Use a custom policy to authorize a RAM user to manage DTS instances

Precautions

• If you need to synchronize data to MaxCompute, you cannot use a RAM user to configure the data synchronization task. You must use an Alibaba Cloud account to configure the task.
• If you use a RAM user to configure DTS tasks and the database is connected over Database Gateway, you must grant the AliyunDGFullAccess permission to the RAM user. If you use a RAM user to configure DTS tasks and the database is connected over Cloud Enterprise Network (CEN), you must grant the AliyunCENFullAccess permission to the RAM user.

Step 1: Create a custom policy

1. Log on to the RAM console by using an Alibaba Cloud account.
2. In the left-side navigation pane, click Policies under Permissions.
3. On the Policies page, click Create Policy.
4. Configure parameters for the custom policy.
   

   Parameter	Description
   Policy Name	Enter an informative name for easy identification.
   Note	Optional. Enter the description of the policy.
   Configuration Mode	Select Script. To configure policies for DTS, you must select Script.
   Policy Document	Select an existing system policy from the drop-down list. Note This topic describes how to create a custom policy. You do not need to specify this parameter.
   Code Editor	Enter the content of the policy in the code editor. Sample custom policies are provided for your reference below this table. Note A policy defines a set of permissions that are described based on the policy structure and syntax. A policy describes the authorized resource sets, the authorized operation sets, and the authorization conditions. For more information, see Policy structure and syntax. You can grant permissions on specific resources and actions.

   Sample custom policies:

   Note

   • You must replace the DTS instance ID in the following code with the actual ID of your DTS instance.
   • If the read-only permission on a DTS instance is granted to a RAM user, the RAM user can query task details and configurations but cannot change configurations. If the read and write permissions on a DTS instance are granted to a RAM user, the RAM user can configure and manage the DTS instance.

   Example 1 Example 2 Example 3 Example 4

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "dts:Describe*",
               "Resource": "acs:dts:*:*:instance/DTS instance ID"
           }
       ],
       "Version": "1"
   }

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "dts:*",
               "Resource": [
                   "acs:dts:*:*:instance/DTS instance ID",
                   "acs:dts:*:*:instance/DTS instance ID"
               ]
           }
       ],
       "Version": "1"
   }

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "dts:DescribeSynchronizationJobStatus",
                   "dts:DescribeSynchronizationJobs"
               ],
               "Resource": "acs:dts:*:*:instance/DTS instance ID"
           }
       ],
       "Version": "1"
   }

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "dts:DescribeSubscriptionInstances",
                   "dts:StartSynchronizationJob",
                   "dts:SuspendSynchronizationJob"
               ],
               "Resource": [
                   "acs:dts:*:*:instance/DTS instance ID",
                   "acs:dts:*:*:instance/DTS instance ID",
           }
       ],
       "Version": "1"
   }

   • Example 1: Read-only permission on a single DTS instance
   • Example 2: Read and write permissions on multiple DTS instances
   • Example 3: View the configurations of a data synchronization task
   • Example 4: Start or pause multiple data synchronization tasks
5. Click OK.

Step 2: Attach the custom policy to a RAM user

1. Log on to the RAM console by using an Alibaba Cloud account.
2. Create a RAM user.
3. In the left-side navigation pane, choose Identities > Users.
4. In the User Logon Name/Display Name column, find the target RAM user.
5. Click Add Permissions in the Actions column.
   
6. In the Add Permissions pane, select the required permission policies.
   1. Select Custom Policy.
   2. Click the name of a custom policy to add the policy to the Selected section.
      
7. Click OK.
8. Click Complete.

Scenarios of operation-level authorization

References

Log on to the Alibaba Cloud Management Console as a RAM user

FAQ

Q: Why does an error message instead of the instance list appear when I log on to the DTS console as a RAM user?

A: The RAM user may have no permissions or may have permissions only on some instances. In this case, the DTS console does not show the instance list. You must contact the RAM administrator and obtain the IDs of the DTS instances on which the RAM user has administrative permissions. Then, you can search for DTS instances by using their IDs in the DTS console.