Data Transmission Service:Fine-grained control with resource groups

Resource group authorization

You can use resource groups to organize and manage resources within your Alibaba Cloud account. For example, you can create a resource group for each project and add its resources to the group for centralized management. For more information, see What is a Resource Group.

After grouping your resources, you can grant permissions to RAM principals, such as RAM users, RAM user groups, or RAM roles, at the resource group level. This ensures a principal can manage only the resources within that resource group. For more information, see Resource grouping and authorization.

This authorization method offers the following advantages:

• Fine-grained permissions: Ensures each principal has only the resource access it requires. This helps separate the management of resources by project within a single account.

• Scalability: When you add new resources, you simply add them to the resource group. The RAM principal automatically gains the required permissions for these new resources, and no additional authorization is required.

Grant resource group-level permissions to a RAM user

This topic explains how to grant a RAM user permissions on DTS resources within a specific resource group.

Supported resource types

You can add the following DTS resource types to resource groups:

Actions without resource group authorization

The following table lists the Data Transmission Service (DTS) Actions that do not support resource group-level authorization.

For Actions that do not support resource group-level authorization, selecting resource group-level as the resource scope has no effect. To grant a RAM user or RAM role permissions for these Actions, create a custom permission policy and select account-level as the resource scope.

Here are two example custom permission policies. You can modify the policy content based on your requirements.

• This policy allows all read-only operations that do not support resource group-level authorization. The Action element lists these operations.

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "dts:CheckDefaultRole",
          "dts:DescribeBasicConfigs",
          "dts:DescribeCheckJobDiffDetails",
          "dts:DescribeCheckJobStatus",
          "dts:DescribeCheckJobs",
          "dts:DescribeClusterNodeInfo",
          "dts:DescribeConnectionStatus",
          "dts:DescribeDTSIP",
          "dts:DescribeDnsResolveResult",
          "dts:DescribeDocParserJobResult",
          "dts:DescribeDocParserJobStatus",
          "dts:DescribeDomainRegions",
          "dts:DescribeDtsJob",
          "dts:DescribeDtsJobsTransmission",
          "dts:DescribeEventMetaInfo",
          "dts:DescribeGadInstanceDetail",
          "dts:DescribeGadInstanceDtsMembers",
          "dts:DescribeGadInstances",
          "dts:DescribeHistoryEvents",
          "dts:DescribeHistoryEventsStat",
          "dts:DescribeInstanceInventory",
          "dts:DescribeJobStepDetail",
          "dts:DescribeMigrationJobs",
          "dts:DescribeNetWorkNisAnalysis",
          "dts:DescribePreCheckCreateGadOrderResult",
          "dts:DescribeRAGDocumentParseResult",
          "dts:DescribeRAGFlowAvailableZones",
          "dts:DescribeRAGFlowInstancePrice",
          "dts:DescribeRdsInfo",
          "dts:DescribeSubscriptionInstances",
          "dts:DescribeSynchronizationJobStatusList",
          "dts:DescribeSynchronizationObjectModifyStatus",
          "dts:DescribeTagKeys",
          "dts:DescribeTagValues",
          "dts:DescribeUserEventConfig",
          "dts:DescribeWorkflowJobResult",
          "dts:DescribeZeroETLInstanceLimitation",
          "dts:ListRAGDocument",
          "dts:ListRAGKnowledgeBase"
        ],
        "Resource": "*"
      }
    ]
  }
  

• This policy allows all operations that do not support resource group-level authorization. The Action element lists these operations.

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "dts:AddTags",
          "dts:AllocateRAGFlowInstancePublicConnection",
          "dts:AuthorizeScaleOut",
          "dts:CheckDefaultEventRule",
          "dts:CheckDefaultRole",
          "dts:ConfigureSynchronizationJobReplicatorCompare",
          "dts:ConfigureZeroETLJob",
          "dts:CountJobByCondition",
          "dts:CreateDedicatedClusterMonitorRule",
          "dts:CreateDocParserJob",
          "dts:CreateGadInstance",
          "dts:CreateRAGFlowInstance",
          "dts:CreateRAGKnowledgeBase",
          "dts:CreateServiceLinkedRoleForZeroETL",
          "dts:CreateZeroETLInstance",
          "dts:DeleteGadInstance",
          "dts:DeleteNetWorkPath",
          "dts:DescribeBasicConfigs",
          "dts:DescribeCheckJobDiffDetails",
          "dts:DescribeCheckJobStatus",
          "dts:DescribeCheckJobs",
          "dts:DescribeClusterNodeInfo",
          "dts:DescribeConnectionStatus",
          "dts:DescribeDTSIP",
          "dts:DescribeDnsResolveResult",
          "dts:DescribeDocParserJobResult",
          "dts:DescribeDocParserJobStatus",
          "dts:DescribeDomainRegions",
          "dts:DescribeDtsJob",
          "dts:DescribeDtsJobsTransmission",
          "dts:DescribeEventMetaInfo",
          "dts:DescribeGadInstanceDetail",
          "dts:DescribeGadInstanceDtsMembers",
          "dts:DescribeGadInstances",
          "dts:DescribeHistoryEvents",
          "dts:DescribeHistoryEventsStat",
          "dts:DescribeInstanceInventory",
          "dts:DescribeJobStepDetail",
          "dts:DescribeMigrationJobs",
          "dts:DescribeNetWorkNisAnalysis",
          "dts:DescribePreCheckCreateGadOrderResult",
          "dts:DescribeRAGDocumentParseResult",
          "dts:DescribeRAGFlowAvailableZones",
          "dts:DescribeRAGFlowInstancePrice",
          "dts:DescribeRdsInfo",
          "dts:DescribeSubscriptionInstances",
          "dts:DescribeSynchronizationJobStatusList",
          "dts:DescribeSynchronizationObjectModifyStatus",
          "dts:DescribeTagKeys",
          "dts:DescribeTagValues",
          "dts:DescribeUserEventConfig",
          "dts:DescribeWorkflowJobResult",
          "dts:DescribeZeroETLInstanceLimitation",
          "dts:DetachGadInstanceDbMember",
          "dts:DisableRAGFlowInstanceSSO",
          "dts:EnableRAGFlowInstanceSSO",
          "dts:Feedback",
          "dts:GenerateChatCompletion",
          "dts:GetAnswer",
          "dts:GetLindormInstanceInner",
          "dts:GetSimilarQuestions",
          "dts:InitDtsRdsInstance",
          "dts:ListRAGDocument",
          "dts:ListRAGKnowledgeBase",
          "dts:LoginRAGFlowInstance",
          "dts:ModifyConsumerGroupPassword",
          "dts:ModifyDtsJobDedicatedCluster",
          "dts:ModifyEventScheduleTime",
          "dts:ModifyGadInstanceName",
          "dts:ModifyRAGFlowInstanceDescription",
          "dts:ModifyRAGFlowInstanceSSO",
          "dts:ModifyRAGFlowSecurityIps",
          "dts:PreCheckCreateGadOrder",
          "dts:PreviewData",
          "dts:PreviewSql",
          "dts:PromoteToMaster",
          "dts:RemoveTags",
          "dts:SaveEtlJob",
          "dts:StartReverseWriter",
          "dts:SubmitDocParserJob",
          "dts:TagResources",
          "dts:UntagResources",
          "dts:UploadRAGDocument"
        ],
        "Resource": "*"
      }
    ]
  }
  

FAQ