Data Transmission Service:Configure RAM authorization for cross-account DTS tasks

Step 1: Create a RAM role

1. Log on to the RAM console using the Alibaba Cloud account that owns the source database.

2. In the navigation pane on the left, choose Identities > Roles.

   

   Important

   Do not choose Identities > Users. Otherwise, DTS will fail to access the database instance and report an error.

3. On the Roles page, click Create Role.

4. In the Create Role panel, you can configure the RAM role.

   1. For Principal Type, select Cloud Account.

      

   2. Set Principal Name to Other Account, and enter the Alibaba Cloud account ID of the destination database.

      

   3. At the bottom of the page, click OK.

   4. In the Create Role panel, enter a name for the RAM role and click OK.

      This example uses the ram-for-dts.

      

Step 2: Grant permissions to the RAM role

Step 3: Modify the trust policy of the RAM role

Step 1: Create a RAM role

1. Log on to the RAM console using the Alibaba Cloud account that owns the destination database.

2. In the navigation pane on the left, choose Identities > Roles.

   

   Important

   Do not choose Identities > Users. Otherwise, DTS will fail to access the database instance and report an error.

3. On the Roles page, click Create Role.

4. In the Create Role panel, you can configure the RAM role.

   1. For Principal Type, select Cloud Account.

      

   2. For the Principal Name parameter, select Other Account and enter the ID of the Alibaba Cloud account that owns the source database.

      

   3. At the bottom of the page, click OK.

   4. In the Create Role panel, enter a name for the RAM role and click OK.

      This example uses the ram-for-dts.

      

Step 2: Grant permissions to the RAM role

Step 3: Modify the trust policy of the RAM role

Step 1: Configure RAM authorization using the Alibaba Cloud account that owns the source database

1. Create a RAM role.

   1. Log on to the RAM console using the Alibaba Cloud account that owns the source database.

   2. In the navigation pane on the left, choose Identities > Roles.

      

      Important

      Do not choose Identities > Users. Otherwise, DTS will fail to access the database instance and report an error.

   3. On the Roles page, click Create Role.

   4. In the Create Role panel, you can configure the RAM role.

      1. For Principal Type, select Cloud Account.

         

      2. Set Principal Name to Other Account and enter the ID of the Alibaba Cloud account that will create the DTS task.

         

      3. At the bottom of the page, click OK.

      4. In the Create Role panel, enter a name for the RAM role and click OK.

         This example uses the ram-for-dts.

         

2. Grant permissions to the RAM role.

   From the page indicating the RAM role is created

   1. On the Permissions tab, click Precise Permission.

      

   2. In the Precise Permission panel, you can set Policy Type to System Policy.

      

   3. Enter AliyunDTSRolePolicy in the Policy Name text box.

   4. Click OK.

      Click the icon on the right side of the Permission tab to refresh the page. Verify that the precise authorization was successful.

   From the RAM role list

   1. Go to the details page of the RAM role.

      1. Log on to the RAM console using the Alibaba Cloud account that owns the source database.

      2. In the navigation pane on the left, choose Identities > Roles.

         

         Important

         Do not choose Identities > Users. Otherwise, DTS will fail to access the database instance and report an error.

      3. On the Roles page, click the target RAM role.

         

   2. On the Permissions tab, click Precise Permission.

      

   3. In the Precise Permission panel, you can set Policy Type to System Policy.

      

   4. Enter AliyunDTSRolePolicy in the Policy Name text box.

   5. Click OK.

      Click the icon on the right side of the Permission tab to refresh the page. Verify that the precise authorization was successful.

3. Modify the trust policy of the RAM role.

   From the page indicating the permission is granted

   1. Click the Trust Policy tab.

      

   2. On the Trust Policy tab, click Edit Trust Policy.

   3. On the JSON tab, replace the contents of the policy editor with the following code.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   4. Replace the two <Alibaba Cloud account ID> placeholders with the ID of the Alibaba Cloud account that you will use to create the DTS task.

      Example (click to expand)

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::164682176356****:root"
                      ],
                      "Service": [
                          "164682176356****@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   5. Click OK to save the trust policy.

      If the "<Alibaba Cloud account ID>@dts.aliyuncs.com" in the `Service` section of the code automatically changes to "dts.aliyuncs.com" after you save the trust policy, this indicates that the <Alibaba Cloud account ID> is incorrect. You must enter the ID of the account used to create the DTS task, not the ID of the source database account.

      Note

      For more information about the Alibaba Cloud account to use to log on to the RAM console and the account to specify in the trust policy, see Account information.

   From the RAM role list

   1. Go to the details page of the RAM role.

      1. Log on to the RAM console using the Alibaba Cloud account that owns the source database.

      2. In the navigation pane on the left, choose Identities > Roles.

         

         Important

         Do not choose Identities > Users. Otherwise, DTS will fail to access the database instance and report an error.

      3. On the Roles page, click the target RAM role.

         

   2. Click the Trust Policy tab.

      

   3. On the Trust Policy tab, click Edit Trust Policy.

   4. On the JSON tab, replace the contents of the policy editor with the following code.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   5. Replace the two <Alibaba Cloud account ID> placeholders with the ID of the Alibaba Cloud account that you will use to create the DTS task.

      Example (click to expand)

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::164682176356****:root"
                      ],
                      "Service": [
                          "164682176356****@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   6. Click OK to save the trust policy.

      If the "<Alibaba Cloud account ID>@dts.aliyuncs.com" in the `Service` section of the code automatically changes to "dts.aliyuncs.com" after you save the trust policy, this indicates that the <Alibaba Cloud account ID> is incorrect. You must enter the ID of the account used to create the DTS task, not the ID of the source database account.

      Note

      For more information about the Alibaba Cloud account to use to log on to the RAM console and the account to specify in the trust policy, see Account information.

Step 2: Configure RAM authorization using the Alibaba Cloud account that owns the destination database

1. Create a RAM role.

   1. Log on to the RAM console using the Alibaba Cloud account that owns the destination database.

   2. In the navigation pane on the left, choose Identities > Roles.

      

      Important

      Do not choose Identities > Users. Otherwise, DTS will fail to access the database instance and report an error.

   3. On the Roles page, click Create Role.

   4. In the Create Role panel, you can configure the RAM role.

      1. For Principal Type, select Cloud Account.

         

      2. Set Principal Name to Other Account and enter the ID of the Alibaba Cloud account that will create the DTS task.

         

      3. At the bottom of the page, click OK.

      4. In the Create Role panel, enter a name for the RAM role and click OK.

         This example uses the ram-for-dts.

         

2. Grant permissions to the RAM role.

   From the page indicating the RAM role is created

   1. On the Permissions tab, click Precise Permission.

      

   2. In the Precise Permission panel, you can set Policy Type to System Policy.

      

   3. Enter AliyunDTSRolePolicy in the Policy Name text box.

   4. Click OK.

      Click the icon on the right side of the Permission tab to refresh the page. Verify that the precise authorization was successful.

   From the RAM role list

   1. Go to the RAM role details page.

      1. Log on to the RAM console using the Alibaba Cloud account that owns the destination database.

      2. In the navigation pane on the left, choose Identities > Roles.

         

         Important

         Do not choose Identities > Users. Otherwise, DTS will fail to access the database instance and report an error.

      3. On the Roles page, click the target RAM role.

         

   2. On the Permissions tab, click Precise Permission.

      

   3. In the Precise Permission panel, you can set Policy Type to System Policy.

      

   4. Enter AliyunDTSRolePolicy in the Policy Name text box.

   5. Click OK.

      Click the icon on the right side of the Permission tab to refresh the page. Verify that the precise authorization was successful.

3. Modify the trust policy of the RAM role.

   From the page indicating the permission is granted

   1. Click the Trust Policy tab.

      

   2. On the Trust Policy tab, click Edit Trust Policy.

   3. On the JSON tab, replace the contents of the policy editor with the following code.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   4. Replace the two <Alibaba Cloud account ID> placeholders with the ID of the Alibaba Cloud account that you will use to create the DTS task.

      Example (click to expand)

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::164682176356****:root"
                      ],
                      "Service": [
                          "164682176356****@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   5. Click OK to save the trust policy.

      If the "<Alibaba Cloud account ID>@dts.aliyuncs.com" in the `Service` section of the code automatically changes to "dts.aliyuncs.com" after you save the trust policy, this indicates that the <Alibaba Cloud account ID> is incorrect. You must enter the ID of the account used to create the DTS task, not the ID of the destination database account.

      Note

      For more information about the Alibaba Cloud account to use to log on to the RAM console and the account to specify in the trust policy, see Account information.

   From the RAM role list

   1. Go to the details page of the RAM role.

      1. Log on to the RAM console using the Alibaba Cloud account that owns the destination database.

      2. In the navigation pane on the left, choose Identities > Roles.

         

         Important

         Do not choose Identities > Users. Otherwise, DTS will fail to access the database instance and report an error.

      3. On the Roles page, click the target RAM role.

         

   2. Click the Trust Policy tab.

      

   3. On the Trust Policy tab, click Edit Trust Policy.

   4. On the JSON tab, replace the contents of the policy editor with the following code.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   5. Replace the two <Alibaba Cloud account ID> placeholders with the ID of the Alibaba Cloud account that you will use to create the DTS task.

      Example (click to expand)

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::164682176356****:root"
                      ],
                      "Service": [
                          "164682176356****@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   6. Click OK to save the trust policy.

      If the "<Alibaba Cloud account ID>@dts.aliyuncs.com" in the `Service` section of the code automatically changes to "dts.aliyuncs.com" after you save the trust policy, this indicates that the <Alibaba Cloud account ID> is incorrect. You must enter the ID of the account used to create the DTS task, not the ID of the destination database account.

      Note

      For more information about the Alibaba Cloud account to use to log on to the RAM console and the account to specify in the trust policy, see Account information.