diff --git a/ansible/roles/cinder/tasks/external_ceph.yml b/ansible/roles/cinder/tasks/external_ceph.yml
index d36bd2d705..4d64963863 100644
--- a/ansible/roles/cinder/tasks/external_ceph.yml
+++ b/ansible/roles/cinder/tasks/external_ceph.yml
@@ -45,7 +45,7 @@
     src: "{{ item }}"
     dest: "{{ node_config_directory }}/cinder-backup/"
   with_fileglob:
-    - "{{ node_custom_config }}/cinder/cinder-volume/ceph.client*"
+    - "{{ node_custom_config }}/cinder/cinder-backup/ceph.client*"
   when:
     - external_ceph_cephx_enabled | bool
     - inventory_hostname in groups['cinder-backup']
diff --git a/doc/external-ceph-guide.rst b/doc/external-ceph-guide.rst
index 4465bf6ae3..ef5875e71c 100644
--- a/doc/external-ceph-guide.rst
+++ b/doc/external-ceph-guide.rst
@@ -154,6 +154,11 @@ will be merged with /etc/kolla/config/cinder/ceph.conf.
 Ceph keyrings are deployed per service and placed into
 cinder-volume and cinder-backup directories:
 
+.. note::
+
+    ``cinder-backup`` requires two keyrings for accessing volumes
+    and backup pool.
+
 ::
 
   root@deploy:/etc/kolla/config# cat
@@ -161,6 +166,10 @@ cinder-volume and cinder-backup directories:
   [client.cinder]
           key = AQAg5YRXpChaGRAAlTSCleesthCRmCYrfQVX1w==
   root@deploy:/etc/kolla/config# cat
+  cinder/cinder-backup/ceph.client.cinder-backup.keyring
+  [client.cinder-backup]
+          key = AQC9wNBYrD8MOBAAwUlCdPKxWZlhkrWIDE1J/w==
+  root@deploy:/etc/kolla/config# cat
   cinder/cinder-volume/ceph.client.cinder.keyring
   [client.cinder]
           key = AQAg5YRXpChaGRAAlTSCleesthCRmCYrfQVX1w==