[Notice] Requirement for RAM authorization to log on to the DMS console

To further enhance the security of accessing databases through Data Management (DMS) and prevent unauthorized access to databases by RAM users that do not have required permissions, DMS will optimize the authorization policy for logging on to the DMS console on May 15, 2025. After the adjustment, only RAM users and RAM roles that have the AliyunDMSLoginConsoleAccess permission can log on to the DMS console.

Adjustment time

May 15, 2025

Impact scope

RAM users that do not have the AliyunDMSLoginConsoleAccess permission cannot log on to the DMS console.

Solutions

Solution 1: Grant the permission to RAM users in the RAM console

Prerequisites

You must have the permission to manage RAM users, such as AliyunRAMUserManageAccess.

Procedure

Log on to the RAM console as a RAM user with the administrator identity. In the left-side navigation pane, click Users.
Find the RAM user that you want to manage and click Add Permissions in the Actions column.
Find and select the AliyunDMSLoginConsoleAccess policy, and click Grant Permissions.
If Completed is displayed, the permission is granted to the RAM user.

Solution 2: Grant the permission to RAM users in the DMS console

Prerequisites

You can only grant the logon permission to RAM users or RAM roles that previously accessed DMS.
You must have the permission to manage RAM users, such as AliyunRAMUserManageAccess.
You are a DMS administrator.

Procedure

Log on to DMS as a DMS administrator and go to the Users page.
Click RAM Authorization to grant the AliyunDMSLoginConsoleAccess permission to existing DMS users.
Note
The RAM authorization feature in DMS is an interim solution. This feature will be discontinued after the permission is granted to all RAM users. The specific discontinuation timeline will be announced separately.
- If the administrator (Alibaba Cloud account) does not create the AliyunDMSAttachRamPolicyRole policy that is used to grant specific permissions to RAM users or roles, the system is automatically redirected to the RAM console after you click RAM Authorization. Perform the operations as prompted.
  - DMS executes the RAM authorization task asynchronously. The authorization process takes about one to two minutes. Go to the RAM console to check whether the permission is granted to relevant RAM users or roles.
  - If the authorization fails, it indicates that you do not have the AliyunRAMUserManageAccess permission. Go to the RAM console to grant the permission to RAM users or RAM roles.
- If the administrator (Alibaba Cloud account) has created the AliyunDMSAttachRamPolicyRole policy, grant the permission to RAM users as prompted in DMS.