Create server role for backups (BACKUP DATABASE and RESTORE HEADERONLY)

Question

Hello-
I wish to create a server role that will allow any users assigned to it to be able to issue a BACKUP DATABASE and RESTORE HEADERONLY for any database on the server.  I've been searching Google and MSDN but haven't had much luck.  I can create the
user (CREATE SERVER ROLE backupuser;) but don't really know how to assign the permissions to it that I want.  I wish to keep the permissions as narrow as possible for good practice; I could just assign the user to the sysadmin group but that shouldn't
be necessary.
If anyone can help, I would much appreciate it.

Answer 1

Whenever you need to find out the required permissions for a command, the best way is to look up these commands in Books Online, and to the Permissions/Securities section. This is what I always do when people asks these questions, because I rarely knows
the answer by heart.
So, let's see what the topic for BACKUP has to say:
   BACKUP DATABASE and BACKUP LOG permissions default to members of the
   sysadmin fixed server role and the db_owner and db_backupoperator fixed
   database roles
The permission section for RESTORE HEADERONLY says:
   Beginning in SQL Server 2008, obtaining information about a backup set or
   backup device requires CREATE DATABASE permission. For more information,
   see GRANT Database Permissions (Transact-SQL).
So it seems that if you want a user that has server-level rights to back up databases, this must be sysadmin, which is a little disappointing. One possibility is to package the BACKUP command in a stored procedure, which you sign with a certificate. Then
you create a login from the certiticate, and add that login to sysadmin. BACKUP accepts parameters for many of its arguments, so you don't have to build dynamic SQL. Still it is not really a satisfactory solution, since this user will have to work with
BACKUP "commands" that will be procedure calls.
Erland Sommarskog, SQL Server MVP, [email protected]