This topic describes the use scenarios of the Data Management (DMS) and Data Disaster Recovery service-linked roles (AliyunServiceRoleForDMS and AliyunServiceRoleForDBS). This topic also describes how to delete a service-linked role.
Background information
A service-linked role is a Resource Access Management (RAM) role. For more information, see RAM role overview. The service-linked role allows DMS to access other cloud services and implement specific features in some scenarios. For more information, see Service-linked roles.
Scenarios
DMS
You can assume the service-linked role of DMS to allow specific DMS features to access Elastic Compute Service (ECS) instances, virtual private clouds (VPC), ApsaraDB RDS instances, and resources related to various databases and tools.
Data Disaster Recovery
The AliyunServiceRoleForDBS role is a RAM role that allows Data Disaster Recovery to access other cloud services. Before Data Disaster Recovery can access Alibaba Cloud databases that you purchase, such as ApsaraDB RDS instances, ApsaraDB for MongoDB instances, Tair (Redis OSS-compatible) instances, and PolarDB databases, or self-managed databases hosted on ECS instances, the AliyunServiceRoleForDBS role must be assigned to Data Disaster Recovery. For more information, see Service-linked roles.
Service-linked role
AliyunServiceRoleForDMS
Role name: AliyunServiceRoleForDMS.
Policy name: AliyunServiceRolePolicyForDMS.
Permission description: The service-linked role allows DMS to access ECS instances, VPCs, ApsaraDB RDS instances, and resources related to various databases and tools.
Operations that can be performed:
Query the details of ApsaraDB RDS, PolarDB, Lindorm, and other database resources to manage Alibaba Cloud databases.
Query the details of ECS instances and VPCs to manage self-managed databases hosted on ECS instances and the Internet.
Use Alibaba Cloud services such as Data Transmission Service (DTS) and Data Disaster Recovery to manage data centrally.
AliyunServiceRoleForDBS
Role name: AliyunServiceRoleForDBS
Policy name: AliyunServiceRolePolicyForDBS
Permission description: The service-linked role allows Data Disaster Recovery to connect to Alibaba Cloud databases that you purchase, such as ApsaraDB RDS instances, ApsaraDB for MongoDB instances, Tair (Redis OSS-compatible) instances, and PolarDB databases, or self-managed databases hosted on ECS instances.
Permissions required to create a service-linked role
DMS
Your RAM user must be granted the required permissions before the AliyunServiceRoleForDMS role can be created for DMS.
If your RAM user does not have the required permissions, you must add the following policy and grant permissions to the RAM user. For more information, see Create custom policies and Grant permissions to a RAM user.
The following code shows the policy that allows authorized RAM users to create the AliyunServiceRoleForDMS role for DMS:
{
"Action":"ram:CreateServiceLinkedRole",
"Resource":"*",
"Effect":"Allow",
"Condition":{
"StringEquals":{
"ram:ServiceName": "dms.aliyuncs.com"
}
}
}Data Disaster Recovery
Your RAM user must be granted the required permissions before the AliyunServiceRoleForDBS role can be created for Data Disaster Recovery.
If your RAM user does not have the required permissions, you must add the following policy and grant permissions to the RAM user. For more information, see Create custom policies and Grant permissions to a RAM user.
The following code shows the policy that allows authorized RAM users to create the AliyunServiceRoleForDBS role for Data Disaster Recovery:
{
"Action":"ram:CreateServiceLinkedRole",
"Resource":"*",
"Effect":"Allow",
"Condition":{
"StringEquals":{
"ram:ServiceName": "dms.aliyuncs.com"
}
}
}Create a service-linked role
DMS
If your RAM user already has the required permissions to create the AliyunServiceRoleForDMS role for DMS, you can log on to the DMS console and click OK in the DMS Service-linked Role dialog box. This way, the system can automatically create the AliyunServiceRoleForDMS role for DMS. For more information, see the Create a service-linked role section of the "Service-linked roles" topic.
Data Disaster Recovery
When you use Data Disaster Recovery for the first time, the system automatically creates the AliyunServiceRoleForDBS role. Before you use Data Disaster Recovery, you must assign the AliyunServiceRoleForDBS role to Data Disaster Recovery to ensure that Data Disaster Recovery has the permissions to access your databases.
View the details of a service-linked role
DMS
After the AliyunServiceRoleForDMS role is created for DMS, you can view the role details in the RAM console, including the basic information, trust policy, and permission policy (AliyunServiceRolePolicyForDMS) of the role.
Data Disaster Recovery
After the AliyunServiceRoleForDBS role is created for Data Disaster Recovery, you can view the role details in the RAM console, including the basic information, trust policy, and permission policy of the role.
Delete a service-linked role
DMS
Before you delete the AliyunServiceRoleForDMS role, you must remove all instances from the instance list in the DMS console. For more information about how to remove an instance and delete a service-linked role, see Remove one or more instances and Delete a service-linked role.
Data Disaster Recovery
You can manually delete the AliyunServiceRoleForDBS role in the RAM console. For more information, see Delete a RAM role.