Data Management:Use DMS across Alibaba Cloud accounts

Assume that Alibaba Cloud account A wants to register a resource from Alibaba Cloud account B into account A's DMS tenant. A RAM user under account B must perform the following steps in the RAM console:

1. Log on to the RAM console by using a RAM user under the resource owner's Alibaba Cloud account B that has the AliyunRAMFullAccess permission.

2. On the Roles page, create a RAM role and configure a trust policy for account A. Use either of the following methods:

   Method 1: Visual editor

   1. On the Create Role page, click Switch to Policy Editor.

      For Select Trusted Entity, select Alibaba Cloud Account. The Switch to Policy Editor button is on the right side of the prompt at the bottom of the page.

   2. On the Visual Editor tab, set Principal to Cloud Service. Configure the following parameters:

      • In the text box under Other Account, enter the UID of Account A.

      • For Cloud Service, select Data Management/DMSEnterprise.

   3. Click OK.

   Method 2: Script editor

   1. On the Create Role page, click Switch to Policy Editor.

   2. On the Script Editor tab, enter the following policy.

      This trust policy allows the specified user to manage resources for cross-account instance registration.

      {
        "Statement": [
          {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "Service": [
                "<UID of Alibaba Cloud account A>@dms.aliyuncs.com"
              ]
            }
          }
        ],
        "Version": "1"
      }

   3. Click OK.

3. On the Policies page, create a custom policy. For example, name the policy DmsCrossAccountPolicy.

   The following database types and access methods (VPC) are supported in the permission policy: Tair (Redis OSS-compatible), PolarDB-X, OceanBase, ApsaraDB for Lindorm, Hologres, GDB, SelectDB, and ClickHouse Enterprise Edition.

   Note

   For RDS, PolarDB for MySQL, PolarDB for PostgreSQL, and PolarDB for PostgreSQL(Compatible with Oracle), skip Steps 3 and 4 and go to Step 5.

   Click here to view the permission policies for each database type.

   Redis

   {
     "Statement": [
       {
         "Action": [
           "kvstore:DescribeSecurityIps",
           "kvstore:ModifySecurityIps",
           "kvstore:DescribeRegions",
           "kvstore:DescribeInstances",
           "kvstore:DescribeInstanceAttribute",
           "kvstore:DescribeInstanceConfig"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   PolarDB-X 1.0

   {
     "Statement": [
       {
         "Action": [
           "drds:DescribeDrdsInstances",
           "drds:QueryInstanceInfoByConn",
           "drds:DescribeDrdsInstanceList",
           "drds:DescribeDrdsDBIpWhiteList",
           "drds:ModifyDrdsIpWhiteList",
           "drds:DescribeDrdsInstanceVersion"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   PolarDB-X 2.0

   {
     "Statement": [
       {
         "Action": [
           "polardbx:DescribeDBInstances",
           "polardbx:DescribeSecurityIps",
           "polardbx:ModifySecurityIps",
           "polardbx:DescribeDBInstanceAttribute",
           "polardbx:DescribeDBInstanceViaEndpoint"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   OceanBase

   {
     "Statement": [
       {
         "Action": [
           "oceanbase:DescribeAllTenantsConnectionInfo",
           "oceanbase:DescribeInstances"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   ApsaraDB for Lindorm

   {
     "Statement": [
       {
         "Action": [
           "lindorm:GetLindormInstanceList",
           "lindorm:GetLindormInstance",
           "lindorm:GetLindormInstanceListForDMS",
           "lindorm:GetLindormInstanceForDMS",
           "lindorm:GetLindormInstanceForDMSByConnStr",
           "lindorm:GetInstanceIpWhiteList",
           "lindorm:UpdateInstanceIpWhiteList"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   Hologres

   {
     "Statement": [
       {
         "Action": [
           "hologram:GetInstance",
           "hologram:ListInstances"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   GDB

   {
     "Statement": [
       {
         "Action": [
           "gdb:DescribeDbInstances"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   SelectDB

   {
     "Statement": [
       {
         "Action": [
           "selectdb:DescribeDBInstances",
           "selectdb:DescribeDBInstanceAttribute",
           "selectdb:DescribeDBInstanceNetInfo",
           "selectdb:DescribeSecurityIPList",
           "selectdb:ModifySecurityIPList"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   ClickHouse Enterprise Edition

   {
     "Statement": [
       {
         "Action": [
           "clickhouse:DescribeDBClusters",
           "clickhouse:DescribeDBInstances",
           "clickhouse:DescribeDBInstanceAttribute",
           "clickhouse:DescribeEndpoints",
           "clickhouse:DescribeSecurityIPList",
           "clickhouse:ModifySecurityIPList"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   The following example policy allows database registration through a VPC.

   {
     "Statement": [
       {
         "Action": [
           "vpc:DescribeVpcs"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

4. On the Roles page, attach the DmsCrossAccountPolicy policy to the role created in Step 2. For more information, see Manage permissions for a RAM role.

5. On the Roles page, click the role name and copy the ARN from the role details page.

Register the instance

When user A registers a database, enter the role ARN.

In the Register Database dialog box, in the Basic Information section, set Database Type to MySQL and configure Instance Region. In the Cross-account ARN field, enter the ARN copied in Step 4.