Configure a custom OSS bucket for DataAgent

Use cases

• Manage data analysis files: Store uploaded files (CSV, Excel, etc.) in a designated OSS bucket for tracking and reuse.

• Persist session history: Save session replays to review past analyses or share with team members.

• Archive result reports: Store DataAgent artifacts — analysis reports, visualizations — for long-term retention. Share them through OSS download links.

• Isolate data by workspace: Assign a separate OSS bucket to each workspace for project-level data isolation.

Configuration priority

DataAgent applies OSS configurations in this priority order:

Workspace OSS configuration > Global OSS configuration > Built-in OSS configuration

• Workspace-level configuration takes the highest precedence.

• If no workspace configuration exists, the global configuration applies.

• If no global configuration is set, the built-in default storage is used.

RAM permissions

Configuring OSS storage requires the following RAM permissions:

Custom role configuration

To allow DataAgent to access your OSS bucket, create a custom RAM role and grant it a least-privilege policy.

Step 1: Create a custom policy

1. Log in to the RAM Policy Console.

2. Click Create Policy.

3. Select the JSON Editor mode.

4. Copy the policy example for your storage types from "Minimum OSS bucket permissions" below.

5. Enter CustomPolicyForAliyunDataAgentAccessOss as the policy name.

6. Click OK to create the policy.

Step 2: Create a custom role

1. Log in to the RAM Role Console.

2. Click Create Role and select Cloud Service as the principal type.

3. Select Data Management/DMSEnterprise from the Principle Name drop-down list, and click OK.

4. In the dialog box that appears, enter CustomRoleForAliyunDataAgentAccessOss as the role name, and click OK.

   Note

   CustomRoleForAliyunDataAgentAccessOss is the role name, which differs from the policy name created in the previous step.

5. Return to the role list, click the role name, and click Grant Permission on the details page.

6. Search for and select the CustomPolicyForAliyunDataAgentAccessOss policy that you created in the previous step.

7. Click OK to confirm the authorization.

Minimum OSS bucket permissions

DataAgent stores three types of files, each requiring different OSS permissions. Grant only the permissions you need.

Local uploads

Session history files

Supported in both global and workspace-level configurations.

Result report files

Supported in both global and workspace-level configurations.

Complete configuration example

The following policy covers all three storage types. This example uses the China (Hangzhou) region.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:ListObjects"
      ],
      "Resource": "acs:oss:oss-cn-hangzhou:${your-aliyun-parent-uid}:${your-oss-bucket-name}"
    },
    {
      "Effect": "Allow",
      "Action": [
        "oss:GetObject",
        "oss:PutObject",
        "oss:DeleteObject"
      ],
      "Resource": "acs:oss:oss-cn-hangzhou:${your-aliyun-parent-uid}:${your-oss-bucket-name}/*"
    }
  ]
}

CORS configuration

Configure Cross-Origin Resource Sharing (CORS) rules if the DataAgent web interface needs to upload files directly or replay session history. In the OSS console, add the following allowed origins to your bucket:

http://*.console.aliyun.com
https://*.console.aliyun.com
http://*.dms.aliyun.com
https://*.dms.aliyun.com
http://*.dms.alibabacloud.com
https://*.dms.alibabacloud.com

FAQ

Related documents

• Import OSS files with DataAgent

• RAM role overview

• OSS permission management

• Cross-Origin Resource Sharing (CORS)