information on how to upgrade the Linux kernel header version, see [Recovering the Cloud Backup agent after a Linux kernel update](../../operations/backup-baremetal/restore-agent.md).

## Service account {#sa}

{% note info %}

You do not have to use a service account when creating a VM using the [management console](https://console.yandex.cloud). However, the user creating the VM must have the `backup.user` [role](../../security/index.md#backup-user) or higher for the folder in which the VM is created.

{% endnote %}

A [service account](../../../iam/concepts/users/service-accounts.md) is a special account the Cloud Backup agent uses to get registered with the Cyberprotect [provider](../index.md#providers).

When creating a Compute Cloud VM you want to configure backups for in Cloud Backup, you need to link to it a service account with the `backup.user` [role](../../security/index.md#backup-user) or higher.

You can [assign the role](../../../iam/operations/sa/assign-role-for-sa.md) to an existing service account or [create](../../../iam/operations/sa/create.md) a new service account with the required role.

## Network access permissions {#vm-network-access}

For the Cloud Backup agent to be able to exchange data with the backup provider servers, make sure the VM has network access to the IP addresses of the Cloud Backup resources as per the table below:

{% list tabs group=traffic %}

- Outgoing traffic {#outgoing}

  Port range | Protocol | Destination name | IPv4 CIDR
  --- | --- | --- | ---
  `80` | `TCP` | `Address range` | `213.180.193.0/24`
  `80` | `TCP` | `Address range` | `213.180.204.0/24`
  `443` | `TCP` | `Address range` | `84.47.172.0/24`
  `443` | `TCP` | `Address range` | `84.201.181.0/24`
  `443` | `TCP` | `Address range` | `178.176.128.0/24`
  `443` | `TCP` | `Address range` | `213.180.193.0/24`
  `443` | `TCP` | `Address range` | `213.180.204.0/24`
  `7770-7800` | `TCP` | `Address range` | `84.47.172.0/24`
  `8443` | `TCP` | `Address range` | `84.47.172.0/24`
  `44445` | `TCP` | `Address range` | `51.250.1.0/24`

  {% note tip %}

  When installing the [Cloud Backup](../agent.md) agent on your VM, you may need to install some missing software components from the internet. To do this, add the following outgoing traffic rule to the [security group](../../../vpc/concepts/security-groups.md):
  * **Port range**: `0-65535`.
  * **Protocol**: `Any`.
  * **Destination name**: `Address range`.
  * **IPv4 CIDR**: `0.0.0.0/0`.
  Once the Cloud Backup agent is installed, you can delete this rule.

  To access the VM over [SSH](../../../compute/operations/vm-connect/ssh.md), add the following incoming traffic rule:
  * **Port range**: `22`.
  * **Protocol**: `Any`.
  * **Destination name**: `Address range`.
  * **IPv4 CIDR**: `0.0.0.0/0`.

  {% endnote %}

{% endlist %}

To provide network access:
{#provide-access}

[Assign](../../../compute/operations/vm-control/vm-attach-public-ip.md) the VM a public IP or use a [route table](../../../vpc/concepts/routing.md#rt-vm) that allows internet access via a [NAT gateway](../../../vpc/concepts/gateways.md) or a custom router.

The VM's [security group](../../../vpc/concepts/security-groups.md) rules must allow access to the specified resources. You can [add the rules](../../../vpc/operations/security-group-add-rule.md) to an existing security group or [create](../../../vpc/operations/security-group-create.md) a new group with the rules.

## Connection statuses {#statuses}

You can view info on the status of a VM connection to Cloud Backup using the [management console](https://console.yandex.cloud), on the VM list page in **Compute Cloud**. The following statuses are available:

* `Connected`: Cloud Backup is connected to the VM, backups are being created as per the specified policies, the Cloud Backup agent is online.
* `No backup policy`: Cloud Backup is connected, but no policy has been assigned, no backups are being created.
* `Failed`: The agent is offline or failed to register.
* `Not connected`: Cloud Backup is not connected to the VM.

You can [view](../../operations/get-journal.md) the VM connection status and [learn](../../operations/get-connection-status.md) more about the VM backup in the backup log.

#### See also {#see-also}

* [Associating a Yandex Cloud Backup policy with a VM automatically](../../tutorials/vm-with-backup-policy/index.md)
* [Connecting Yandex BareMetal servers to Cloud Backup](baremetal.md)
* [Connecting VMs and servers from outside Yandex Cloud to Cloud Backup](external-resources.md)