Complete these preparation steps before starting a data migration task.
Step 1: Upload the list file
An HTTP/HTTPS list file consists of two components: a manifest.json file that defines the schema, and one or more .csv.gz files that contain the actual file list. Each .csv.gz file must not exceed 100 MB.
Create a CSV list file
Create a CSV-formatted list file on your local machine. Each row represents a file. Rows are separated by a line feed (
\n), and columns within each row are separated by commas (,).ImportantKey and Url are required. All other fields are optional.
Each row must end with a line feed. Missing line feeds cause CSV parsing failures that interrupt the migration task.
Required items
Name
Required
Description
Notes
Url
Yes
Data Online Migration uses this URL to download the file content (GET request) and retrieve file metadata (HEAD request).
NoteThe Url must be accessible via commands such as
curl --HEAD "$Url"andcurl --GET "$Url". Data Online Migration does not support URL redirection.Both Url and Key must be URL-encoded if they contain special characters. Without encoding, the migration may fail.
Url: URL-encode the URL so that it remains accessible by command-line tools such as
curl(without redirection).Key: URL-encode the intended object name for the file in OSS.
ImportantAfter encoding, confirm the following. Otherwise, the migration may fail or the file path at the destination may differ from what you expect.
The plus sign (+) in the original string is encoded as %2B.
The percent sign (%) in the original string is encoded as %25.
The comma (,) in the original string is encoded as %2C.
For example, the original string
a+b%c,d.fileencodes toa%2Bb%25c%2Cd.file.Key
Yes
The object name in OSS after migration. The final name is
prefix + Key value. For example, if the prefix isbackup/and the Key isimages/photo.jpg, the object is stored asbackup/images/photo.jpg.The following example shows a plain (unencoded) CSV file named
plain_example.csvwith two columns:UrlandKey. The URLs are directly accessible using thecurlcommand, and theKeyvalues are the intended object names in OSS.https://help-static-aliyun-doc.aliyuncs.com/assets/img/zh-CN/1354977961/p486238.jpg,assets/img/zh-CN/1354977961/p486238.jpg https://www.example-fake1.com/url-that-can-be-accessed-only-after-encoding/123.png,url-that-can-be-accessed-only-after-encoding/123.png https://www.example-fake2.com/url-that-can-be-accessed-without-encoding/123.png,url-that-can-be-accessed-without-encoding/123.png https://www.example-fake3.com/Chinese/Japanese/Korean/123.png,Chinese/Japanese/Korean/123.pngImportantDo not use the built-in Notepad application on Windows to edit
manifest.jsonorplain_example.csv. Notepad may add a byte order mark (BOM) (0xefbbbf) to the first 3 bytes of the file, causing parsing errors in Data Online Migration. On Linux or macOS, runod -c plain_example.csv | lessto check whether the BOM is present. On Windows, use Notepad++ or Visual Studio Code instead.If your URLs or keys contain special characters, encode them before use. The following Python script reads
plain_example.csvline by line and writes the URL-encoded output toexample.csv.# -*- coding: utf-8 -*- import sys if sys.version_info.major == 3: from urllib.parse import quote_plus else: from urllib import quote_plus reload(sys) sys.setdefaultencoding("utf-8") # Source CSV file path. src_path = "plain_example.csv" # URL-encoded file path. out_path = "example.csv" # The sample CSV contains only two columns: url and key. with open(src_path) as fin, open(out_path, "w") as fout: for line in fin: items = line.strip().split(",") url, key = items[0], items[1] enc_url = quote_plus(url.encode("utf-8")) enc_key = quote_plus(key.encode("utf-8")) # The enc_url and enc_key vars are encoded format. fout.write(enc_url + "," + enc_key + "\n")After running the script,
example.csvcontains the following encoded content:https%3A%2F%2Fhelp-static-aliyun-doc.aliyuncs.com%2Fassets%2Fimg%2Fzh-CN%2F1354977961%2Fp486238.jpg,assets%2Fimg%2Fzh-CN%2F1354977961%2Fp486238.jpg https%3A%2F%2Fwww.example-fake1.com%2Furl-that-can-be-accessed-only-after-encoding%2F123.png,url-that-can-be-accessed-only-after-encoding%2F123.png https%3A%2F%2Fwww.example-fake2.com%2Furl-that-can-be-accessed-without-encoding%2F123.png,url-that-can-be-accessed-without-encoding%2F123.png https%3A%2F%2Fwww.example-fake3.com%2FChinese%2FJapanese%2FKorean%2F123.png,Chinese%2FJapanese%2FKorean%2F123.pngAll items
Name
Required
Notes
Key
Yes
The object name in OSS after migration. The final name is
prefix + Key value.Url
Yes
Data Online Migration uses this URL to download the file content (GET request) and retrieve file metadata (HEAD request).
Size
No
The size of the file to migrate, in bytes.
NoteThis field is used to calculate storage usage for migrated files. If omitted, the storage usage chart in the console will be unavailable.
NoteThe order of items is not fixed, but must match the order of fields in the fileSchema field in
manifest.json.
Compress the CSV file
Compress each CSV file into a
.csv.gzfile using gzip.Compress a single file
To compress a single file named
example.csv, run:gzip -c example.csv > example.csv.gzNoteThe
gzipcommand without the-cflag removes the source file after compression. To keep the source file, usegzip -c <source_file> > <source_file>.gz.This produces a
.csv.gzfile.Compress multiple files
To compress all CSV files in a directory (for example,
example1.csv,example2.csv, andexample3.csvin thedirdirectory), run:gzip -r dirNoteThe
gzipcommand compresses each file in the directory separately and does not package the directory itself. Source files are not retained.This produces
example1.csv.gz,example2.csv.gz, andexample3.csv.gzin thedirdirectory.
Create the manifest.json file
The
manifest.jsonfile defines the schema and references all CSV list files. Configure the following fields:fileFormat: Set toCSV.fileSchema: Lists the column names in the CSV file, in the same order as the columns.NoteThe number of columns in the CSV file must match the number of fields in
fileSchema. The migration service validates this at task creation.files: An array of CSV file references. Each entry includes:key: The path to the.csv.gzfile in the bucket.MD5checksum: A 16-digit hexadecimal MD5 string (case-insensitive). Example:91A76757B25C8BE78BC321DEEBA6A5AD. Leave blank to skip the checksum check.size: The size of the.csv.gzfile.
Example:
{ "fileFormat":"CSV", "fileSchema":"Url, Key", "files":[{ "key":"dir/example1.csv.gz", "MD5checksum":"", "size":0 },{ "key":"dir/example2.csv.gz", "MD5checksum":"", "size":0 }] }Upload the manifest file to OSS or AWS S3.
Upload
manifest.jsonand all.csv.gzfiles. The file names in the bucket must match the file names referenced inmanifest.json.Record the path to
manifest.json. You will need to specify this path when creating the source data address.
Step 2: Create a destination bucket
Create a destination bucket to store the migrated data. For more information, see Create a bucket.
Step 3: Create a RAM user and grant permissions
-
You must use this RAM user to create roles and perform migration tasks. We recommend that you create this RAM user under the Alibaba Cloud account that owns the source or destination bucket.
-
To create a RAM user, see Quick start: Create a RAM user and grant permissions.
Log on to the RAM console with your Alibaba Cloud account. On the Users page, find the RAM user that you created and click Add Permissions in the Actions column.
-
System policy: Permissions for managing Online Migration Service (AliyunOSSImportFullAccess).
-
Custom policy: This policy must include the
ram:CreateRole,ram:CreatePolicy,ram:AttachPolicyToRole, andram:ListRolespermissions.For more information about how to manage permissions, see Create a custom policy. The following is a sample policy:
{ "Version":"1", "Statement":[ { "Effect":"Allow", "Action":[ "ram:CreateRole", "ram:CreatePolicy", "ram:AttachPolicyToRole", "ram:ListRoles" ], "Resource":"*" } ] }
Step 4: Grant permissions on the manifest bucket
Instructions vary depending on whether the inventory bucket belongs to your account.
Inventory bucket in your account
-
One-click authorization
We recommend using the one-click authorization feature in the Data Online Migration console. You can find this option under Migration Implementation > Step 2 > Authorize List Role.
-
Manual authorization
Grant inventory bucket permissions
On the Roles page, find the RAM role you created and click Add Permissions in the Actions column.
-
Custom policy: This policy must include the
oss:List*andoss:Get*permissions.
For more information about how to create a custom policy, see Create a custom policy. The following code provides an example policy:
NoteThis is an example policy. Replace <myInvBucket> with the name of your inventory bucket.
For more information about OSS permission policies, see Common examples of RAM policies.
ImportantIf the inventory bucket contains objects encrypted with KMS, you must also attach the AliyunKMSFullAccess system policy to the RAM role.
{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "oss:List*", "oss:Get*" ], "Resource": [ "acs:oss:*:*:<myInvBucket>", "acs:oss:*:*:<myInvBucket>/*" ] } ] } -
Inventory bucket in another account
Grant inventory bucket permissions
-
Log on to the OSS console with the Alibaba Cloud account that owns the inventory bucket.
-
In the left-side navigation pane, click Buckets and then click the name of the inventory bucket.
-
In the left-side navigation pane, choose Permission Control > Bucket Policy.
-
On the Add by Syntax tab, click Edit and add the following bucket policy.
-
Custom policy:
Grant the RAM role permissions to list and read all resources in the bucket.
NoteThis is an example policy. Replace the placeholders with your actual values: <otherInvBucket> with the inventory bucket name, <myuid> with the Alibaba Cloud account ID of the account used to access the Data Online Migration console, <otherUid> with the Alibaba Cloud account ID of the inventory bucket owner, and <roleName> with the role name you created. For more information about OSS permission policies, see Common examples of RAM policies.
{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "oss:List*", "oss:Get*" ], "Principal": [ "arn:sts::<myUid>:assumed-role/<roleName>/*" ], "Resource": [ "acs:oss:*:<otherUid>:<otherInvBucket>", "acs:oss:*:<otherUid>:<otherInvBucket>/*" ] } ] }
2. Grant KMS permissions
-
If the inventory bucket contains objects encrypted with KMS, you must also attach the AliyunKMSFullAccess system policy to the RAM role.
-
If objects in the inventory bucket are encrypted with a customer-managed key, grant the RAM role access to that key by following these steps:
-
Log on to the Key Management Service console and find the key.
-
Set the Key Policy, select Users from other accounts, and enter the principal ARN. For more information, see Set a key policy. Click Key Policy. In the panel that appears, configure Administrators and Users by searching for and selecting them by RAM user or RAM role name. In the Users from other accounts section, enter the principal ARN in the format
acs:ram::<userId>:role/<ramrole>oracs:ram::<userId>:user/<ramuser>. Click Add Principal ARN to add multiple ARNs.
-
Step 5: Grant permissions on the destination bucket
Follow the steps that correspond to your destination bucket's ownership.
Destination in same account
-
Automatic authorization
Use automatic role authorization in the Data Online Migration console: Migration Implementation > Step 3 > Authorize Role.
-
Manual authorization
NoteUse manual authorization when:
-
You want a single RAM role to manage multiple source buckets.
-
Your account is near the RAM role limit.
-
Automatic authorization is not suitable or unavailable for your use case.
1. Create a RAM role
Log on to the RAM console, go to the Roles page, and click Create Role.
-
For Select Trusted Entity, select Alibaba Cloud Service.
-
For Role Type, select Data Transport.
-
Enter a Role Name. The name must be in all lowercase letters.
For example, enter
role-test. A role name can be up to 64 characters in length and can contain letters, digits, hyphens (-), and periods (.). After you enter the name, click OK.2. Grant permissions to the RAM role
On the Roles page, find the RAM role and click Add Permissions in the Actions column.
-
Create and attach a custom policy with these permissions:
oss:List*,oss:Get*,oss:Put*, andoss:AbortMultipartUpload.
Create a custom policy. Example policy:
NoteReplace <myDestBucket> with your destination bucket name.
ImportantIf the destination bucket uses SSE-KMS encryption, you must also attach the AliyunKMSFullAccess system policy to the RAM role.
{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "oss:List*", "oss:Get*", "oss:Put*", "oss:AbortMultipartUpload" ], "Resource": [ "acs:oss:*:*:<myDestBucket>", "acs:oss:*:*:<myDestBucket>/*" ] } ] } -
Destination in different account
1. Create a RAM role
In the Alibaba Cloud account used for the migration, log on to the RAM console, go to the Roles page, and click Create Role.
-
For Select Trusted Entity, select Alibaba Cloud Service.
-
For Role Type, select Data Transport.
-
Enter a Role Name. The name must be in all lowercase letters.
For example, enter role-test. A role name can be up to 64 characters in length and can contain letters, digits, hyphens (-), and periods (.). After you enter the name, click OK.
2. Authorize the destination bucket
A new Bucket Policy overwrites the existing one. Include all previous statements to preserve existing permissions.
-
Using the Alibaba Cloud account that owns the destination bucket, log on to the OSS console.
-
In the left-side navigation pane, click Buckets. On the Buckets page, click the name of the destination bucket.
-
In the left-side navigation pane, choose Permission Control > Bucket Policy.
-
On the Add by Syntax tab, click Edit to define a custom Bucket Policy.
-
Grant the RAM role permissions to list, read, and write all objects in the bucket.
-
Replace the following placeholders: <otherDestBucket> with the name of the destination bucket, <otherUid> with the UID of the Alibaba Cloud account that owns the destination bucket, <myUid> with the UID of the Alibaba Cloud account for the migration console, and <roleName> with the name of the role created above. Common examples of RAM policies.
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"oss:List*",
"oss:Get*",
"oss:Put*",
"oss:AbortMultipartUpload"
],
"Principal": [
"arn:sts::<myUid>:assumed-role/<roleName>/*"
],
"Resource": [
"acs:oss:*:<otherUid>:<otherDestBucket>",
"acs:oss:*:<otherUid>:<otherDestBucket>/*"
]
}
]
}
3. KMS authorization
-
If the destination bucket uses SSE-KMS encryption, you must also attach the AliyunKMSFullAccess system policy to the RAM role in the account used for the migration.
-
If the destination bucket uses a custom KMS key, grant the RAM role access to the key:
-
Log on to the KMS console and find the key.
-
Configure the key policy. Select Users of Other Accounts and enter the ARN of the authorized principal. Configure a key policy.
In the Key Policy dialog box, configure the following authorized principals:
-
Key administrators: Enter the name of a RAM user or RAM role to search and add.
-
Key users: Enter the name of a RAM user or RAM role to search and add.
-
Key users of other accounts: Enter the ARN of the authorized principal in the format
acs:ram::<userId>:role/<ramrole>oracs:ram::<userId>:user/<ramuser>, and click Add ARN of Key User of Other Accounts to add multiple entries.
-
-