Data Transmission Service:Configure RAM authorization for data transmission from a self-managed database in a VPC across Alibaba Cloud accounts

Usage notes

You can synchronize or migrate data from a self-managed database in a VPC across Alibaba Cloud accounts when the self-managed database is used as the source database. If the self-managed database is used as the destination database, you cannot synchronize or migrate data to the self-managed database in the VPC across Alibaba Cloud accounts.

Step 1: Create a RAM role and grant the default permission on DTS to the RAM role

1. Log on to the RAM console by using the Alibaba Cloud account to which the Express Connect circuit belongs.

2. In the left-side navigation pane, choose Identities > Roles.

   Important

   Do not choose Identities > Users. Otherwise, DTS cannot access the instance, and an error will be reported.

3. On the Roles page, click Create Role.

4. In the Create Role panel, select Alibaba Cloud Account for the Select Trusted Entity parameter and click Next.

5. In the Create Role panel, specify Alibaba Cloud Account for the Select Trusted Entity parameter and click Next.

6. Configure parameters for the RAM role.
   1. Specify RAM Role Name.
   2. Optional:Specify Note.
   3. Select Current Alibaba Cloud Account or Other Alibaba Cloud Account.
      • Current Alibaba Cloud Account: If you want a RAM user that belongs to your Alibaba Cloud account to assume the RAM role, select Current Alibaba Cloud Account.
      • Other Alibaba Cloud Account: If you want a RAM user that belongs to a different Alibaba Cloud account to assume the RAM role, select Other Alibaba Cloud Account and enter the ID of the Alibaba Cloud account. This option is provided to authorize different Alibaba Cloud accounts.
        Note You can view the ID of an Alibaba Cloud account on the Security Settings page.
7. Click OK.

8. Click Input and Attach.

9. In the Add Permissions panel, select System Policy for Type.

10. In the Policy Name field, enter AliyunDTSRolePolicy.

11. Click OK.
12. Click Close.

Step 2: Authorize the RAM role to access the VPC within another Alibaba Cloud account

1. Log on to the RAM console by using the Alibaba Cloud account to which the Express Connect circuit belongs.

2. In the left-side navigation pane, choose Identities > Roles.

   Important

   Do not choose Identities > Users. Otherwise, DTS cannot access the instance, and an error will be reported.

3. Find the RAM role that you created in Step 1 and click the role name.

4. On the Permissions tab, click Grant Permission.

5. In the Grant Permission panel, attach the AliyunVPCReadOnlyAccess policy to the RAM role.

   1. Set the authorization scope.
      • Alibaba Cloud Account: The permissions take effect on the current Alibaba Cloud account.
      • Specific Resource Group: The permissions take effect in a specific resource group.
        Note If you select Specific Resource Group for Authorized Scope, make sure that the required cloud service supports resource groups. For more information, see Services that work with Resource Group.
   2. Specify the principal.
      The principal is the RAM role to which permissions are granted. By default, the current RAM role is specified. You can also specify a different RAM role.

   3. Attach a policy to the RAM role.

      Enter AliyunVPCReadOnlyAccess in the search box and click the policy name to add the policy to the Selected section.

      Note You can attach a maximum of five policies to a RAM role at a time. If you need to attach more than five policies to a RAM role, perform the operation multiple times.

6. Click OK.

7. Click Complete.

8. On the Basic Information page of the RAM role, click the Trust Policy Management tab.

9. Click Edit Trust Policy. In the Edit Trust Policy panel, replace the policy content with the following sample code.

   {
       "Statement": [
           {
               "Action": "sts:AssumeRole",
               "Effect": "Allow",
               "Principal": {
                   "RAM": [
                       "acs:ram::<ID of the Alibaba Cloud account to which the destination instance belongs>:root"
                   ],
                   "Service": [
                       "<ID of the Alibaba Cloud account to which the destination instance belongs>@dts.aliyuncs.com"
                   ]
               }
           }
       ],
       "Version": "1"
   }

   Note

   To obtain the ID of the Alibaba Cloud account to which the destination instance belongs, you must go to the Account Management page by using the account. The account ID is displayed on the Security Settings page. Then, you must replace <ID of Account B> in the preceding sample code with the account ID that you obtained.

10. Click OK.

Configure a data synchronization or migration task

1. Log on to the Data Management (DMS) console by using the Alibaba Cloud account to which the destination instance belongs.

2. Go to the corresponding task management page based on the actual case.

   Note

   The operations that you perform may vary based on the mode and layout of the DMS console. For more information, see Simple mode and Customize the layout and style of the DMS console.

3. Create a DTS task that migrates or synchronizes data across Alibaba Cloud accounts based on the type of the source and destination databases. For more information, see Overview of data synchronization scenarios, Overview of data migration scenarios, and Overview of change tracking scenarios.

   Note

   • You must set the Access Method parameter of the source database to Express Connect, VPN Gateway, or Smart Access Gateway and the Replicate Data Across Alibaba Cloud Accounts parameter to Yes.

   • If an error occurs when you set the Connected VPC parameter for the source database, refer to the solutions that are described in the Troubleshooting section of the "Synchronize or migrate data across Alibaba Cloud accounts" topic.