Cloud Backup:Cross-account backup

(Optional) Step 1: Set a delegated administrator account

To use a member account of a Resource Directory as the management account, you must set this account as a delegated administrator account for the Cloud Backup service. For more information, see Manage delegated administrator accounts.

1. Use the management account of your Resource Directory to log on to the Resource Management console.

2. In the left-side navigation pane, choose Resource Directory > Trusted Service.

3. On the Trusted Service page, find Cloud Backup and click Manage in the Actions column.

4. In the Delegated Administrator Account section, click Add.

5. In the Add Delegated Administrator Account panel, select the desired management account.

6. Click OK.

   After the account is added, Cloud Backup appears in the list of trusted services when you log on to the Resource Management console as the delegated administrator account.

Step 2: Add the member account

1. Use the management account to log on to the log on to the Cloud Backup console.

2. In the left-side navigation pane, choose Backup > Cross-account backup.

3. On the Cross-account backup page, switch to the region that contains the resources of the account to be backed up.

4. Click Add an account to be backed up.

5. In the Add an account to be backed up panel, configure the following parameters and click OK.

   Parameter	Description
   Cross-account type	Select Resource Directory-based.
   Select an account to be backed up	Select an account to be backed up from the Resource Directory. You can select only one member account at a time. You can enter a keyword to quickly find the member account.

   Note

   For accounts that are in a Resource Directory, we recommend that you configure cross-account backup by using Resource Directory. You can also configure cross-account backup by using RAM role assumption. For more information, see Add an account via RAM role assumption.

   After the account is added, it appears in the account list. When an account is managed for the first time, Cloud Backup automatically creates the AliyunServiceRoleForHbrRd service-linked role:

   • Role name: AliyunServiceRoleForHbrRd

   • Access policy: AliyunServiceRolePolicyForHbrRd

   • Permission description: Allows Cloud Backup to access the resources of other authorized accounts for cross-account backup and restore operations.

Step 1: Create a service-linked role

The management account requires the AliyunServiceRoleForHbrCrossAccountBackup service-linked role.

• Role name: AliyunServiceRoleForHbrCrossAccountBackup

• Access policy: AliyunServiceRolePolicyForHbrCrossAccountBackup

• Permission description: Allows the backup service to access the resources of other authorized accounts for cross-account backup and restore operations.

1. Use the management account to log on to the Cloud Backup console.

2. In the left navigation bar, select Backup > Cross-Account Backup.

3. On the Cross-Account Backup page, switch to the region that contains the resources you want to back up.

4. Click Add Account to Be Backed Up, and in the Add Account to Be Backed Up panel, set Cross-account Type to Based on RAM role assumption.

5. In the Cloud Backup Authorization dialog box, click Authorize.

   For more information, see Cloud Backup service-linked role.

Step 2: Create a RAM role

1. Use the account to be backed up to log on to the RAM console.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, click Create Role.

4. On the Create Role page, set Principal Type to Cloud Account. Then, set Principal Name to Other Account, enter the ID of the management account, and click OK.

   

   Note

   Go to the Security Settings page to view your Alibaba Cloud account ID.

5. In the Create Role dialog box, enter a RAM role name, such as hbrcrossrole, and click OK.

Step 3: Grant permissions to the RAM role

The following steps show how to attach the AliyunHBRRolePolicy policy to the hbrcrossrole RAM role.

1. Use the account to be backed up to log on to the RAM console.

2. In the left-side navigation pane, choose Identities > Roles.

3. Find the hbrcrossrole RAM role and go to its details page.

4. On the Permissions tab, click Precise Permission.

5. In the Precise Permission dialog box, set Permission Type to System Policy, enter AliyunHBRRolePolicy in the Policy Name field, and then click OK.

6. A success message appears. Click Close.

7. Modify the trust policy of the RAM role.

   1. On the role details page, click the Trust Policy tab.

   2. Click Edit Trust Policy.

   3. Click the JSON tab and copy the following code to the code editor. Replace management-account-id with the ID of the management account.

      This policy grants the management account permission to obtain a temporary token through Cloud Backup to operate on the resources of the account to be backed up.

      Note

      You can go to the Security Settings page to view your Alibaba Cloud account ID.

      {
       "Statement": [
           {
               "Action": "sts:AssumeRole",
               "Effect": "Allow",
               "Principal": {
                   "RAM": [
                       "acs:ram::management-account-id:role/AliyunServiceRoleForHbrCrossAccountBackup"
                   ]
               }
           }
       ],
       "Version": "1"
      }

   4. Click OK.

Step 4: Add the managed account

1. Use the management account to log on to the Cloud Backup console.

2. In the left navigation bar, select Backup > Cross-Account Backup.

3. On the Cross-Account Backup page, switch to the region that contains the resources you want to back up.

   Important

   The management account must add the account to be backed up in the same region as the ECS files, NAS file systems, OSS buckets, Tablestore tables, ECS databases, or ECS instances to be backed up. Otherwise, Cloud Backup cannot find the resources, causing backup plans to be misconfigured or backup jobs to fail.

4. Click Add an account to be backed up. In the Add an account to be backed up panel, select RAM role assumption-based for Cross-account type, configure the following parameters, and then click OK.

   

   Parameter	Description
   Cross-account type	Select RAM role assumption-based. If your accounts are managed by using Resource Directory, we recommend that you see Add an account by using Resource Directory.
   Alibaba Cloud Account ID	Enter the Alibaba Cloud account ID. In this case, enter the ID of the account to be backed up. Note You can go to the Security Settings page to view your Alibaba Cloud account ID.
   Role Name	Enter the name of the RAM role that you created in the account to be backed up, such as hbrcrossrole. Important Click Check Permissions to verify that the authorization is correctly configured. If an error is reported, check your configuration and try again. If the check is successful, the following message appears: You are authorized to access the resources of this role.
   Account Alias	Specify an alias for the account to be backed up to facilitate identification. We recommend that you use the name of the Alibaba Cloud account to be backed up.

Is cross-account backup free?

The cross-account backup feature is free of charge. However, costs incurred during backup and restore operations are charged to the management account. Snapshot service fees for ECS instance backups and OSS request fees are charged to the account to be backed up. For more information, see Billing.

Cross-account vault replication vs. cross-account backup

• Cross-account replication for backup vaults: The source account runs a backup job and generates backup data. The source account then copies the data from its backup vault to another Alibaba Cloud account. As a result, both accounts store a copy of the backup data. This achieves data redundancy and allows the data to be used across accounts.

• Cross-account backup: The management account applies backup policies to the accounts to be backed up. The backup data from these accounts is centrally stored in the backup vaults of the management account. The management account can use the backup data to perform on-demand restore operations. This achieves unified management of backup data. The accounts to be backed up cannot view or manage their backed up data.

Both methods support account-level data isolation for accounts inside and outside a Resource Directory, making them widely used for enterprise data security and compliance. Choose the appropriate method. You can also combine the two methods to achieve both unified management and redundancy of backup data.