Cloud Backup:Cross-account backup

(Optional) Step 1: Set a delegated administrator account for Cloud Backup

To use a member account of a resource directory as the management account, you must set the account as the delegated administrator account for the Cloud Backup service in the trusted services of the resource directory in the Resource Management console. For more information, see Manage delegated administrator accounts.

1. Log on to the Resource Management console using the management account of the resource directory.

2. In the left navigation pane, choose Resource Directory > Trusted Service.

3. On the Trusted Service page, in the row for the Cloud Backup service, click Manage in the Actions column.

4. In the Delegated Administrator Account section, click Add.

5. In the Add Delegated Administrator Account panel, select the management account.

6. Click OK.

   After the account is added, the Cloud Backup service appears in the trusted services of the resource directory when you log on to the Resource Management console with the delegated administrator account.

Step 2: Add the account to be backed up in the management account

1. Log on to the Cloud Backup console using a management account.

2. In the left navigation pane, choose Backup > Cross-Account Backup.

3. On the Cross-Account Backup page, switch to the region where the source account's resources are located.

4. Click Add an account to be backed up.

5. In the Add an account to be backed up panel, configure the following parameters and click OK.

   Parameter	Description
   Cross Account Type	Select Resource Directory Based.
   Select an account to be backed up	Select the account to be backed up from the resource directory. You can select only one account from the resource directory each time you add an account to be backed up. Enter a keyword to quickly find the desired member.

   Note

   For accounts that are added to a resource directory, configure cross-account backup using the resource directory. You can also configure cross-account backup by assuming a RAM role. For more information, see Add an account to be backed up using RAM role assumption.

   After the account is added, the account to be backed up appears in the account list.When an account to be backed up is managed for the first time, Cloud Backup automatically creates the AliyunServiceRoleForHbrRd service-linked role:

   • Role name: AliyunServiceRoleForHbrRd

   • Access policy: AliyunServiceRolePolicyForHbrRd

   • Permission description: Allows Cloud Backup to access the resources of other authorized accounts for cross-account backup and restore operations.

Step 1: Create a RAM role in the account to be backed up

1. Log on to the RAM console using the account that you want to back up.

2. In the left navigation pane, choose Identities > Roles.

3. On the Roles page, click Create Role.

4. On the Create Role page, set Principal Type to Cloud Account. Then, set Principal Name to Other Account, enter the ID of the account, and click OK.

   

   Note

   You can go to the Security Settings page to view your Alibaba Cloud account ID.

5. In the Create Role dialog box, enter a name for the RAM role, such as hbrcrossrole, and click OK.

Step 2: Grant permissions to the RAM role in the account to be backed up

The following example shows how to grant the AliyunHBRRolePolicy permissions to the hbrcrossrole RAM role:

1. Log on to the Resource Access Management (RAM) console using the account to be backed up.

2. In the navigation pane on the left, choose Identities > Roles.

3. Find the hbrcrossrole RAM role and go to the role details page.

4. On the Permissions tab, click Precise Permission.

5. In the Precise Permission page, set the Policy Type to System Policy, enter AliyunHBRRolePolicy for the Policy Name, and then click OK.

6. A success message is displayed, confirming the precise authorization. Click Close.

7. Modify the trust policy of the RAM role.

   1. On the role details page, click the Trust Policy tab.

   2. Click Edit Trust Policy.

   3. On the JSON tab, copy the following code into the text box. Replace destination-account-id with the ID of the management account.

      This policy allows the management account to obtain a temporary token through Cloud Backup to operate the resources of the account to be backed up.

      {
       "Statement": [
           {
               "Action": "sts:AssumeRole",
               "Effect": "Allow",
               "Principal": {
                   "RAM": [
                       "acs:ram::destination-account-id:role/AliyunServiceRoleForHbrCrossAccountBackup"
                   ]
               }
           }
       ],
       "Version": "1"
      }

   4. Click OK.

Step 3: Add the account to be backed up in the management account

1. Log on to the Cloud Backup console using a management account.

2. In the navigation pane on the left, choose Backup > Cross-Account Backup.

3. On the Cross-Account Backup page, switch to the region that contains the resources you want to back up.

   Important

   The management account must add the account to be backed up in the region where the ECS files, NAS file systems, OSS buckets, Tablestore tables, databases on ECS instances, or ECS instances to be backed up are located. Otherwise, Cloud Backup cannot find the resources to be backed up, which causes backup plans or backup tasks to fail.

4. Click Add an account to be backed up. In the displayed panel, configure the following parameters and then click OK.

   

   Parameter	Description
   Cross Account Type	Select the option to assume a RAM role. If the backup management account is a Resource Directory Cloud Backup service administrator, see Add accounts from a resource directory.
   Alibaba Cloud Account ID	Enter the Alibaba Cloud account ID. In this case, enter the ID of the account to be backed up.
   Role Name	Enter the name of the RAM role created in the account to be backed up, such as hbrcrossrole. When the management account adds an account to be backed up for the first time, you must authorize the service-linked role AliyunServiceRoleForHbrCrossAccountBackup. After the authorization is complete, you do not need to repeat it. Role name: AliyunServiceRoleForHbrCrossAccountBackup Access policy: AliyunServiceRolePolicyForHbrCrossAccountBackup Permission description: Allows the backup service to access the resources of other authorized accounts for cross-account backup and restoration. Important Click Check Permissions to check whether the previous authorization configuration is correct. If an error is reported, check the configuration and try again. If the check is successful, the message You are authorized to access the resources of this role. appears.
   Account Alias	Set an easy-to-identify name for the backup account. We recommend using the Alibaba Cloud account name of the account to be backed up.

Is the cross-account backup feature free?

Yes, the feature is free of charge. Associated costs that are generated during backup and recovery are borne by the management account. However, snapshot service fees for ECS instance backups and OSS request fees are still borne by the account to be backed up. For more information, see Billing.

What is the difference between cross-account backup vault replication and cross-account backup? In what scenarios are they used?

• Cross-account replication of backup vaults: The source account has already performed a backup and generated backup data. The source account copies the data from its backup vault to another Alibaba Cloud account. As a result, both accounts store a copy of the backup data to achieve data redundancy or enable cross-account use.

• Cross-account backup: The management account uniformly issues backup policies to the accounts to be backed up. The backup data from these accounts is stored in the management account. The management account can use this backup data for on-demand restoration, which achieves unified management of backup data. The accounts to be backed up cannot view or manage the backed-up data.

Both methods are widely used in enterprise data security and compliance scenarios. Both support account-level data isolation and storage for accounts both within and outside a resource directory. Choose a method as needed. You can also combine both methods to achieve both unified management and redundancy of backup data.