Data Transmission Service:Custom policies for DTS

Prerequisites

Before you begin, ensure that you have:

• Authorized the RAM user to access the cloud resources used by DTS, such as ApsaraDB for RDS instances and Elastic Compute Service (ECS) instances. This allows DTS to read the relevant resource information when the RAM user configures a DTS task. For details, see Authorize DTS to access Alibaba Cloud resources.

Usage notes

• To synchronize data to a MaxCompute project, configure the task using an Alibaba Cloud account instead of a RAM user.

• If the database connects over Database Gateway, grant the RAM user the AliyunDGFullAccess permission.

• If the database connects over Cloud Enterprise Network (CEN), grant the RAM user the AliyunCENFullAccess permission.

Step 1: Create a custom policy

1. Log on to the RAM console as a RAM user with administrative rights.

2. In the left-side navigation pane, choose Permissions > Policies.

3. On the Policies page, click Create Policy.

4. On the Create Policy page, click the JSON tab.

5. In the code editor, enter your policy content. Keep the following in mind: The following examples cover common scenarios. Choose the one that matches your use case, or combine actions from multiple examples. Example 1: Read-only access to a single DTS instance Use this when you want a RAM user to view task details and configurations but not make any changes.

   • Replace the DTS instance ID placeholder with the actual ID of your DTS instance.

   • Read-only permissions let a RAM user query task details and configurations, but not modify them. Read and write permissions let a RAM user configure and manage the DTS instance.

   • The policy must include the DescribeBasicConfigs and DescribeDomainRegions actions.

   Example 1

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "dts:Describe*",
               "Resource": "acs:dts:*:*:instance/DTS instance ID"
           }
       ],
       "Version": "1"
   }

   Example 2

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "dts:*",
               "Resource": [
                   "acs:dts:*:*:instance/DTS instance ID",
                   "acs:dts:*:*:instance/DTS instance ID"
               ]
           }
       ],
       "Version": "1"
   }

   Example 3

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "dts:DescribeSynchronizationJobStatus",
                   "dts:DescribeSynchronizationJobs"
               ],
               "Resource": "acs:dts:*:*:instance/DTS instance ID"
           }
       ],
       "Version": "1"
   }

   Example 4

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "dts:DescribeSubscriptionInstances",
                   "dts:StartSynchronizationJob",
                   "dts:SuspendSynchronizationJob"
               ],
               "Resource": [
                   "acs:dts:*:*:instance/DTS instance ID",
                   "acs:dts:*:*:instance/DTS instance ID",
                   "acs:dts:*:*:instance/DTS instance ID"
               ]
           }
       ],
       "Version": "1"
   }

   Example 2: Full access to multiple DTS instances Use this when a RAM user needs to configure and manage multiple specific instances. List each instance ID as a separate resource.

   Example 3: View configurations of a data synchronization task Use this when you want a RAM user to check the status and configuration of a synchronization task, without any write access.

   Example 4: Start or pause multiple data synchronization tasks Use this when you want a RAM user to control task execution across multiple instances — start or pause tasks — without access to configuration settings.

6. Click OK.

7. Fill in the Name and Description fields.

8. Review and optimize the policy content.

   • Basic optimization (automatic): The system removes unnecessary conditions and arrays.

   • Advanced optimization (optional): Move the pointer over Optional: advanced optimize and click Perform. The system splits resources or conditions that are incompatible with actions, narrows down resources, and deduplicates or merges policy statements.

9. Click OK.

Step 2: Attach the custom policy to a RAM user

1. Log on to the RAM console as a RAM user with administrative rights.

2. Create a RAM user.

3. In the left-side navigation pane, choose Identities > Users.

4. On the Users page, find the RAM user in the User Logon Name/Display Name column.

5. Click Add Permissions in the Actions column.

6. In the Grant Permission panel, configure the following:

   1. Set the Resource Scope parameter: > Important: If you select ResourceGroup, make sure that the required cloud service supports resource groups. For details, see Services that work with Resource Group. For instructions on granting resource group permissions, see Use a resource group to grant a RAM user the permissions to manage a specific ECS instance.

      • Account: The permission applies to the current Alibaba Cloud account.

      • ResourceGroup: The permission applies to a specific resource group.

   2. In the Policy section, select Custom Policy from the drop-down list.

   3. Search for the policy you created in Step 1.

   4. Click the policy name to add it to the Selected Policy section.

7. Click Grant permissions.

8. Click Close.

Action-level authorization reference

Use this section to identify which API actions to include in a custom policy for a specific console operation.

The DescribeDTSIP, DescribeSubscriptionInstances, and DescribeSynchronizationJobs actions let RAM users query available DTS instances. If a RAM user has access only to specific instances, they must first query the available instances before performing related operations. To authorize a RAM user to configure a data migration, data synchronization, or change tracking task, create a custom policy and attach it. For details, see Authorize DTS to access Alibaba Cloud resources.

What to do next

Log on to the Alibaba Cloud Management Console by using a RAM user

FAQ

Why does the DTS console show an error instead of the instance list after I log on as a RAM user?

The RAM user likely has no permissions, or has permissions only on specific instances. When instance-level restrictions are in place, the DTS console cannot display the full instance list. Contact your RAM administrator to get the IDs of the DTS instances the RAM user can access, then search for those instances by ID in the DTS console.