Use a custom policy to authorize a RAM user to manage DTS instances

Step 1: Create a custom policy

1. Log on to the RAM console by using an Alibaba Cloud account.
2. In the left-side navigation pane, click Policies under Permissions.
3. On the Policies page, click Create Policy.
4. Configure parameters for the custom policy.
   

   Parameter	Description
   Policy Name	Enter an informative name for easy identification.
   Note	Optional. Enter the description of the policy.
   Configuration Mode	Select Script. To configure policies for DTS, you must select Script.
   Policy Document	Select an existing system policy from the drop-down list. Note This topic describes how to create a custom policy. You do not need to configure this parameter.
   Policy	Enter the permission policy. You can edit the sample policies that are listed in this topic based on your needs. Note A policy defines a set of permissions that are described based on the policy structure and syntax. A policy describes the authorized resource sets, authorized operation sets, and authorization conditions. For more information, see Policy structure and syntax. Resource-level and operation-level authorization are supported.

   Sample custom policies:

   Note

   • You must replace the DTS instance ID in the following code with the actual ID of your DTS instance.
   • If the read-only permission on a DTS instance is granted to a RAM user, the RAM user can query task details and configurations but cannot change configurations. If the read/write permissions on a DTS instance are granted to a RAM user, the RAM user can configure and manage the DTS instance.

   demo 1 demo 2 demo 3 demo 4

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "dts:Describe*",
               "Resource": "acs:dts:*:*:instance/DTS instance ID"
           }
       ],
       "Version": "1"
   }

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "dts:*",
               "Resource": [
                   "acs:dts:*:*:instance/DTS instance ID",
                   "acs:dts:*:*:instance/DTS instance ID"
               ]
           }
       ],
       "Version": "1"
   }

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "dts:DescribeSynchronizationJobStatus",
                   "dts:DescribeSynchronizationJobs"
               ],
               "Resource": "acs:dts:*:*:instance/DTS instance ID"
           }
       ],
       "Version": "1"
   }

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "dts:DescribeSubscriptionInstances",
                   "dts:StartSynchronizationJob",
                   "dts:SuspendSynchronizationJob"
               ],
               "Resource": [
                   "acs:dts:*:*:instance/DTS instance ID",
                   "acs:dts:*:*:instance/DTS instance ID",
           }
       ],
       "Version": "1"
   }

   • demo 1: Read-only permission on a single DTS instance.
   • demo 2: Read/write permissions on multiple DTS instances.
   • demo 3: View the configurations of a data synchronization task.
   • demo 4: Start or pause a data synchronization task.
5. Click OK.

Step 2: Attach the custom policy to a RAM user

1. Log on to the RAM console by using an Alibaba Cloud account.
2. Create a RAM user.
3. In the left-side navigation pane, click Users under Identities.
4. In the User Logon Name/Display Name column, find the target RAM user.
5. Click Add Permissions in the Actions column.
   
6. In the Add Permissions pane, select the required permission policies.
   1. Select Custom Policy.
   2. Click the name of a custom policy to add the policy to the Selected section.
      
7. Click OK.
8. Click Finished.

Scenarios of operation-level authorization

What to do next

Log on to the RAM console as a RAM user.

FAQ

Q: Why does an error message instead of the instance list appear when I log on to the DTS console as a RAM user?

A: The RAM user may have no permissions or may have permissions only on some instances. In this case, the DTS console does not show the instance list. You must contact the RAM administrator and obtain the IDs of the DTS instances on which the RAM user has administrative permissions. Then, you can search for DTS instances by using their IDs in the DTS console.