Cloud Backup:Cross-account backup

(Optional) Step 1: Set a delegated administrator account

To use a member account of a resource directory as the management account, you must set this account as a delegated administrator account for Cloud Backup. You can do this from the trusted services page for your resource directory in the Resource Management console. For more information, see Manage a delegated administrator account.

1. Log on to the Resource Management console by using the management account of your resource directory.

2. In the left-side navigation pane, choose Resource Directory > Trusted Services.

3. On the Trusted Services page, find the Cloud Backup service and click Manage in the Actions column.

4. In the Delegated Administrator Account section, click Add.

5. In the Add Delegated Administrator Account panel, select the intended management account.

6. Click OK.

   After the account is added, the Cloud Backup service appears in the list of trusted services when you log on to the Resource Management console with the delegated administrator account.

Step 2: Add a managed account

1. Log on to the Cloud Backup console by using the management account.

2. In the left-side navigation pane, choose Backup > Cross-Account Backup.

3. On the Cross-Account Backup page, switch to the region where the resources of the account to be backed up are located.

4. Click Add the account to be backed up.

5. In the Add the account to be backed up panel, configure the following parameters and click OK.

   Parameter	Description
   Cross-account type	Select Based on Resource Directory.
   Select an account to be backed up	Select an account from the resource directory. You can select only one account at a time. You can enter a keyword to quickly find the account that you want to add.

   Note

   For accounts that are part of a resource directory, we recommend that you configure cross-account backup based on Resource Directory. However, you can also use the method based on RAM role assumption. For more information, see Add an account by using RAM role assumption.

   After the account is added, it appears in the account list.When an account to be backed up is managed for the first time, Cloud Backup automatically creates the AliyunServiceRoleForHbrRd service-linked role:

   • Role name: AliyunServiceRoleForHbrRd

   • Permission policy: AliyunServiceRolePolicyForHbrRd

   • Description: Allows Cloud Backup to access the resources of other authorized accounts for cross-account backup and restore operations.

Step 1: Create a service-linked role

You must authorize the management account to use the AliyunServiceRoleForHbrCrossAccountBackup service-linked role.

• Role name: AliyunServiceRoleForHbrCrossAccountBackup

• Permission policy: AliyunServiceRolePolicyForHbrCrossAccountBackup

• Description: Allows the backup service to access resources in other authorized accounts for cross-account backup and restore operations.

1. Log on to the Cloud Backup console by using the management account.

2. In the left-side navigation pane, choose Backup > Cross-Account Backup.

3. On the Cross-Account Backup page, switch to the region where the resources to be backed up are located.

4. Click Add the account to be backed up. In the Add the account to be backed up panel, select Based on RAM Role Assumption for the Cross-account type parameter.

5. In the Cloud Backup Authorization dialog box, click Authorize.

   For more information, see Service-linked roles for Cloud Backup.

Step 2: Create a RAM role in the managed account

1. Log on to the RAM console by using the account to be backed up.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, click Create Role.

4. On the Create Role page, select Cloud Account for Principal Type and Other Cloud Account for Principal Name. Enter the Account ID of the management account, and then click OK.

   

   Note

   To view your Alibaba Cloud account ID, go to the Security Settings page.

5. In the Create Role dialog box, enter a RAM role name, such as hbrcrossrole, and then click OK.

Step 3: Grant permissions to the RAM role

The following steps show how to grant the AliyunHBRRolePolicy permissions to the hbrcrossrole RAM role:

1. Log on to the RAM console by using the account to be backed up.

2. In the left-side navigation pane, choose Identities > Roles.

3. Find the target RAM role hbrcrossrole, and go to its details page.

4. On the Permissions tab, click Add Permissions.

5. In the Add Permissions panel, set Policy Type to System Policy, enter AliyunHBRRolePolicy as the policy name, and then click OK.

6. A message appears indicating that the permissions are granted. Click Close.

7. Modify the trust policy of the RAM role.

   1. On the role details page, click the Trust Policy tab.

   2. Click Edit Trust Policy.

   3. Click the JSON Editor tab and copy the following code into the policy editor. Replace management-account-id with the ID of the management account.

      This policy allows the management account to obtain a temporary token through Cloud Backup to operate the resources of the account to be backed up.

      Note

      You can go to the Security Settings page to view your Alibaba Cloud account ID.

      {
       "Statement": [
           {
               "Action": "sts:AssumeRole",
               "Effect": "Allow",
               "Principal": {
                   "RAM": [
                       "acs:ram::management-account-id:role/AliyunServiceRoleForHbrCrossAccountBackup"
                   ]
               }
           }
       ],
       "Version": "1"
      }

   4. Click OK.

Step 4: Add the managed account

1. Log on to the Cloud Backup console by using the management account.

2. In the left-side navigation pane, choose Backup > Cross-Account Backup.

3. On the Cross-Account Backup page, switch to the region where the resources to be backed up are located.

   Important

   You must add the account to be backed up in the same region as its resources (ECS files, NAS, OSS, Tablestore, Database Backup, or ECS instances). Otherwise, Cloud Backup cannot find the resources, causing backup plans or tasks to fail.

4. Click Add the account to be backed up. In the Add the account to be backed up panel, set Cross-account type to Based on RAM Role Assumption, configure the following parameters, and then click OK.

   

   Parameter	Description
   Cross-account type	Select Based on RAM role assumption. If the management account is a Cloud Backup administrator for a resource directory, we recommend that you see Add an account by using Resource Directory.
   Alibaba Cloud Account ID	Enter the ID of the account to be backed up. Note You can go to the Security Settings page to view your Alibaba Cloud account ID.
   Role Name	Enter the RAM role name for the account to be backed up, such as hbrcrossrole. Important Click Check Permissions to verify that the authorization is configured correctly. If an error is reported, check your configuration and try again. If the check is successful, the message You are authorized to access the resources of this role. appears.
   Account Alias	Set an easy-to-identify name for the account. We recommend that you use the account name of the account to be backed up.

Is the cross-account backup feature free of charge?

The feature itself is free, but costs associated with backup and restore operations are charged to the management account. Snapshot service fees for ECS instance backups and OSS request fees are charged to the account being backed up. For more information, see Billing.

Cross-account replication vs. cross-account backup

• Cross-account replication of a backup vault: The source account performs a backup and then copies the data from its backup vault to another Alibaba Cloud account. As a result, both accounts have a copy of the backup data. This is used to create backup data redundancy or to use the data in a different account.

• Cross-account backup: The management account assigns backup policies to other accounts. The backup data from these accounts is stored centrally in the management account. The management account can then use this data for on-demand restore operations, which allows for unified management of backup data. The accounts being backed up cannot view or manage the backed-up data.

Both methods are widely used for enterprise data security and compliance. They both support account-level data isolation for accounts within or outside a resource directory. You can select a method based on your business needs or combine both methods to achieve unified data management and backup data redundancy.