Data Management Service (DMS) uses two service-linked roles to access other Alibaba Cloud services on your behalf: AliyunServiceRoleForDMS for DMS features, and AliyunServiceRoleForDBS for Data Disaster Recovery. This topic describes what each role does, what permissions it holds, and how to create, view, or delete it.
Background
A service-linked role is a special type of Resource Access Management (RAM) role with two key differences from a regular RAM role:
-
Owned by the service: The role is created by and belongs to the cloud service, not your account.
-
Permissions are fixed: You cannot edit the permission policy. The permissions are defined and managed by the service itself.
For a general overview of RAM roles, see RAM role overview. For more about the service-linked role mechanism, see Service-linked roles.
Scenarios
Data Management (DMS)
If a feature of DMS needs to access resources such as ECS, VPC, RDS, and other databases or tools, the service-linked role for DMS grants the required access permissions.
Data Disaster Recovery (DBS)
The service-linked role for DBS (AliyunServiceRoleForDBS) is a RAM role with permissions to access other Alibaba Cloud services. DBS uses this role to obtain the access permissions required to connect to ApsaraDB databases that you purchased on Alibaba Cloud, such as RDS, MongoDB, Redis, and PolarDB, or to self-managed databases on ECS instances. For more information, see Service-linked roles.
Role details
AliyunServiceRoleForDMS
What this role does
AliyunServiceRoleForDMS lets DMS access Elastic Compute Service (ECS) instances, virtual private clouds (VPCs), ApsaraDB RDS instances, and resources across the databases and tools it manages. Specifically:
-
Query ApsaraDB RDS, PolarDB, Lindorm, and other cloud database resources to enable centralized management of Alibaba Cloud databases.
-
Query ECS instances and VPCs to manage self-managed databases hosted on ECS and internet-accessible databases.
-
Invoke Data Transmission Service (DTS) and Data Disaster Recovery to support data migration, synchronization, and backup workflows.
| Field | Value |
|---|---|
| Role name | AliyunServiceRoleForDMS |
| Policy name | AliyunServiceRolePolicyForDMS |
| Trusted service | dms.aliyuncs.com |
AliyunServiceRoleForDBS
What this role does
AliyunServiceRoleForDBS lets Data Disaster Recovery connect to and manage the following databases:
-
Alibaba Cloud databases: ApsaraDB RDS instances, ApsaraDB for MongoDB instances, Tair (Redis OSS-compatible) instances, and PolarDB databases.
-
Self-managed databases hosted on ECS instances.
The role must exist before Data Disaster Recovery can access any of these databases. When you use Data Disaster Recovery for the first time, the system creates this role automatically.
| Field | Value |
|---|---|
| Role name | AliyunServiceRoleForDBS |
| Policy name | AliyunServiceRolePolicyForDBS |
| Trusted service | dbs.aliyuncs.com |
Permissions required to create a service-linked role
Data Management (DMS)
Before a service-linked role can be created, the RAM user performing the action must have the ram:CreateServiceLinkedRole permission scoped to the appropriate service.
Specific permissions are required to create the service-linked role for DMS.
If the RAM user lacks this permission, attach a custom policy with the following statement. For instructions, see Create custom policies and Grant permissions to a RAM user.
Example policy: Allow the creation of a service-linked role for DMS.
For AliyunServiceRoleForDMS:
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "dms.aliyuncs.com"
}
}
}Data Disaster Recovery (DBS)
Specific permissions are required to create the service-linked role for Data Disaster Recovery (DBS).
If your RAM user does not have sufficient permissions, you must add the following permissions to the RAM user. For more information about how to add and grant permissions, see Create a custom permission policy and Manage RAM user permissions.
Example policy: Allow the creation of a service-linked role for Data Disaster Recovery (DBS).
For AliyunServiceRoleForDBS:
{
"Action": "ram:CreateServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "dbs.aliyuncs.com"
}
}
}Create a service-linked role
Data Management (DMS)
AliyunServiceRoleForDMS: If your RAM user has the required permissions, log on to the DMS console. When the DMS Service-linked Role dialog box appears, click OK. The system creates AliyunServiceRoleForDMS automatically. For details, see the Create a service-linked role section in the "Service-linked roles" topic.
Data Disaster Recovery (DBS)
AliyunServiceRoleForDBS: The system creates this role automatically the first time you use Data Disaster Recovery. No manual steps are required.
View a service-linked role
Data Management (DMS)
After a service-linked role is created, you can view its Alibaba Cloud Resource Name (ARN), trust policy, and permission policy in the RAM console. The steps below apply to both roles — substitute the role name and policy name where indicated.
-
Log on to the RAM console.
-
In the left-side navigation pane, choose Identities > Roles.
-
On the Roles page, search for the role name (AliyunServiceRoleForDMS or AliyunServiceRoleForDBS) and click its name.
-
On the role details page, find the following information:
-
Basic Information — shows the role name, creation time, and ARN.
-
Trust Policy tab — shows the
Servicefield, which identifies the cloud service that can assume the role. For example:"Service": ["dms.aliyuncs.com"]. -
Permissions tab — lists the attached policies. Click the policy name (AliyunServiceRolePolicyForDMS or AliyunServiceRolePolicyForDBS) and then open the Policy Document tab to view the full policy content.
-
Service-linked role permissions are not visible on the Policies page of the RAM console. Access them through the role details page as described above.
Data Disaster Recovery (DBS)
After the service-linked role for Data Disaster Recovery (DBS) (AliyunServiceRoleForDBS) is created, you can view the role in the RAM console. In the console, you can view the basic information, trust policy, and access policy (AliyunServiceRolePolicyForDBS) of the role.
Delete a service-linked role
Data Management (DMS)
AliyunServiceRoleForDMS: Remove all instances from the instance list in the DMS console before deleting this role. This is required to prevent DMS from losing access to resources it is still managing. For instructions, see Remove one or more instances and Delete a service-linked role.
Data Disaster Recovery (DBS)
AliyunServiceRoleForDBS: Delete the role manually in the RAM console. For instructions, see Delete a RAM role.