[Yandex Cloud documentation](../../index.md) > [Yandex Cloud Backup](../index.md) > [Getting started](index.md) > Getting started with Cloud Backup on an existing VM

# How to get started with Yandex Cloud Backup on an existing VM


Before you get started with Cloud Backup, make sure you have a linked [billing account](../../billing/concepts/billing-account.md) and its [status](../../billing/concepts/billing-account-statuses.md) is `ACTIVE` or `TRIAL_ACTIVE`.

Make sure you have a Yandex Compute Cloud [VM instance](../../compute/concepts/vm.md). In this tutorial, you will connect a [Linux](https://en.wikipedia.org/wiki/Linux) VM instance to Cloud Backup. If you have no suitable VM instance, follow [Getting started with Yandex Cloud Backup on a new VM](new-vm.md).

{% cut "The cost of VM backup resources includes:" %}

* Fee for VM [computing resources](../../compute/concepts/vm-platforms.md) and [disks](../../compute/concepts/disk.md) (see [Yandex Compute Cloud pricing](../../compute/pricing.md)).
* Fee for backed up VMs and backup retention (see [Yandex Cloud Backup pricing](../pricing.md)).

{% endcut %}

To get started with Cloud Backup:

1. [Set up the infrastructure](#deploy-infrastructure).
1. [Activate Cloud Backup](#activate-provider).
1. [Install the Cloud Backup agent](#connect-vm).
1. [Link your VM to a backup policy](#add-policy).

If you no longer need the resources you created, [delete them](#clear-out).

## Set up the infrastructure {#deploy-infrastructure}

1. In the [cloud network](../../vpc/concepts/network.md#network) hosting the VM you want to connect to Cloud Backup, [create](../../vpc/operations/security-group-create.md) a security group with the following outgoing traffic [rules](../../vpc/concepts/security-groups.md#security-groups-rules):

    Port range | Protocol | Destination name | CIDR blocks
    --- | --- | --- | ---
    `80` | `TCP` | `CIDR` | `213.180.193.0/24`
    `80` | `TCP` | `CIDR` | `213.180.204.0/24`
    `443` | `TCP` | `CIDR` | `84.47.172.0/24`
    `443` | `TCP` | `CIDR` | `84.201.181.0/24`
    `443` | `TCP` | `CIDR` | `178.176.128.0/24`
    `443` | `TCP` | `CIDR` | `213.180.193.0/24`
    `443` | `TCP` | `CIDR` | `213.180.204.0/24`
    `7770-7800` | `TCP` | `CIDR` | `84.47.172.0/24`
    `8443` | `TCP` | `CIDR` | `84.47.172.0/24`
    `44445` | `TCP` | `CIDR` | `51.250.1.0/24`
    
    
    
    {% note tip %}
    
    When installing the [Cloud Backup agent](../concepts/agent.md) on your VM or BareMetal server, you might need to install missing software components from the internet. To do this, add the following outgoing traffic rule to the [security group](../../vpc/concepts/security-groups.md):
    * **Port range**: `0-65535`.
    * **Protocol**: `Any`.
    * **Destination name**: `CIDR`.
    * **CIDR blocks**: `0.0.0.0/0`.
    
    Once the Cloud Backup agent is installed, you can delete this rule.
    
    To access the VM over [SSH](../../compute/operations/vm-connect/ssh.md), add the following incoming traffic rule:
    * **Port range**: `22`.
    * **Protocol**: `Any`.
    * **Destination name**: `CIDR`.
    * **CIDR blocks**: `0.0.0.0/0`.
    
    {% endnote %}

1. Assign the new [security group](../../vpc/concepts/security-groups.md) to the VM you are connecting to Cloud Backup:

    {% list tabs group=instructions %}

    - Management console {#console}

      1. In the [management console](https://console.yandex.cloud), select the folder where you want to connect a VM to Cloud Backup.
      1. Navigate to **Compute Cloud** and select the VM.
      1. Under **Network interface**, add a security group to the VM [network interface](../../compute/concepts/network.md):
      
          * In the top-right corner of the section, click ![image](../../_assets/console-icons/ellipsis.svg) and select **Edit**.
          * In the window that opens, select the previously created security group in the **Security groups** field.
          * Click **Save**.
      
      1. If the VM does not have a [public IP address](../../vpc/concepts/address.md#public-addresses), then under **Network**, click ![image](../../_assets/console-icons/ellipsis.svg) in the top-right corner of the relevant network interface section and select **Add public IP address**. In the window that opens:
      
          * In the **Public address** field, select `Auto` to get an IP address automatically or `List` to choose a reserved address from the list.
          * Optionally, if you selected `Auto` in the **Public address** field, enable **DDoS protection**. For more information, see [Yandex DDoS Protection in Virtual Private Cloud](../../vpc/ddos-protection/index.md).
          * If you selected `List` in the **Public address** field, choose the IP address you want to assign to your VM. The IP address and the VM must be in the same [availability zone](../../overview/concepts/geo-scope.md).
          * Click **Add**.
      
          Instead of assigning a public IP address to your VM, you can associate the subnet hosting this VM with a [route table](../../vpc/concepts/routing.md#rt-vm) allowing internet access via a [NAT gateway](../../vpc/concepts/gateways.md) or a custom router.

    {% endlist %}

1. [Create](../../iam/operations/sa/create.md) a service account and [assign](../../iam/operations/sa/assign-role-for-sa.md) it the `backup.user` [role](../security/index.md#backup-user) or higher. 
1. Link the new [service account](../../iam/concepts/users/service-accounts.md) to the VM you are connecting to Cloud Backup:

    {% note info %}
    
    You can only link one service account to a virtual machine.
    
    {% endnote %}
    
    To link a service account to a VM, you need a permission to use this account. This permission comes with the [iam.serviceAccounts.user](../../iam/security/index.md#iam-serviceAccounts-user) and [editor](../../iam/roles-reference.md#editor) roles or higher.

    {% list tabs group=instructions %}

    - Management console {#console}

      1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to connect a VM to Cloud Backup.
      1. Navigate to **Compute Cloud** and select the VM from the list that opens.
      1. In the top-right corner of the page, click ![image](../../_assets/console-icons/pencil.svg) **Edit VM**.
      1. Under **Additional**, select a service account with the `backup.user` role or higher.
      1. Click **Save changes**.

    {% endlist %}

## Activate Cloud Backup {#activate-provider}

To activate the service, you need _at least_ the `backup.user` [role](../security/index.md#backup-user) for the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) in which you want to create backups of VMs or BareMetal servers.

When you enable the service, the backup provider starts. Learn more about the backup provider and data sent to it in [Service activation and backup provider](../concepts/index.md#providers).

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder where you want to connect a VM to Cloud Backup.
  1. Navigate to **Cloud Backup**.
  1. If you have not activated Cloud Backup yet, click **Activate**.

      If there is no **Activate** button, and you can create a VM connected to Cloud Backup, Cloud Backup has already been activated. Proceed to the next step.

{% endlist %}

## Install the Cloud Backup agent {#connect-vm}

1. [Connect](../../compute/operations/vm-connect/ssh.md) to the VM over SSH.
1. Install the Cloud Backup agent on the VM by running this command in the Linux terminal:

    {% list tabs group=operating_system %}

    - Ubuntu {#ubuntu}

      ```bash
      sudo apt update && \
      sudo apt install -y jq && \
      curl https://storage.yandexcloud.net/backup-distributions/agent_installer.sh | sudo bash
      ```

      Result:

      ```text
      ...
      Agent registered with id D9CA44FC-716A-4B3B-A702-C6**********
      ```

    - CentOS {#centos}

      ```bash
      sudo yum install epel-release -y && \
      sudo yum update -y && \
      sudo yum install jq -y && \
      curl https://storage.yandexcloud.net/backup-distributions/agent_installer.sh | sudo bash
      ```

      Result:

      ```text
      ...
      Agent registered with id D9CA44FC-716A-4B3B-A702-C6**********
      ```

    {% endlist %}

    {% note info %}

    If you get the `Failed to parse cloudbackup from instance attributes IAM token and instance registration id are empty, unable to provide authorization` error, make sure the VM has a service account with the `backup.user` [role](../security/index.md#backup-user) or higher [assigned](../operations/connect-vm-linux.md#connect-sa-to-vm).

    {% endnote %}

## Link your VM to a backup policy {#add-policy}

Once you install the agent, the VM will be added to **Cloud Backup** in the ![machines](../../_assets/console-icons/server.svg) **Virtual machines** tab and you will be able to [associate](../operations/policy-vm/attach-and-detach-vm.md) it with a [Cloud Backup policy](../concepts/policy.md).

1. Make sure the Cloud Backup agent has been installed:
   
   {% list tabs group=instructions %}
   
   - Management console {#console}
   
     1. In the [management console](https://console.yandex.cloud), select the folder where you activated Cloud Backup.
     1. Navigate to **Compute Cloud**.
     1. Select the VM.
     1. Check that the value of the **Backup** field in the **Cloud Backup** section is `No backup policy`.
   
   {% endlist %}
1. Link your VM to a backup policy:
   
   {% list tabs group=instructions %}
   
   - Management console {#console}
   
     1. In the [management console](https://console.yandex.cloud), select the folder with the activated service and VM you need.
     1. Navigate to **Cloud Backup**.
     1. In the left-hand panel, select ![policies](../../_assets/console-icons/calendar.svg) **Backup policies**.
     1. Select one of the policies created by default. Click **Create policy** to create a new policy, if required.
     1. Under **Attached resources** on the **Virtual machines** tab, click ![plus-sign](../../_assets/console-icons/plus.svg) **Attach a VM**.
     1. In the window that opens, select the VM from the list and click **Attach**.
   
   {% endlist %}
   
   As a result, the VM will be associated with the backup policy and the system will start taking its backups according to the policy schedule.

## How to delete the resources you created {#clear-out}

To stop paying for the resources you created:
1. [Delete](../operations/backup-vm/delete.md) VM backups, if any.
1. [Delete](../operations/delete-vm.md) the VM from Cloud Backup.

## What's next {#what-is-next}

* [Learn about the service's features](../concepts/index.md)
* [See other guides on how to use the service](../operations/index.md)

#### Useful links {#see-also}

* [Creating a disk snapshot](../../compute/operations/disk-control/create-snapshot.md)

* [Getting started with Yandex Cloud Backup](index.md)