Data Transmission Service:Configure RAM authorization for data transmission from a self-managed database in a VPC across Alibaba Cloud accounts

Usage notes

You can synchronize or migrate data from a self-managed database in a VPC over Express Connect, VPN Gateway, or Smart Access Gateway across Alibaba Cloud accounts when the self-managed database is used as the source database. If the self-managed database is used as the destination database, you cannot synchronize or migrate data to the self-managed database in the VPC across Alibaba Cloud accounts. For more information about supported databases, see the section Supported databases in the topic "Configure RAM authorization for cross-account DTS tasks".

Step 1: Create a RAM role and grant the default permission on DTS to the RAM role

1. Log on to the RAM console by using the Alibaba Cloud account to which the Express Connect circuit belongs.

   Important

   If you grant permissions to a RAM role as a RAM user, an error message that indicates invalid permissions may appear when you configure a DTS task.

2. In the left-side navigation pane, choose Identities > Roles.

   

   Important

   Do not choose Identities > Users, as this will prevent DTS from accessing the database instance, resulting in an error.

3. On the Roles page, click Create Role.

4. In the Create Role panel, perform the following steps.

   1. Select the Principal Type parameter to Cloud Account.

      

   2. Select the Principal Name parameter to Other Account, and enter the ID of the Alibaba Cloud account to which the source instances belong.

      

   3. Click OK.

   4. In the Create Role panel that appears, enter the role name, and click OK.

      In this example, ram-for-dts is specified.

      

5. On the Permissions tab, click Precise Permission.

   

6. In the Precise Permission panel, perform the following steps:

   1. Select the Policy Type parameter to System Policy.

      

   2. Enter a Policy Name. In this example, AliyunDTSRolePolicy is specified.

   3. Click OK.

      Click the icon in the right side of the Permissions tab to refresh the page. Check whether the required permissions are granted.

Step 2: Authorize the RAM role to access the VPC within another Alibaba Cloud account

1. Log on to the RAM console by using the Alibaba Cloud account to which the Express Connect circuit belongs.

   Important

   If you grant permissions to a RAM role as a RAM user, an error message that indicates invalid permissions may appear when you configure a DTS task.

2. In the left-side navigation pane, choose Identities > Roles.

   

   Important

   Do not choose Identities > Users, as this will prevent DTS from accessing the database instance, resulting in an error.

3. Find the RAM role that you created in Step 1 and click the role name.

4. Grant permissions to the RAM role.

   1. On the Permissions tab, click Grant Permission.

   2. In the Grant Permission panel, perform the following steps:

      1. Configure the Resource Scope parameter.

         In this example, Account is selected. For more information, see Grant permissions to a RAM role.

      2. In the Policy section, select System Policy from the drop-down list.

      3. Configure the Policy parameter.

         Enter AliyunVPCReadOnlyAccess in the search box and click the search icon. Select the policy name to add it to the Selected Policy section.

      4. Click Grant permissions.

   3. After you grant the permissions, click Close.

5. Modify the trust policy of the RAM role.

   1. Click the Trust Policy tab.

      

   2. Click Edit Trust Policy.

   3. Replace the policy text with the following sample code.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   4. Replace the two <Alibaba Cloud account ID> in the sample code with the ID of the Alibaba Cloud account to which the destination database belongs.

   5. Click OK.

      If the "<Alibaba Cloud account ID>@dts.aliyuncs.com" in the Service section of the preceding code is automatically changed to "dts.aliyuncs.com" after you save the trust policy, this indicates that the configuration of <Alibaba Cloud account ID> is invalid.

      Note

      For more information about the Alibaba Cloud account that is used to log on to the RAM console and the Alibaba Cloud account that is specified in the trust policy, see Account information of this topic.

Configure a DTS task

1. Access the Configurations for Source and Destination Databases page by using the Alibaba Cloud account to which the destination instance belongs.

   1. Use one of the following methods to go to the Data Synchronization page and select the region in which the data synchronization instance resides.

      DTS console

      1. Log on to the DTS console.

      2. In the left-side navigation pane, click Data Synchronization.

      3. In the upper-left corner of the page, select the region in which the data synchronization instance resides.

      DMS console

      Note

      The actual operations may vary based on the mode and layout of the DMS console. For more information, see Simple mode and Customize the layout and style of the DMS console.

      1. Log on to the DMS console.

      2. In the top navigation bar, move the pointer over Data + AI and choose DTS (DTS) > Data Synchronization.

      3. From the drop-down list to the right of Data Synchronization Tasks, select the region in which the data synchronization instance resides.

   2. Click Create Task to go to the task configuration page.

2. Configure a source database.

   The following table describes key parameters:

   Parameter	Description
   Select Existing Connection	This parameter is not set in this example.
   Database Type	You can select one based on your business requirements.
   Access Method	Select Express Connect, VPN Gateway, or Smart Access Gateway.
   Instance Region	You can select one based on your business requirements.
   Replicate Data Across Alibaba Cloud Accounts	Select Yes.
   Alibaba Cloud Account	Enter the Alibaba Cloud account that owns the source database.
   RAM Role Name	The name of the RAM role that is created by using the Alibaba Cloud account to which the source database belongs. In this example, enter the RAM role name created in Step 1.
   Connected VPC	You can select one based on your business requirements. Note If an error occurs when you set the Connected VPC parameter for the source database, see the section Common errors in the topic "Configure a DTS task across Alibaba Cloud accounts".

3. Refer to the related topics and configure other parameters based on your business requirements.