Preparations - Data Online Migration - Alibaba Cloud Documentation Center

This topic describes the operations that you must perform before you migrate data.

Step 1: Create a source NAS file system

Apsara File Storage NAS
- Create a mount target for your file system. For more information, see Manage mount points.
- If you configure a permission group for the Apsara File Storage NAS file system, you must allow all IP addresses in the virtual private cloud (VPC) to which the NAS file system is mounted to access the NAS file system. For more information, see Manage permission groups.
Third-party NAS
- Connect your NAS server to an Alibaba Cloud VPC.
  - To allow access to your NAS server over an Alibaba Cloud VPC, you can connect the NAS server to the VPC by using an Express Connect circuit. For information about how to deploy an Express Connect circuit, contact Alibaba Cloud Technical Support.
  - You can also connect your NAS server to the VPC over a VPN gateway.
- If you configure a permission group for the third-party NAS file system, you must allow all IP addresses in the VPC to which the NAS file system is mounted to access the NAS file system.

Step 2: Create a destination bucket

Create a destination bucket in the OSS console to store the migrated data. For more information, see Create a bucket.

Step 3: Create a RAM role that is used to migrate data

To ensure data security, we recommend that you create a RAM role and attach the required policies to the RAM role based on the principle of least privilege for data migration.

Note

If you want to migrate data across Alibaba Cloud accounts, you must create RAM roles for both Alibaba Cloud accounts to which the source and destination buckets belong. Then, you must attach the required policies to the RAM roles.

Log on to the RAM console.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click Create Role.
In the Select Role Type step of the Create Role wizard, select Alibaba Cloud Service and click Next.
In the Selected Trusted Entity section, select Normal Service Role as Role Type, enter a RAM role name in the RAM Role Name field, and select Data Online Migration from the Select Trusted Service drop-down list. Then, click OK.

Step 4: Grant permissions to the RAM user

After the RAM user is created, go to the Users page in the RAM console. Find the RAM user that you want to manage and click Add Permissions in the Actions column to grant permissions to the RAM user. Grant the required permissions to the RAM user based on the migration scenario.

Migrate data from Apsara File Storage NAS to OSS

Migrate data within the same Alibaba Cloud account

If you want to migrate data within the same Alibaba Cloud account, you must grant the following permissions to the RAM user:

System policy: AliyunMGWFullAccess
Custom policy:
- Permissions on Object Storage Service (OSS) resources
  Note
  The following policy is used to grant full control permissions to the RAM user on the bucket in which the migrated data is stored. mybucket indicates the name of the destination bucket. Replace <mybucket> with the name of the destination bucket.
  For more information about RAM policies for OSS, see Common examples of RAM policies.
```
{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "oss:*",
            "Resource": [
                "acs:oss:*:*:mybucket",
                "acs:oss:*:*:mybucket/*"
            ]
        }
    ]
}
```
- Permissions on Apsara File Storage NAS
  Grant the RAM user the permission to read source data. For more information about RAM policies for Apsara File Storage NAS, see Perform access control based on RAM policies.

Migrate data across Alibaba Cloud accounts

If you want to migrate data across Alibaba Cloud accounts, you must grant the following permissions to the RAM users:

RAM user that is created within the source Alibaba Cloud account
- System policy: AliyunMGWFullAccess
- Custom policy:
  Grant the RAM user the permission to read source data. For more information about RAM policies for Apsara File Storage NAS, see Perform access control based on RAM policies.
RAM user that is created within the destination Alibaba Cloud account
- System policy: AliyunMGWFullAccess
- Custom policy:
  Note
  The following policy is used to grant full control permissions to the RAM user on the bucket in which the migrated data is stored. mybucket indicates the name of the destination bucket. Replace <mybucket> with the name of the destination bucket.
  For more information about RAM policies for OSS, see Common examples of RAM policies.
```
{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "oss:*",
            "Resource": [
                "acs:oss:*:*:mybucket",
                "acs:oss:*:*:mybucket/*"
            ]
        }
    ]
}
```

Migrate data from third-party NAS to OSS

If you want to you migrate data from third-party NAS to OSS, you must grant the following permissions to the RAM users:

System policy: AliyunMGWFullAccess
Custom policy: Grant the RAM user full control permissions on the bucket in which the migrated data is stored.
Note
- The following policy is for reference only. Replace mybucket with the name of the destination bucket.
- For more information about RAM policies for OSS, see Common examples of RAM policies.
```
{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "oss:*",
            "Resource": [
                "acs:oss:*:*:mybucket",
                "acs:oss:*:*:mybucket/*"
            ]
        }
    ]
}
```