All Products
Search

This Product

    Data Online Migration:Prerequisites

    Document Center

    Data Online Migration:Prerequisites

    Last Updated:Jun 03, 2026

    Complete the required users, buckets, and permissions before migrating data from Amazon S3 to OSS.

    Step 1: Create an IAM user

    For security, create an IAM user with read permissions on the source data and generate access keys. IAM user.

    Important

    • Data Online Migration does not support AWS S3 IP address whitelists. Disable any whitelist before migration.

    • This link is for reference only and the content may be outdated.

    Step 2: Create a destination bucket

    Create a destination bucket to store the migrated data. For more information, see Create a bucket.

    Step 3: Create a RAM user and grant permissions

    Important

    • Use this user to create roles and perform migration tasks. We recommend creating this RAM user in the Alibaba Cloud account that owns the source bucket or the destination bucket.

    • If you have not created a RAM user, see Quick start: Create a RAM user and grant permissions.

    Log on to the RAM console with your Alibaba Cloud account. On the Users page, find the RAM user, and then click Add Permissions in the Actions column.

    1. System policy: Attach the AliyunOSSImportFullAccess (permissions to manage Data Online Migration) policy.

    2. Custom policy: This policy must include the ram:CreateRole, ram:CreatePolicy, ram:AttachPolicyToRole, and ram:ListRoles permissions.

      For more information, see Create a custom policy. The following is a sample policy:

      {
    "Version":"1",
    "Statement":[
        {
            "Effect":"Allow",
            "Action":[
                "ram:CreateRole",
                "ram:CreatePolicy",
                "ram:AttachPolicyToRole",
                "ram:ListRoles"
            ],
            "Resource":"*"
        }
    ]
}

    Step 4: Authorize the destination bucket

    Choose the tab that matches your destination bucket ownership.

    Destination in same account

    • Automatic authorization

      Use automatic role authorization in the Data Online Migration console: Migration Implementation > Step 3 > Authorize Role.

    • Manual authorization

      Note

      Use manual authorization when:

      • You want a single RAM role to manage multiple source buckets.

      • Your account is near the RAM role limit.

      • Automatic authorization is not suitable or unavailable for your use case.

      1. Create a RAM role

      Log on to the RAM console, go to the Roles page, and click Create Role.

      1. For Select Trusted Entity, select Alibaba Cloud Service.

      2. For Role Type, select Data Transport.

      3. Enter a Role Name. The name must be in all lowercase letters.

      lQLPKIBPhyQhs7vNAlPNA-mwb_9Zfe8j6sMHtpv2syNfAA_1001_595

      image

      2. Grant permissions to the RAM role

      On the Roles page, find the RAM role and click Add Permissions in the Actions column.

      • Create and attach a custom policy with these permissions: oss:List*, oss:Get*, oss:Put*, and oss:AbortMultipartUpload.

      Create a custom policy. Example policy:

      Note

      Replace <myDestBucket> with your destination bucket name.

      Common examples of RAM policies.

      Important

      If the destination bucket uses SSE-KMS encryption, you must also attach the AliyunKMSFullAccess system policy to the RAM role.

      {
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:List*",
        "oss:Get*",
        "oss:Put*",
        "oss:AbortMultipartUpload"
      ],
      "Resource": [
        "acs:oss:*:*:<myDestBucket>",
        "acs:oss:*:*:<myDestBucket>/*"
      ]
    }
  ]
}

    Destination in different account

    1. Create a RAM role

    In the Alibaba Cloud account used for the migration, log on to the RAM console, go to the Roles page, and click Create Role.

    1. For Select Trusted Entity, select Alibaba Cloud Service.

    2. For Role Type, select Data Transport.

    3. Enter a Role Name. The name must be in all lowercase letters.

    lQLPKIBPhyQhs7vNAlPNA-mwb_9Zfe8j6sMHtpv2syNfAA_1001_595

    image

    2. Authorize the destination bucket

    Important

    A new Bucket Policy overwrites the existing one. Include all previous statements to preserve existing permissions.

    1. Using the Alibaba Cloud account that owns the destination bucket, log on to the OSS console.

    2. In the left-side navigation pane, click Buckets. On the Buckets page, click the name of the destination bucket.

    3. In the left-side navigation pane, choose Permission Control > Bucket Policy.

    4. On the Add by Syntax tab, click Edit to define a custom Bucket Policy.

      • Grant the RAM role permissions to list, read, and write all objects in the bucket.

    Note

    Replace the following placeholders: <otherDestBucket> with the name of the destination bucket, <otherUid> with the UID of the Alibaba Cloud account that owns the destination bucket, <myUid> with the UID of the Alibaba Cloud account for the migration console, and <roleName> with the name of the role created above. Common examples of RAM policies.

    {
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:List*",
        "oss:Get*",
        "oss:Put*",
        "oss:AbortMultipartUpload"
      ],
      "Principal": [
         "arn:sts::<myUid>:assumed-role/<roleName>/*"
      ],
      "Resource": [
        "acs:oss:*:<otherUid>:<otherDestBucket>",
        "acs:oss:*:<otherUid>:<otherDestBucket>/*"
      ]
    }
  ]
}

    3. KMS authorization

    1. If the destination bucket uses SSE-KMS encryption, you must also attach the AliyunKMSFullAccess system policy to the RAM role in the account used for the migration.

    2. If the destination bucket uses a custom KMS key, grant the RAM role access to the key:

      1. Log on to the KMS console and find the key.

      2. Configure the key policy. Select Users of Other Accounts and enter the ARN of the authorized principal. Configure a key policy.image

    Step 5: Restore archived data

    • You must manually restore objects from the Archive storage class before creating a source data address and migration task.

    • Set the restoration period (the number of days the object stays restored) to be long enough to complete the entire migration. This prevents objects from returning to the archived state mid-migration.

    • You may be charged for the restoration operation. The fee may be relatively high. For more information about the billing methods, contact the service provider that offers the source bucket.

    Note

    Data Online Migration will not automatically restore archived objects. Objects that are still archived or in the process of being restored cannot be migrated and will be skipped.

    To learn how to restore objects in Alibaba Cloud OSS, see Restore objects.

    Amazon S3 object restoration: Restoring an archived object.

    Important

    This link is for reference only and the content may be outdated.