All Products
Search
Document Center

:Preparations

Last Updated:Aug 28, 2026

Complete these preparation steps before starting a data migration task.

Step 1: Upload the list file

An HTTP/HTTPS list file consists of two components: a manifest.json file that defines the schema, and one or more .csv.gz files that contain the actual file list. Each .csv.gz file must not exceed 100 MB.

  1. Create a CSV list file

    Create a CSV-formatted list file on your local machine. Each row represents a file. Rows are separated by a line feed (\n), and columns within each row are separated by commas (,).

    Important
    • Key and Url are required. All other fields are optional.

    • Each row must end with a line feed. Missing line feeds cause CSV parsing failures that interrupt the migration task.

    • Required items

      Name

      Required

      Description

      Notes

      Url

      Yes

      Data Online Migration uses this URL to download the file content (GET request) and retrieve file metadata (HEAD request).

      Note

      The Url must be accessible via commands such as curl --HEAD "$Url" and curl --GET "$Url". Data Online Migration does not support URL redirection.

      Both Url and Key must be URL-encoded if they contain special characters. Without encoding, the migration may fail.

      • Url: URL-encode the URL so that it remains accessible by command-line tools such as curl (without redirection).

      • Key: URL-encode the intended object name for the file in OSS.

      Important

      After encoding, confirm the following. Otherwise, the migration may fail or the file path at the destination may differ from what you expect.

      • The plus sign (+) in the original string is encoded as %2B.

      • The percent sign (%) in the original string is encoded as %25.

      • The comma (,) in the original string is encoded as %2C.

      For example, the original string a+b%c,d.file encodes to a%2Bb%25c%2Cd.file.

      Key

      Yes

      The object name in OSS after migration. The final name is prefix + Key value. For example, if the prefix is backup/ and the Key is images/photo.jpg, the object is stored as backup/images/photo.jpg.

      The following example shows a plain (unencoded) CSV file named plain_example.csv with two columns: Url and Key. The URLs are directly accessible using the curl command, and the Key values are the intended object names in OSS.

      https://help-static-aliyun-doc.aliyuncs.com/assets/img/zh-CN/1354977961/p486238.jpg,assets/img/zh-CN/1354977961/p486238.jpg
      https://www.example-fake1.com/url-that-can-be-accessed-only-after-encoding/123.png,url-that-can-be-accessed-only-after-encoding/123.png
      https://www.example-fake2.com/url-that-can-be-accessed-without-encoding/123.png,url-that-can-be-accessed-without-encoding/123.png
      https://www.example-fake3.com/Chinese/Japanese/Korean/123.png,Chinese/Japanese/Korean/123.png
      Important

      Do not use the built-in Notepad application on Windows to edit manifest.json or plain_example.csv. Notepad may add a byte order mark (BOM) (0xefbbbf) to the first 3 bytes of the file, causing parsing errors in Data Online Migration. On Linux or macOS, run od -c plain_example.csv | less to check whether the BOM is present. On Windows, use Notepad++ or Visual Studio Code instead.

      If your URLs or keys contain special characters, encode them before use. The following Python script reads plain_example.csv line by line and writes the URL-encoded output to example.csv.

      # -*- coding: utf-8 -*-
      import sys
      
      if sys.version_info.major == 3:
          from urllib.parse import quote_plus
      else:
          from urllib import quote_plus
          reload(sys)
          sys.setdefaultencoding("utf-8")
      
      # Source CSV file path.
      src_path = "plain_example.csv"
      # URL-encoded file path.
      out_path = "example.csv"
      
      # The sample CSV contains only two columns: url and key.
      with open(src_path) as fin, open(out_path, "w") as fout:
          for line in fin:
              items = line.strip().split(",")
              url, key = items[0], items[1]
              enc_url = quote_plus(url.encode("utf-8"))
              enc_key = quote_plus(key.encode("utf-8"))
              # The enc_url and enc_key vars are encoded format.
              fout.write(enc_url + "," + enc_key + "\n")
      

      After running the script, example.csv contains the following encoded content:

      https%3A%2F%2Fhelp-static-aliyun-doc.aliyuncs.com%2Fassets%2Fimg%2Fzh-CN%2F1354977961%2Fp486238.jpg,assets%2Fimg%2Fzh-CN%2F1354977961%2Fp486238.jpg
      https%3A%2F%2Fwww.example-fake1.com%2Furl-that-can-be-accessed-only-after-encoding%2F123.png,url-that-can-be-accessed-only-after-encoding%2F123.png
      https%3A%2F%2Fwww.example-fake2.com%2Furl-that-can-be-accessed-without-encoding%2F123.png,url-that-can-be-accessed-without-encoding%2F123.png
      https%3A%2F%2Fwww.example-fake3.com%2FChinese%2FJapanese%2FKorean%2F123.png,Chinese%2FJapanese%2FKorean%2F123.png
    • All items

      Name

      Required

      Notes

      Key

      Yes

      The object name in OSS after migration. The final name is prefix + Key value.

      Url

      Yes

      Data Online Migration uses this URL to download the file content (GET request) and retrieve file metadata (HEAD request).

      Size

      No

      The size of the file to migrate, in bytes.

      Note

      This field is used to calculate storage usage for migrated files. If omitted, the storage usage chart in the console will be unavailable.

      Note

      The order of items is not fixed, but must match the order of fields in the fileSchema field in manifest.json.

  2. Compress the CSV file

    Compress each CSV file into a .csv.gz file using gzip.

    • Compress a single file

      To compress a single file named example.csv, run:

      gzip -c example.csv > example.csv.gz
      Note

      The gzip command without the -c flag removes the source file after compression. To keep the source file, use gzip -c <source_file> > <source_file>.gz.

      This produces a .csv.gz file.

    • Compress multiple files

      To compress all CSV files in a directory (for example, example1.csv, example2.csv, and example3.csv in the dir directory), run:

      gzip -r dir
      Note

      The gzip command compresses each file in the directory separately and does not package the directory itself. Source files are not retained.

      This produces example1.csv.gz, example2.csv.gz, and example3.csv.gz in the dir directory.

  3. Create the manifest.json file

    The manifest.json file defines the schema and references all CSV list files. Configure the following fields:

    • fileFormat: Set to CSV.

    • fileSchema: Lists the column names in the CSV file, in the same order as the columns.

      Note

      The number of columns in the CSV file must match the number of fields in fileSchema. The migration service validates this at task creation.

    • files: An array of CSV file references. Each entry includes:

      • key: The path to the .csv.gz file in the bucket.

      • MD5checksum: A 16-digit hexadecimal MD5 string (case-insensitive). Example: 91A76757B25C8BE78BC321DEEBA6A5AD. Leave blank to skip the checksum check.

      • size: The size of the .csv.gz file.

    Example:

    {
        "fileFormat":"CSV",
        "fileSchema":"Url, Key",
        "files":[{
            "key":"dir/example1.csv.gz",
            "MD5checksum":"",
            "size":0
        },{
            "key":"dir/example2.csv.gz",
            "MD5checksum":"",
            "size":0
        }]
    }
  4. Upload the manifest file to OSS or AWS S3.

    1. Upload manifest.json and all .csv.gz files. The file names in the bucket must match the file names referenced in manifest.json.

    2. Record the path to manifest.json. You will need to specify this path when creating the source data address.

Step 2: Create a destination bucket

Create a destination bucket to store the migrated data. For more information, see Create a bucket.

Step 3: Create a RAM user and grant permissions

Important
  • You must use this RAM user to create roles and perform migration tasks. We recommend that you create this RAM user under the Alibaba Cloud account that owns the source or destination bucket.

  • To create a RAM user, see Quick start: Create a RAM user and grant permissions.

Log on to the RAM console with your Alibaba Cloud account. On the Users page, find the RAM user that you created and click Add Permissions in the Actions column.

  1. System policy: Permissions for managing Online Migration Service (AliyunOSSImportFullAccess).

  2. Custom policy: This policy must include the ram:CreateRole, ram:CreatePolicy, ram:AttachPolicyToRole, and ram:ListRoles permissions.

    For more information about how to manage permissions, see Create a custom policy. The following is a sample policy:

    {
        "Version":"1",
        "Statement":[
            {
                "Effect":"Allow",
                "Action":[
                    "ram:CreateRole",
                    "ram:CreatePolicy",
                    "ram:AttachPolicyToRole",
                    "ram:ListRoles"
                ],
                "Resource":"*"
            }
        ]
    }

Step 4: Grant permissions on the manifest bucket

Instructions vary depending on whether the inventory bucket belongs to your account.

Inventory bucket in your account

  • One-click authorization

    We recommend using the one-click authorization feature in the Data Online Migration console. You can find this option under Migration Implementation > Step 2 > Authorize List Role.

  • Manual authorization

    Grant inventory bucket permissions

    On the Roles page, find the RAM role you created and click Add Permissions in the Actions column.

    • Custom policy: This policy must include the oss:List* and oss:Get* permissions.

    For more information about how to create a custom policy, see Create a custom policy. The following code provides an example policy:

    Note

    This is an example policy. Replace <myInvBucket> with the name of your inventory bucket.

    For more information about OSS permission policies, see Common examples of RAM policies.

    Important

    If the inventory bucket contains objects encrypted with KMS, you must also attach the AliyunKMSFullAccess system policy to the RAM role.

    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "oss:List*",
            "oss:Get*"
          ],
          "Resource": [
            "acs:oss:*:*:<myInvBucket>",
            "acs:oss:*:*:<myInvBucket>/*"
          ]
        }
      ]
    }

Inventory bucket in another account

Grant inventory bucket permissions

  1. Log on to the OSS console with the Alibaba Cloud account that owns the inventory bucket.

  2. In the left-side navigation pane, click Buckets and then click the name of the inventory bucket.

  3. In the left-side navigation pane, choose Permission Control > Bucket Policy.

  4. On the Add by Syntax tab, click Edit and add the following bucket policy.

  • Custom policy:

    Grant the RAM role permissions to list and read all resources in the bucket.

    Note

    This is an example policy. Replace the placeholders with your actual values: <otherInvBucket> with the inventory bucket name, <myuid> with the Alibaba Cloud account ID of the account used to access the Data Online Migration console, <otherUid> with the Alibaba Cloud account ID of the inventory bucket owner, and <roleName> with the role name you created. For more information about OSS permission policies, see Common examples of RAM policies.

    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "oss:List*",
            "oss:Get*"
          ],
          "Principal": [
             "arn:sts::<myUid>:assumed-role/<roleName>/*"
          ],
          "Resource": [
            "acs:oss:*:<otherUid>:<otherInvBucket>",
            "acs:oss:*:<otherUid>:<otherInvBucket>/*"
          ]
        }
      ]
    }

2. Grant KMS permissions

  1. If the inventory bucket contains objects encrypted with KMS, you must also attach the AliyunKMSFullAccess system policy to the RAM role.

  2. If objects in the inventory bucket are encrypted with a customer-managed key, grant the RAM role access to that key by following these steps:

    1. Log on to the Key Management Service console and find the key.

    2. Set the Key Policy, select Users from other accounts, and enter the principal ARN. For more information, see Set a key policy. Click Key Policy. In the panel that appears, configure Administrators and Users by searching for and selecting them by RAM user or RAM role name. In the Users from other accounts section, enter the principal ARN in the format acs:ram::<userId>:role/<ramrole> or acs:ram::<userId>:user/<ramuser>. Click Add Principal ARN to add multiple ARNs.

Step 5: Grant permissions on the destination bucket

Follow the steps that correspond to your destination bucket's ownership.

Destination in same account

  • Automatic authorization

    Use automatic role authorization in the Data Online Migration console: Migration Implementation > Step 3 > Authorize Role.

  • Manual authorization

    Note

    Use manual authorization when:

    • You want a single RAM role to manage multiple source buckets.

    • Your account is near the RAM role limit.

    • Automatic authorization is not suitable or unavailable for your use case.

    1. Create a RAM role

    Log on to the RAM console, go to the Roles page, and click Create Role.

    1. For Select Trusted Entity, select Alibaba Cloud Service.

    2. For Role Type, select Data Transport.

    3. Enter a Role Name. The name must be in all lowercase letters.

    For example, enter role-test. A role name can be up to 64 characters in length and can contain letters, digits, hyphens (-), and periods (.). After you enter the name, click OK.

    2. Grant permissions to the RAM role

    On the Roles page, find the RAM role and click Add Permissions in the Actions column.

    • Create and attach a custom policy with these permissions: oss:List*, oss:Get*, oss:Put*, and oss:AbortMultipartUpload.

    Create a custom policy. Example policy:

    Note

    Replace <myDestBucket> with your destination bucket name.

    Common examples of RAM policies.

    Important

    If the destination bucket uses SSE-KMS encryption, you must also attach the AliyunKMSFullAccess system policy to the RAM role.

    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "oss:List*",
            "oss:Get*",
            "oss:Put*",
            "oss:AbortMultipartUpload"
          ],
          "Resource": [
            "acs:oss:*:*:<myDestBucket>",
            "acs:oss:*:*:<myDestBucket>/*"
          ]
        }
      ]
    }

Destination in different account

1. Create a RAM role

In the Alibaba Cloud account used for the migration, log on to the RAM console, go to the Roles page, and click Create Role.

  1. For Select Trusted Entity, select Alibaba Cloud Service.

  2. For Role Type, select Data Transport.

  3. Enter a Role Name. The name must be in all lowercase letters.

For example, enter role-test. A role name can be up to 64 characters in length and can contain letters, digits, hyphens (-), and periods (.). After you enter the name, click OK.

2. Authorize the destination bucket

Important

A new Bucket Policy overwrites the existing one. Include all previous statements to preserve existing permissions.

  1. Using the Alibaba Cloud account that owns the destination bucket, log on to the OSS console.

  2. In the left-side navigation pane, click Buckets. On the Buckets page, click the name of the destination bucket.

  3. In the left-side navigation pane, choose Permission Control > Bucket Policy.

  4. On the Add by Syntax tab, click Edit to define a custom Bucket Policy.

    • Grant the RAM role permissions to list, read, and write all objects in the bucket.

Note

Replace the following placeholders: <otherDestBucket> with the name of the destination bucket, <otherUid> with the UID of the Alibaba Cloud account that owns the destination bucket, <myUid> with the UID of the Alibaba Cloud account for the migration console, and <roleName> with the name of the role created above. Common examples of RAM policies.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:List*",
        "oss:Get*",
        "oss:Put*",
        "oss:AbortMultipartUpload"
      ],
      "Principal": [
         "arn:sts::<myUid>:assumed-role/<roleName>/*"
      ],
      "Resource": [
        "acs:oss:*:<otherUid>:<otherDestBucket>",
        "acs:oss:*:<otherUid>:<otherDestBucket>/*"
      ]
    }
  ]
}
3. KMS authorization
  1. If the destination bucket uses SSE-KMS encryption, you must also attach the AliyunKMSFullAccess system policy to the RAM role in the account used for the migration.

  2. If the destination bucket uses a custom KMS key, grant the RAM role access to the key:

    1. Log on to the KMS console and find the key.

    2. Configure the key policy. Select Users of Other Accounts and enter the ARN of the authorized principal. Configure a key policy.

      In the Key Policy dialog box, configure the following authorized principals:

      • Key administrators: Enter the name of a RAM user or RAM role to search and add.

      • Key users: Enter the name of a RAM user or RAM role to search and add.

      • Key users of other accounts: Enter the ARN of the authorized principal in the format acs:ram::<userId>:role/<ramrole> or acs:ram::<userId>:user/<ramuser>, and click Add ARN of Key User of Other Accounts to add multiple entries.