Data Management:Collaborate on DMS across Alibaba Cloud accounts

Assume that Alibaba Cloud account A needs to register a resource from Alibaba Cloud account B in the DMS tenant of account A. A RAM user that belongs to account B must perform the following operations in the RAM console:

1. Log on to the RAM console as a RAM user that belongs to the resource owner's Alibaba Cloud account B. This user must have the AliyunRAMFullAccess permission.

2. On the Roles page, create a RAM role and set a trust policy for account A. You can use one of the following methods:

   Method 1: Visual editor

   1. On the Create Role page, click Switch to Policy Editor.

      

   2. On the Visual Editor tab, set Principal to Cloud Service and configure the following parameters:

      • Enter the UID of Alibaba Cloud account A in the Other Account text box.

      • Set the Cloud Service parameter to Data Management/DMS Enterprise.

        

   3. Click OK.

   Method 2: Script editor

   1. On the Create Role page, click Switch To Policy Editor.

      

   2. On the JSON tab, enter the policy.

      Policy description: This trust policy allows the specified user to register instances and manage resources across accounts.

      {
        "Statement": [
          {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "Service": [
                "<UID of Alibaba Cloud account A>@dms.aliyuncs.com"
              ]
            }
          }
        ],
        "Version": "1"
      }

   3. Click OK.

3. On the Policies page, create a permission policy, such as DmsCrossAccountPolicy.

   The access policy supports the following database types and connection types (VPC and leased line): Redis, PolarDB-X, OceanBase, Lindorm, Hologres, GDB, SelectDB, and ClickHouse Enterprise Edition.

   Note

   For RDS, PolarDB for MySQL, PolarDB for PostgreSQL, and PolarDB for PostgreSQL (Compatible with Oracle), you can skip Steps 3 and 4 and proceed directly to Step 5.

   Click to view the access policy for each database type.

   Redis

   {
     "Statement": [
       {
         "Action": [
           "kvstore:DescribeSecurityIps",
           "kvstore:ModifySecurityIps",
           "kvstore:DescribeRegions",
           "kvstore:DescribeInstances",
           "kvstore:DescribeInstanceAttribute",
           "kvstore:DescribeInstanceConfig"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   PolarDB-X 1.0

   {
     "Statement": [
       {
         "Action": [
           "drds:DescribeDrdsInstances",
           "drds:QueryInstanceInfoByConn",
           "drds:DescribeDrdsInstanceList",
           "drds:DescribeDrdsDBIpWhiteList",
           "drds:ModifyDrdsIpWhiteList",
           "drds:DescribeDrdsInstanceVersion"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   PolarDB-X 2.0

   {
     "Statement": [
       {
         "Action": [
           "polardbx:DescribeDBInstances",
           "polardbx:DescribeSecurityIps",
           "polardbx:ModifySecurityIps",
           "polardbx:DescribeDBInstanceAttribute",
           "polardbx:DescribeDBInstanceViaEndpoint"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   OceanBase

   {
     "Statement": [
       {
         "Action": [
           "oceanbase:DescribeAllTenantsConnectionInfo",
           "oceanbase:DescribeInstances"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   Lindorm

   {
     "Statement": [
       {
         "Action": [
           "lindorm:GetLindormInstanceList",
           "lindorm:GetLindormInstance",
           "lindorm:GetLindormInstanceListForDMS",
           "lindorm:GetLindormInstanceForDMS",
           "lindorm:GetLindormInstanceForDMSByConnStr",
           "lindorm:GetInstanceIpWhiteList",
           "lindorm:UpdateInstanceIpWhiteList"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   Hologres

   {
     "Statement": [
       {
         "Action": [
           "hologram:GetInstance",
           "hologram:ListInstances"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   GDB

   {
     "Statement": [
       {
         "Action": [
           "gdb:DescribeDbInstances"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   SelectDB

   {
     "Statement": [
       {
         "Action": [
           "selectdb:DescribeDBInstances",
           "selectdb:DescribeDBInstanceAttribute",
           "selectdb:DescribeDBInstanceNetInfo",
           "selectdb:DescribeSecurityIPList",
           "selectdb:ModifySecurityIPList"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   ClickHouse Enterprise Edition

   {
     "Statement": [
       {
         "Action": [
           "clickhouse:DescribeDBClusters",
           "clickhouse:DescribeDBInstances",
           "clickhouse:DescribeDBInstanceAttribute",
           "clickhouse:DescribeEndpoints",
           "clickhouse:DescribeSecurityIPList",
           "clickhouse:ModifySecurityIPList"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   Example policy description: This policy lets you register a database in DMS over a VPC or leased line.

   {
     "Statement": [
       {
         "Action": [
           "vpc:DescribeVpcs"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

4. On the Roles page, grant the DmsCrossAccountPolicy permission to the role that you created in Step 2. For more information, see Grant permissions to a RAM role.

5. On the Roles page, click the role name. On the resulting page, copy the ARN.

   

Register the instance

When user A registers a database, enter the role ARN.