Data Transmission Service:Configure RAM authorization for cross-account DTS tasks

Step 1: Create a RAM role

1. Sign in to the RAM console with the Alibaba Cloud account (main account) that owns the source database.

   k"> with the Alibaba Cloud account (main account) that owns the source database.

2. In the left-side navigation pane, choose Identities > Role.

   Important

   Do not choose Identities > Users. Otherwise, DTS cannot access the database instance and an error occurs.

   error occurs.

3. On the Role page, click Create Role.

   id="uicontrol_znn_dnk_zbi">Create Role.

4. In the Create Role panel, configure the RAM role.

   1. For Principal Type, select Cloud Account.

   2. For Principal Name, select Other Account and enter the ID of the Alibaba Cloud account (main account) that owns the destination database.

   3. At the bottom of the page, click OK.

   4. In the Create Role panel, enter a name for the RAM role and click OK.

      In this example, enter ram-for-dts.

   g="uicontrol" id="a73e158de1l6x" conref="mcms_dita_dts_web.dita#dts_web/dts.common.ok">.

   In this example, enter ram-for-dts.

   on.ok">.

   In this example, enter ram-for-dts.

Step 2: Grant precise permissions

AliyunDTSRolePolicy cannot be found through the search feature of Add Permissions. In the Permissions tab, click Precise Permission. Enter AliyunDTSRolePolicy in the policy name text box, and then click OK to complete the authorization.

Step 3: Update the trust policy

Step 1: Create a RAM role

1. Sign in to the RAM console with the Alibaba Cloud root account that owns the destination database.

   "> with the Alibaba Cloud root account that owns the destination database.

2. In the left-side navigation pane, choose Identities > Role.

   Important

   Do not choose Identities > Users. Otherwise, DTS cannot access the database instance and an error occurs.

   error occurs.

3. On the Role page, click Create Role.

   id="uicontrol_znn_dnk_zbi">Create Role.

4. In the Create Role panel, configure the RAM role.

   1. For Principal Type, select Cloud Account.

   2. For Principal Name, select Other Account, and then enter the ID of the Alibaba Cloud root account that owns the source database.

   3. At the bottom of the page, click OK.

   4. In the Create Role panel, enter a name for the RAM role and click OK.

      In this example, enter ram-for-dts.

   d">Obtain the ID of the Alibaba Cloud root account that owns the source database.

Step 2: Grant permissions to the RAM role

Step 3: Update the trust policy

Step 1: Configure RAM for the source account

1. Create a RAM role.

   1. Sign in to the RAM console with the Alibaba Cloud account (main account) that owns the source database.

      k"> with the Alibaba Cloud account (main account) that owns the source database.

   2. In the left-side navigation pane, choose Identities > Role.

      Important

      Do not choose Identities > Users. Otherwise, DTS cannot access the database instance and an error occurs.

      error occurs.

   3. On the Role page, click Create Role.

      id="uicontrol_znn_dnk_zbi">Create Role.

   4. In the Create Role panel, configure the RAM role.

      1. For Principal Type, select Cloud Account.

      2. For Principal Name, select Other Account, and enter the ID of the designated root account for creating the DTS task.

      3. At the bottom of the page, click OK.

      4. In the Create Role panel, enter a name for the RAM role and click OK.

         In this example, enter ram-for-dts.

   >

2. Grant precise permissions to the RAM role.

   From the success page

   1. On the Permissions tab, click Grant Permission.

      g">Permissions tab, click Grant Permission.

   2. In the Grant Permission panel, set Policy Type to System Policy.

      ission panel, set Policy Type to System Policy.

   3. In the Policy Name field, enter AliyunDTSRolePolicy.

      /b> field, enter AliyunDTSRolePolicy.

   4. Click OK.

      You can click the refresh icon on the right side of the Permissions tab to confirm that the permission has been granted.

      side of the Permissions tab to confirm that the permission has been granted.

   From the role list

   1. Go to the details page of the RAM role.

      1. Sign in to the RAM console with the Alibaba Cloud account (main account) that owns the source database.

         k"> with the Alibaba Cloud account (main account) that owns the source database.

      2. In the left-side navigation pane, choose Identities > Role.

         Important

         Do not choose Identities > Users. Otherwise, DTS cannot access the database instance and an error occurs.

         error occurs.

      3. On the Role page, find and click the target RAM role.

      ind and click the target RAM role.d click the target RAM role.

   2. On the Permissions tab, click Grant Permission.

      g">Permissions tab, click Grant Permission.

   3. In the Grant Permission panel, set Policy Type to System Policy.

      ission panel, set Policy Type to System Policy.

   4. In the Policy Name field, enter AliyunDTSRolePolicy.

      /b> field, enter AliyunDTSRolePolicy.

   5. Click OK.

      You can click the refresh icon on the right side of the Permissions tab to confirm that the permission has been granted.

      side of the Permissions tab to confirm that the permission has been granted.

3. Modify the trust policy of the RAM role.

   From the Precise Permission success page

   1. Click the Trust Policy tab.

      Click Edit Trust Policy.

      >

      Click Edit Trust Policy.

   2. On the Trust Policy tab, click Edit Trust Policy.

      >Trust Policy tab, click Edit Trust Policy.

   3. On the JSON tab, replace the existing code in the policy editor with the following code.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

      /div>

   4. Replace the two <Alibaba Cloud account ID> placeholders in the code with the ID of the Alibaba Cloud account that is used to create the DTS task.

      Example (click to expand)

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::164682176356****:root"
                      ],
                      "Service": [
                          "164682176356****@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   5. Click OK, save the trust policy.

      If, after saving the trust policy, the "<Alibaba Cloud account ID>@dts.aliyuncs.com" part of the code changes to "dts.aliyuncs.com" automatically, this indicates that <Alibaba Cloud account ID>is configured incorrectly (it must be the Alibaba Cloud account ID that created the DTS task, but you configured the source database's account ID)。

      Note

      For the Alibaba Cloud account used to log on to the RAM console and replaced in the trust policy, see Accounts。

   From the RAM role list

   1. Go to the details page of the RAM role.

      1. Sign in to the RAM console with the Alibaba Cloud account (main account) that owns the source database.

         k"> with the Alibaba Cloud account (main account) that owns the source database.

      2. In the left-side navigation pane, choose Identities > Role.

         Important

         Do not choose Identities > Users. Otherwise, DTS cannot access the database instance and an error occurs.

         error occurs.

      3. On the Role page, find and click the target RAM role.

   2. Click the Trust Policy tab.

      Click Edit Trust Policy.

      >

      Click Edit Trust Policy.

   3. On the Trust Policy tab, click Edit Trust Policy.

      >Trust Policy tab, click Edit Trust Policy.

   4. On the JSON tab, replace the existing code in the policy editor with the following code.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

      /div>

   5. Replace the two <Alibaba Cloud account ID> placeholders in the code with the ID of the Alibaba Cloud account that is used to create the DTS task.

      Example (click to expand)

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::164682176356****:root"
                      ],
                      "Service": [
                          "164682176356****@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   6. Click OK, save the trust policy.

      If, after saving the trust policy, the "<Alibaba Cloud account ID>@dts.aliyuncs.com" part of the code changes to "dts.aliyuncs.com" automatically, this indicates that <Alibaba Cloud account ID>is configured incorrectly (it must be the Alibaba Cloud account ID that created the DTS task, but you configured the source database's account ID)。

      Note

      For the Alibaba Cloud account used to log on to the RAM console and replaced in the trust policy, see Accounts。

Step 2: Configure RAM authorization using the Alibaba Cloud account (primary account) of the destination database

1. Create a RAM role.

   1. Sign in to the RAM console with the Alibaba Cloud root account that owns the destination database.

      "> with the Alibaba Cloud root account that owns the destination database.

   2. In the left-side navigation pane, choose Identities > Role.

      Important

      Do not choose Identities > Users. Otherwise, DTS cannot access the database instance and an error occurs.

      error occurs.

   3. On the Role page, click Create Role.

      id="uicontrol_znn_dnk_zbi">Create Role.

   4. In the Create Role panel, configure the RAM role.

      1. For Principal Type, select Cloud Account.

      2. For Principal Name, select Other Account, and enter the ID of the designated root account for creating the DTS task.

      3. At the bottom of the page, click OK.

      4. In the Create Role panel, enter a name for the RAM role and click OK.

         In this example, enter ram-for-dts.

2. Grant precise permissions to the RAM role.

   From the success page

   1. On the Permissions tab, click Grant Permission.

      g">Permissions tab, click Grant Permission.

   2. In the Grant Permission panel, set Policy Type to System Policy.

      ission panel, set Policy Type to System Policy.

   3. In the Policy Name field, enter AliyunDTSRolePolicy.

      /b> field, enter AliyunDTSRolePolicy.

   4. Click OK.

      You can click the refresh icon on the right side of the Permissions tab to confirm that the permission has been granted.

      side of the Permissions tab to confirm that the permission has been granted.

   From the role list

   1. Go to the details page of the RAM role.

      1. Sign in to the RAM console with the Alibaba Cloud root account that owns the destination database.

         "> with the Alibaba Cloud root account that owns the destination database.

      2. In the left-side navigation pane, choose Identities > Role.

         Important

         Do not choose Identities > Users. Otherwise, DTS cannot access the database instance and an error occurs.

         error occurs.

      3. On the Role page, find and click the target RAM role.

      OPIC">

   2. On the Permissions tab, click Grant Permission.

      g">Permissions tab, click Grant Permission.

   3. In the Grant Permission panel, set Policy Type to System Policy.

      ission panel, set Policy Type to System Policy.

   4. In the Policy Name field, enter AliyunDTSRolePolicy.

      /b> field, enter AliyunDTSRolePolicy.

   5. Click OK.

      You can click the refresh icon on the right side of the Permissions tab to confirm that the permission has been granted.

      side of the Permissions tab to confirm that the permission has been granted.

3. Modify the trust policy of the RAM role.

   From the page that indicates the permission is granted

   1. Click the Trust Policy tab.

      Click Edit Trust Policy.

      >

      Click Edit Trust Policy.

   2. On the Trust Policy tab, click Edit Trust Policy.

      >Trust Policy tab, click Edit Trust Policy.

   3. On the JSON tab, replace the existing code in the policy editor with the following code.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

      /div>

   4. Replace the two <Alibaba Cloud account ID> placeholders in the code with the ID of the Alibaba Cloud account that is used to create the DTS task.

      Example (click to expand)

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::164682176356****:root"
                      ],
                      "Service": [
                          "164682176356****@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   5. Click OK, save the trust policy.

      If, after saving the trust policy, the "<Alibaba Cloud account ID>@dts.aliyuncs.com" part of the code changes to "dts.aliyuncs.com" automatically, this indicates that <Alibaba Cloud account ID>is configured incorrectly (it must be the Alibaba Cloud account ID that created the DTS task, but you configured the destination database's account ID)。

      Note

      For the Alibaba Cloud account used to log on to the RAM console and replaced in the trust policy, see Accounts。

   From the RAM role list

   1. Go to the details page of the RAM role.

      1. Sign in to the RAM console with the Alibaba Cloud root account that owns the destination database.

         "> with the Alibaba Cloud root account that owns the destination database.

      2. In the left-side navigation pane, choose Identities > Role.

         Important

         Do not choose Identities > Users. Otherwise, DTS cannot access the database instance and an error occurs.

         error occurs.

      3. On the Role page, find and click the target RAM role.

   2. Click the Trust Policy tab.

      Click Edit Trust Policy.

      >

      Click Edit Trust Policy.

   3. On the Trust Policy tab, click Edit Trust Policy.

      >Trust Policy tab, click Edit Trust Policy.

   4. On the JSON tab, replace the existing code in the policy editor with the following code.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

      /div>

   5. Replace the two <Alibaba Cloud account ID> placeholders in the code with the ID of the Alibaba Cloud account that is used to create the DTS task.

      Example (click to expand)

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::164682176356****:root"
                      ],
                      "Service": [
                          "164682176356****@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   6. Click OK, save the trust policy.

      If, after saving the trust policy, the "<Alibaba Cloud account ID>@dts.aliyuncs.com" part of the code changes to "dts.aliyuncs.com" automatically, this indicates that <Alibaba Cloud account ID>is configured incorrectly (it must be the Alibaba Cloud account ID that created the DTS task, but you configured the destination database's account ID)。

      Note

      For the Alibaba Cloud account used to log on to the RAM console and replaced in the trust policy, see Accounts。