Migrate data between ApsaraDB RDS instances of different Alibaba Cloud accounts - Data Transmission Service

You can use Data Transmission Service (DTS) to migrate data between ApsaraDB RDS instances of different Alibaba Cloud accounts. This topic describes how to use DTS to migrate data between ApsaraDB RDS instances of different Alibaba Cloud accounts.

Prerequisites

The account of the destination instance is an Alibaba Cloud account.
The available storage space of the destination instance is larger than the total size of the data in the source instance.

Billing

Migration type	Task configuration fee	Internet traffic fee
Schema migration and full data migration	Free of charge.	Charged only when data is migrated from Alibaba Cloud over the Internet. For more information, see Billing overview.
Incremental data migration	Charged. For more information, see Billing overview.

Permissions required for database accounts

Instance	Schema migration	Full data migration	Incremental data migration
Source ApsaraDB RDS instance	Read and write permissions	Read and write permissions	Read and write permissions
Destination ApsaraDB RDS instance	Read and write permissions	Read and write permissions	Read and write permissions

Preparations

Required:Obtain the IDs of the Alibaba Cloud account to which the source and destination instances belong.
Note
Skip the step if you have obtained the IDs of the Alibaba Cloud accounts to which the source and destination instances belong.
1. Log on to the Account Management console by using the Alibaba Cloud account to which the source or destination instance belongs.
2. Optional:In the left-side navigation pane, click Basic Information.
3. View and record the value of the Account ID parameter.

Create a RAM role.

Log on to the RAM console by using the Alibaba Cloud account to which the source instance belongs.
Important
We recommend that you use the Alibaba Cloud account to which the source instance belongs to grant permissions. Otherwise, an error message that indicates the permissions are not granted to the RAM role may appear when you configure a DTS task.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click Create Role.
In the Create Role panel, select Alibaba Cloud Account for the Select Trusted Entity parameter and click Next.

In the Configure Role step, configure parameters for the RAM role. Select Trusted Entity

Parameter	Description
RAM Role Name	The name of the RAM role. In this example, ram-for-dts is used. Note The role name must be 1 to 64 characters in length and can contain letters, digits, and hyphens (-).
Note	Optional. The description for the RAM role.
Select Trusted Alibaba Cloud Account	Select Other Alibaba Cloud Account and enter the ID of the Alibaba Cloud account to which the destination instance belongs. For information about how to obtain the ID of an Alibaba Cloud account, see Preparations.

Click OK.

Click Input and Attach to grant permissions to the created RAM role.
1. In the Add Permissions panel, select System Policy as Type.
2. In the Policy Name field, enter AliyunDTSRolePolicy.
3. Click OK.
4. After you grant the permissions, click Close.
Modify the trust policy.
1. On the Roles page, find the RAM role that you created and click the role name to view details.
2. On the Basic Information page of the RAM role, click the Trust Policy Management tab.
3. On the Trust Policy Management tab, click Edit Trust Policy.
4. Copy the following code to the code editor:
```
{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "RAM": [
                    "acs:ram::<ID of the Alibaba Cloud account to which the destination instance belongs>:root"
                ],
                "Service": [
                    "<ID of the Alibaba Cloud account to which the destination instance belongs>@dts.aliyuncs.com"
                ]
            }
        }
    ],
    "Version": "1"
}
```
5. In the preceding code, replace ID of the Alibaba Cloud account to which the destination instance belongs with the Alibaba Cloud account ID that you specified when you configure the RAM role information.
6. Click OK.

Procedure

In this example, data is migrated between ApsaraDB RDS instances of different Alibaba Cloud accounts.

Go to the Data Migration page by using the Alibaba Cloud account to which the destination instance belongs.
1. Log on to the Data Management (DMS) console by using the Alibaba Cloud account to which the destination instance belongs.
2. In the top navigation bar, move the pointer over DTS.
3. Choose DTS (DTS) > Data Migration.
Note You can also go to the Data Migration page in the DTS console of the new version.
From the drop-down list next to Data Migration Tasks, select the region in which your data migration instance resides.
Note If you use the new DTS console, select the region in which the data migration instance resides in the upper-left corner.

Click Create Task and configure the source and destination databases.

Warning After you select the source and destination instances, we recommend that you read the limits displayed at the top of the page. This helps ensure that the task properly runs or prevent data inconsistency.

Section	Parameter	Description
N/A	Task Name	The name of the task. DTS automatically generates a task name. We recommend that you specify an informative name to identify the task. You do not need to specify a unique task name.
Source Database	Select an existing DMS database instance	The database instance that you want to use. You can choose whether to use an existing instance based on your business requirements. If you use an existing instance, DTS automatically applies the parameter settings of the source database. If you do not use an existing instance, you must configure the parameters for the database.
	Database Type	The type of the source instance. Select MySQL.
	Access Method	The access method of the source instance. Select Alibaba Cloud Instance.
	Instance Region	The region in which the source ApsaraDB RDS instance resides. Note You can select different regions for the source and destination ApsaraDB RDS instances.
	Replicate Data Across Alibaba Cloud Accounts	Specifies whether to migrate data across Alibaba Cloud accounts. In this example, Yes is selected.
	Alibaba Cloud Account	The ID of the Alibaba Cloud account that owns the source instance. Note To obtain the ID of the Alibaba Cloud account that owns the source instance, you must log on to the Account Management console by using this account. The account ID is displayed on the Basic Information page.
	RAM Role Name	The RAM role that is assigned to the Alibaba Cloud account that owns the source instance. For more information, see Configure RAM authorization for cross-account data migration and synchronization.
	RDS instance ID	The ID of the source ApsaraDB RDS instance. Note If an alert message is displayed when you select an ApsaraDB RDS instance ID, modify the parameter values as prompted. For more information about alert messages, see the FAQ section of this topic.
	Database Account	The account of the source database. For more information about the required permissions, see the Permissions required for database accounts section of this topic.
	Database Password	The password of the database account.
	Encryption	Specifies whether to encrypt the connection to the source instance. Select Non-encrypted or SSL-encrypted based on your business requirements. In this example, Non-encrypted is selected. Note If you want to select SSL-encrypted, you must enable SSL encryption for the ApsaraDB RDS instance before you configure the data migration task. For more information, see Configure SSL encryption for an ApsaraDB RDS for MySQL instance.
Destination Database	Select an existing DMS database instance	The database instance that you want to use. You can choose whether to use an existing instance based on your business requirements. If you use an existing instance, DTS automatically applies the parameter settings of the instance. If you do not use an existing instance, you must configure the parameters for the database.
	Database Type	The type of the destination instance. Select MySQL.
	Access Method	The access method of the destination instance. Select Alibaba Cloud Instance.
	Instance Region	The region in which the destination ApsaraDB RDS instance resides. Note You can select different regions for the source and destination ApsaraDB RDS instances.
	RDS instance ID	The ID of the destination ApsaraDB RDS instance. Note If an alert message is displayed when you select an ApsaraDB RDS instance ID, modify the parameter values as prompted. For more information about alert messages, see the FAQ section of this topic.
	Database Account	The account of the destination database. For more information about the required permissions, see the Permissions required for database accounts section of this topic.
	Database Password	The password of the database account.
	Encryption	Specifies whether to encrypt the connection to the destination instance. Select Non-encrypted or SSL-encrypted based on your business requirements. In this example, Non-encrypted is selected. Note If you want to select SSL-encrypted, you must enable SSL encryption for the ApsaraDB RDS instance before you configure the data migration task. For more information, see Configure SSL encryption on an ApsaraDB RDS for MySQL instance.

In the lower part of the page, click Test Connectivity and Proceed.
If the source or destination database is an Alibaba Cloud database instance, such as an ApsaraDB RDS for MySQL or ApsaraDB for MongoDB instance, DTS automatically adds the CIDR blocks of DTS servers to the whitelist of the instance. If the source or destination database is a self-managed database hosted on an Elastic Compute Service (ECS) instance, DTS automatically adds the CIDR blocks of DTS servers to the security group rules of the ECS instance, and you must make sure that the ECS instance can access the database. If the source or destination database is a self-managed database that is deployed in a data center or provided by a third-party cloud service provider, you must manually add the CIDR blocks of DTS servers to the whitelist of the database to allow DTS to access the database. For more information about the CIDR blocks of DTS servers, see Add the CIDR blocks of DTS servers to the security settings of on-premises databases.
Warning If the CIDR blocks of DTS servers are automatically or manually added to the whitelist of a database or an instance, or to the security group rules of an ECS instance, security risks may arise. Therefore, before you use DTS to migrate data, you must understand and acknowledge the potential risks and take preventive measures, including but not limited to the following measures: enhance the security of your username and password, limit the ports that are exposed, authenticate API calls, regularly check the whitelist or ECS security group rules and forbid unauthorized CIDR blocks, or connect the database to DTS by using Express Connect, VPN Gateway, or Smart Access Gateway.

Configure objects to migrate and advanced settings.

Parameter or setting	Description
Migration Type	To perform only full data migration, select Schema Migration and Full Data Migration. To ensure service continuity during data migration, select Schema Migration, Full Data Migration, and Incremental Data Migration. Note If Incremental Data Migration is not selected, we recommend that you do not write data to the source instance during data migration. This ensures data consistency between the source and destination instances.
Processing Mode of Conflicting Tables	Precheck and Report Errors: checks whether the destination database contains tables that have the same names as tables in the source database. If the source and destination databases do not contain identical table names, the precheck is passed. Otherwise, an error is returned during the precheck and the data migration task cannot be started. Note You can use the object name mapping feature to rename the tables that are migrated to the destination database. You can use this feature if the source and destination databases contain tables that have identical names and the tables in the destination database cannot be deleted or renamed. For more information, see Map object names. Ignore Errors and Proceed: skips the precheck for identical table names in the source and destination databases. Warning If you select Ignore Errors and Proceed, data inconsistency may occur, and your business may be exposed to potential risks. If the source and destination databases have the same schema, DTS does not migrate data records that have the same primary keys as data records in the destination database. If the source and destination databases have different schemas, only some columns are migrated or the data migration task fails. Proceed with caution.
Capitalization of Object Names in Destination Instance	The capitalization of database names, table names, and column names in the destination instance. By default, DTS default policy is selected. You can select other options to ensure that the capitalization of object names is consistent with the default capitalization of object names in the source or destination database. For more information, see Specify the capitalization of object names in the destination instance.
Select Objects	Select one or more objects from the Source Objects section and click the icon to add the objects to the Selected Objects section.
Rename Databases and Tables	To rename an object that you want to migrate to the destination instance, right-click the object in the Selected Objects section. For more information, see Map the name of a single object. To rename multiple objects at a time, click in the upper-right corner of the Selected Objects section. For more information, see Map multiple object names at a time. Note If you use the object name mapping feature to rename an object, other objects that are dependent on the object may fail to be migrated.
Filter data	You can specify WHERE conditions to filter data. For more information, see Use SQL conditions to filter data.
Select the SQL operations to be incrementally migrated	In the Selected Objects section, right-click an object. In the dialog box that appears, select the DDL and DML operations that you want to migrate.

Click Next: Advanced Settings to configure advanced settings.

Parameter	Description
Set Alerts	Specifies whether to set alerts for the data migration task. If the task fails or the migration latency exceeds the threshold, the alert contacts will receive notifications. Valid values: No: does not set alerts. Yes: sets alerts. If you select Yes, you must also set the alert threshold and alert contacts. For more information, see Configure monitoring and alerting when you create a DTS task.
Copy the temporary table of the Online DDL tool that is generated in the source table to the destination database	If you use Data Management (DMS) or the gh-ost tool to perform online DDL operations on the source database, you can specify whether to migrate the temporary tables generated by online DDL operations. Valid values: Important You cannot use tools such as pt-online-schema-change to perform online DDL operations on the source database. Otherwise, the DTS task fails. Yes: DTS migrates the data of temporary tables generated by online DDL operations. Note If online DDL operations generate a large amount of data, the data migration task may take an extended period of time to complete. No, Adapt to DMS Online DDL: DTS does not migrate the data of temporary tables generated by online DDL operations. Only the original DDL operations that are performed by using DMS are migrated. Note If you select this option, the tables in the destination database may be locked. No, Adapt to gh-ost: DTS does not migrate the data of temporary tables generated by online DDL operations. Only the original DDL operations that are performed by using the gh-ost tool are migrated. You can use the default or custom regular expressions to filter out the shadow tables of the gh-ost tool and tables that are not required. Note If you select this option, the tables in the destination database may be locked.
Retry Time for Failed Connections	The retry time range for failed connections. If the source or destination database fails to be connected after the data migration task is started, DTS immediately retries a connection within the time range. Valid values: 10 to 1440. Unit: minutes. Default value: 720. We recommend that you set the parameter to a value greater than 30. If DTS reconnects to the source and destination databases within the specified time range, DTS resumes the data migration task. Otherwise, the data migration task fails. Note If you set different retry time ranges for multiple data migration tasks that share the same source or destination database, the value that is set later takes precedence. If DTS retries a connection, you are charged for the operation of the DTS instance. We recommend that you specify the retry time based on your business needs and release the DTS instance at your earliest opportunity after the source and destination instances are released.
Configure ETL	Specifies whether to configure the extract, transform, and load (ETL) feature. For more information, see What is ETL?What is ETL? Valid values: Yes: configures the ETL feature. You can enter data processing statements in the code editor. For more information, see Configure ETL in a data migration or data synchronization task. No: does not configure the ETL feature.

In the lower part of the page, click Next: Save Task Settings and Precheck.
Note
- Before you can start the data migration task, DTS performs a precheck. You can start the data migration task only after the task passes the precheck.
- If the task fails to pass the precheck, click View Details next to each failed item. After you troubleshoot the issues based on the causes, run a precheck again.
- If an alert is triggered for an item during the precheck:
  If an alert item cannot be ignored, click View Details next to the failed item and troubleshoot the issues. Then, run a precheck again.
  If an alert item can be ignored, click Confirm Alert Details. In the View Details dialog box, click Ignore. In the message that appears, click OK. Then, click Precheck Again to run a precheck again. If you ignore the alert item, data inconsistency may occur, and your business may be exposed to potential risks.
Wait until the Success Rate value becomes 100%. Then, click Next: Purchase Instance.

On the Purchase Instance page, specify the Instance Class parameter for the data migration instance. The following table describes the parameter.

Section	Parameter	Description
Parameters	Instance Class	DTS provides several instance classes that vary in the migration speed. You can select an instance class based on your business scenario. For more information, see Specifications of data migration instances.

Read and select the check box to agree to Data Transmission Service (Pay-as-you-go) Service Terms.
Click Buy and Start to start the data migration task. You can view the progress of the task in the task list.

FAQ

The following table describes common alert messages and the corresponding solutions when you configure the source and destination databases.

Alert message	Solution
	The value of the Alibaba Cloud Account parameter is invalid. Check whether you enter a valid ID of the Alibaba Cloud account to which the source instance belongs. For more information, see Preparations.
	Possible causes: The value of the RAM Role Name parameter is invalid. Check whether you enter a valid RAM role name of the Alibaba Cloud account to which the source instance belongs. The required permissions are not granted to the RAM role. Use the Alibaba Cloud account to which the source instance belongs to grant permissions. Note For more information, see Preparations.
	Possible causes: The value of the RAM Role Name parameter is invalid. Check whether you enter a valid RAM role name of the Alibaba Cloud account to which the source instance belongs. The required permissions are not granted to the RAM role. Check whether you have granted the required permissions to the RAM role. The trust policy of the RAM role is not modified. Check whether you correctly have modified the trust policy for the RAM role. Note For more information, see Preparations.
	The RAM role that you specify in the RAM Role Name parameter is not granted permissions by clicking Input and Attach on the Roles page in the Resource Access Management (RAM) console. Grant the required permissions to the RAM role by clicking Input and Attach on the Roles page and create a task again. For more information, see Grant permissions to an existing RAM role.