Data Transmission Service:Configure RAM authorization for cross-account DTS tasks

Step 1: Create a RAM role

1. Log in to the RAM console using Account A.

2. In the left navigation pane, choose Identities > Roles.

   Important

   Choose Identities > Roles, not Identities > Users. Using Users causes DTS to fail to access the database instance.

   

3. Click Create Role.

4. In the Create Role panel:

   1. For Principal Type, select Cloud Account.

   2. Set Principal Name to Other Account and enter Account B's ID.

   3. Click OK.

   4. Enter a name for the RAM role (for example, ram-for-dts) and click OK.

Step 2: Grant permissions to the RAM role

Step 3: Update the trust policy

The trust policy grants Account B permission to use this RAM role and allows DTS to assume it on Account B's behalf. The RAM field specifies who can assume the role; the Service field allows DTS to make requests using that account's identity. Both fields must contain Account B's ID.

When you configure the DTS task

When Account B creates the DTS task, set Replicate Data Across Alibaba Cloud Accounts to Yes for the source database. In the Source Database section, enter Account A's ID in the Alibaba Cloud Account field.

Step 1: Create a RAM role

1. Log in to the RAM console using Account B.

2. In the left navigation pane, choose Identities > Roles.

   Important

   Choose Identities > Roles, not Identities > Users. Using Users causes DTS to fail to access the database instance.

   

3. Click Create Role.

4. In the Create Role panel:

   1. For Principal Type, select Cloud Account.

   2. Set Principal Name to Other Account and enter Account A's ID.

   3. Click OK.

   4. Enter a name for the RAM role (for example, ram-for-dts) and click OK.

Step 2: Grant permissions to the RAM role

Step 3: Update the trust policy

Both fields in the policy must contain Account A's ID (the source database account, which creates the DTS task).

When you configure the DTS task

When Account A creates the DTS task, set Replicate Data Across Alibaba Cloud Accounts to Yes for the destination database. In the Destination Database section, enter Account B's ID in the Alibaba Cloud Account field.

Step 1: Account A configures RAM authorization

1. Create a RAM role.

   1. Log in to the RAM console using Account A.

   2. In the left navigation pane, choose Identities > Roles. > Important: Choose Identities > Roles, not Identities > Users. Using Users causes DTS to fail to access the database instance.

   3. Click Create Role.

   4. In the Create Role panel:

      1. For Principal Type, select Cloud Account.

      2. Set Principal Name to Other Account and enter Account C's ID.

      3. Click OK.

      4. Enter a name for the RAM role (for example, ram-for-dts) and click OK.

2. Grant permissions to the RAM role.

   From the page indicating the RAM role is created

   1. On the Permissions tab, click Precise Permission.

      

   2. In the Precise Permission panel, you can set Policy Type to System Policy.

      

   3. Enter AliyunDTSRolePolicy in the Policy Name text box.

   4. Click OK.

      Click the icon on the right side of the Permission tab to refresh the page. Verify that the precise authorization was successful.

   From the RAM role list

   1. Log in to the RAM console using Account A.

   2. In the left navigation pane, choose Identities > Roles. > Important: Choose Identities > Roles, not Identities > Users.

   3. Click the RAM role you created.

   4. On the Permissions tab, click Precise Permission.

   5. In the Precise Permission panel, set Policy Type to System Policy.

   6. In the Policy Name field, enter AliyunDTSRolePolicy.

   7. Click OK.

   8. Click the refresh icon to confirm the permission was added.

3. Update the trust policy. Both fields in the policy must contain Account C's ID (the DTS task creator).

   From the page indicating the permission is granted

   1. Click the Trust Policy tab.

      

   2. On the Trust Policy tab, click Edit Trust Policy.

   3. On the JSON tab, replace the contents of the policy editor with the following code.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   4. Replace the two <Alibaba Cloud account ID> placeholders with the ID of the Alibaba Cloud account that you will use to create the DTS task.

      Example (click to expand)

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::164682176356****:root"
                      ],
                      "Service": [
                          "164682176356****@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   5. Click OK to save the trust policy.

      If the "<Alibaba Cloud account ID>@dts.aliyuncs.com" in the `Service` section of the code automatically changes to "dts.aliyuncs.com" after you save the trust policy, this indicates that the <Alibaba Cloud account ID> is incorrect. You must enter the ID of the account used to create the DTS task, not the ID of the source database account.

   From the RAM role list

   1. Log in to the RAM console using Account A.

   2. In the left navigation pane, choose Identities > Roles. > Important: Choose Identities > Roles, not Identities > Users.

   3. Click the RAM role you created.

   4. Click the Trust Policy tab.

   5. Click Edit Trust Policy.

   6. On the JSON tab, replace the existing content with the following: ``json { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "RAM": [ "acs:ram::<Alibaba Cloud account ID>:root" ], "Service": [ "<Alibaba Cloud account ID>@dts.aliyuncs.com" ] } } ], "Version": "1" } ``

   7. Replace both <Alibaba Cloud account ID> placeholders with Account C's ID.

      Example (click to expand)

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   8. Click OK. > Note: If the Service value automatically changes to "dts.aliyuncs.com" after saving, the account ID is wrong. Correct the ID and save again.

Step 2: Account B configures RAM authorization

Repeat the same three-step process using Account B (destination database owner). The trust policy must also contain Account C's ID.

1. Create a RAM role.

   1. Log in to the RAM console using Account B.

   2. In the left navigation pane, choose Identities > Roles. > Important: Choose Identities > Roles, not Identities > Users. Using Users causes DTS to fail to access the database instance.

   3. Click Create Role.

   4. In the Create Role panel:

      1. For Principal Type, select Cloud Account.

      2. Set Principal Name to Other Account and enter Account C's ID.

      3. Click OK.

      4. Enter a name for the RAM role (for example, ram-for-dts) and click OK.

2. Grant permissions to the RAM role.

   From the page indicating the RAM role is created

   1. On the Permissions tab, click Precise Permission.

      

   2. In the Precise Permission panel, you can set Policy Type to System Policy.

      

   3. Enter AliyunDTSRolePolicy in the Policy Name text box.

   4. Click OK.

      Click the icon on the right side of the Permission tab to refresh the page. Verify that the precise authorization was successful.

   From the RAM role list

   1. Log in to the RAM console using Account B.

   2. In the left navigation pane, choose Identities > Roles. > Important: Choose Identities > Roles, not Identities > Users.

   3. Click the RAM role you created.

   4. On the Permissions tab, click Precise Permission.

   5. In the Precise Permission panel, set Policy Type to System Policy.

   6. In the Policy Name field, enter AliyunDTSRolePolicy.

   7. Click OK.

   8. Click the refresh icon to confirm the permission was added.

3. Update the trust policy. Both fields in the policy must contain Account C's ID.

   From the page indicating the permission is granted

   1. Click the Trust Policy tab.

      

   2. On the Trust Policy tab, click Edit Trust Policy.

   3. On the JSON tab, replace the contents of the policy editor with the following code.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   4. Replace the two <Alibaba Cloud account ID> placeholders with the ID of the Alibaba Cloud account that you will use to create the DTS task.

      Example (click to expand)

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::164682176356****:root"
                      ],
                      "Service": [
                          "164682176356****@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   5. Click OK to save the trust policy.

      If the "<Alibaba Cloud account ID>@dts.aliyuncs.com" in the `Service` section of the code automatically changes to "dts.aliyuncs.com" after you save the trust policy, this indicates that the <Alibaba Cloud account ID> is incorrect. You must enter the ID of the account used to create the DTS task, not the ID of the destination database account.

   From the RAM role list

   1. Log in to the RAM console using Account B.

   2. In the left navigation pane, choose Identities > Roles. > Important: Choose Identities > Roles, not Identities > Users.

   3. Click the RAM role you created.

   4. Click the Trust Policy tab.

   5. Click Edit Trust Policy.

   6. On the JSON tab, replace the existing content with the following: ``json { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "RAM": [ "acs:ram::<Alibaba Cloud account ID>:root" ], "Service": [ "<Alibaba Cloud account ID>@dts.aliyuncs.com" ] } } ], "Version": "1" } ``

   7. Replace both <Alibaba Cloud account ID> placeholders with Account C's ID.

      Example (click to expand)

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   8. Click OK. > Note: If the Service value automatically changes to "dts.aliyuncs.com" after saving, the account ID is wrong. Correct the ID and save again.

When you configure the DTS task

When Account C creates the DTS task, set Replicate Data Across Alibaba Cloud Accounts to Yes for both the source and destination databases. In the Source Database section, enter Account A's ID in the Alibaba Cloud Account field. In the Destination Database section, enter Account B's ID in the Alibaba Cloud Account field.