Use a custom policy to authorize a RAM user to manage DTS instances

Step 1: Create a custom policy

1. Log on to the RAM console with an Alibaba Cloud account.
2. In the left-side navigation pane, click Policies under Permissions.
3. On the Policies page, click Create Policy.
4. Configure parameters for the custom policy.
   

   Parameter	Description
   Policy Name	Enter an informative name for easy identification.
   Note	Optional. Enter the description of the policy.
   Configuration Mode	Select Script. To configure policies for DTS, you can only select Script.
   Policy Document	Select an existing system policy from the drop-down list. Note This topic describes how to create a custom policy. You do not need to configure this parameter.
   Policy	Enter the permission policy. You can edit the sample policies that are listed in this topic based on your needs. Note A policy defines a set of permissions that are described according to the policy structure and grammar. You can use policies to describe the authorized resource sets, authorized operation sets, and authorization conditions. For more information, see Policy structure and grammar. Resource-and Action-level authorization is currently supported.

   Sample custom policies:

   Note

   • You must replace the DTS instance ID in the following code with the actual ID of your DTS instance.
   • If a RAM user has the read-only permission for DTS instances, the RAM user can query task details and configurations but cannot change configurations. If a RAM user has the read/write permissions for DTS instances, the RAM user can configure and manage the DTS instances.

   demo1 demo2 demo3 demo4

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "dts:Describe*",
               "Resource": "acs:dts:*:*:instance/DTS instance ID"
           }
       ],
       "Version": "1"
   }

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "dts:*",
               "Resource": [
                   "acs:dts:*:*:instance/DTS instance ID",
                   "acs:dts:*:*:instance/DTS instance ID"
               ]
           }
       ],
       "Version": "1"
   }

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "dts:DescribeSynchronizationJobStatus",
                   "dts:DescribeSynchronizationJobs"
               ],
               "Resource": "acs:dts:*:*:instance/DTS instance ID"
           }
       ],
       "Version": "1"
   }

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "dts:DescribeSubscriptionInstances",
                   "dts:StartSynchronizationJob",
                   "dts:SuspendSynchronizationJob"
               ],
               "Resource": [
                   "acs:dts:*:*:instance/DTS instance ID",
                   "acs:dts:*:*:instance/DTS instance ID",
           }
       ],
       "Version": "1"
   }

   • demo1: Read-only permission for a single DTS instance
   • demo2: Read/write permissions for DTS instances.
   • demo3: View the configurations for a single data synchronization instance.
   • demo4: Start or pause data synchronization instances.
5. Click OK.

Step 2: Attach the custom policy to a RAM user

1. Log on to the RAM console with an Alibaba Cloud account.
2. Create a RAM user.
3. In the left-side navigation pane, click Users under Identities.
4. In the User Logon Name/Display Name column, find the target RAM user.
5. Click Add Permissions in the Actions column.
   
6. In the Add Permissions dialog box, select the required permission policies.
   1. Select Custom Policy.
   2. Click the name of a custom policy to add the policy to the Selected section.
      
7. Click OK.
8. Click Finished.

Common scenarios of operation-level authorization

Related operations

Log on to the RAM console as a RAM user.

FAQ

Q: Why does the DTS console not show the instance list when I log on to the DTS console as a RAM user and display an error message?

A: The RAM user may not have permissions or may have permissions only on some instances. In this case, the DTS console does not show the instance list. You must contact the RAM administrator and obtain the ID of the DTS instance that the RAM user has administrative permissions. Then, you can search for a DTS instance by using the instance ID in the DTS console.