This topic describes how to configure Resource Access Management (RAM) authorization for data migration or synchronization from a self-managed database in a virtual private cloud (VPC) across different Alibaba Cloud accounts. After authorization, Data Transmission Service (DTS) can read data from a VPC that belongs to another Alibaba Cloud account when you configure data migration or synchronization. You can migrate or synchronize data from a self-managed database that is connected over Express Connect across different Alibaba Cloud accounts.

Prerequisites

The RAM role of DTS is authorized by the Alibaba Cloud account to which the Express Connect circuit belongs to access the cloud resources of the account. For more information, see Authorize DTS to access Alibaba Cloud resources.

Background information

An on-premises database or a database hosted on a third-party cloud is connected to Alibaba Cloud VPC over Express Connect, VPN Gateway, or Smart Access Gateway. You need to migrate data from the on-premises database or the database hosted on the third-party cloud to an ApsaraDB RDS instance across different Alibaba Cloud accounts. The following figure shows the architecture for this scenario.

Important Before you can use DTS to migrate or synchronize data from a self-managed database in a VPC across different Alibaba Cloud accounts, you must perform the following steps: Configure RAM authorization for the Alibaba Cloud account to which the Express Connect circuit belongs (Account A), specify the Alibaba Cloud account to which the destination instance belongs (Account B) as a trusted account, and then authorize Account B to access the cloud resources of Account A.
Scenario architecture

Step 1: Create a RAM role and grant the default permission on DTS to the role

  1. Log on to the RAM console by using the Alibaba Cloud account to which the Express Connect circuit belongs.
  2. In the left-side navigation pane, choose Identities > Roles.
  3. On the Roles page, click Create Role.
  4. In the Create Role panel, select Alibaba Cloud Account for the Select Trusted Entity parameter and click Next.
  5. Configure parameters for the RAM role.
    1. Specify RAM Role Name.
    2. Optional:Specify Note.
    3. Select Current Alibaba Cloud Account or Other Alibaba Cloud Account.
      • Current Alibaba Cloud Account: If you want a RAM user that belongs to your Alibaba Cloud account to assume the RAM role, select Current Alibaba Cloud Account.
      • Other Alibaba Cloud Account: If you want a RAM user that belongs to a different Alibaba Cloud account to assume the RAM role, select Other Alibaba Cloud Account and enter the ID of the Alibaba Cloud account. This option is provided to authorize different Alibaba Cloud accounts.
        Note You can view the ID of an Alibaba Cloud account on the Security Settings page.
  6. Click OK.
  7. On the Roles page, find the RAM role to which you want to grant permissions and click Input and Attach in the Actions column.
  8. In the Add Permissions panel, select System Policy and enter AliyunDTSRolePolicy in the Policy Name field.
  9. Click OK.
  10. Click Close.

Step 2: Authorize the RAM role to access the VPC within another Alibaba Cloud account

  1. Log on to the RAM console by using the Alibaba Cloud account to which the Express Connect circuit belongs.
  2. In the left-side navigation pane, choose Identities > Roles.
  3. Find the RAM role created in Step 1 and click the role name.
  4. On the Permissions tab of the page that appears, click Grant Permission.
  5. In the Grant Permission panel, attach the AliyunVPCReadOnlyAccess policy to the RAM role.
    1. Set the authorization scope.
      • Alibaba Cloud Account: The permissions take effect on the current Alibaba Cloud account.
      • Specific Resource Group: The permissions take effect in a specific resource group.
        Note If you select Specific Resource Group for Authorized Scope, make sure that the required cloud service supports resource groups. For more information, see Services that work with Resource Group.
    2. Specify the principal.
      The principal is the RAM role to which permissions are granted. By default, the current RAM role is specified. You can also specify a different RAM role.
    3. Select policies.

      Enter AliyunVPCReadOnlyAccess in the search box and click the policy name to add the policy to the Selected section.

      Note You can attach a maximum of five policies to a RAM role at a time. If you need to attach more than five policies to a RAM role, perform the operation multiple times.
  6. Click OK.
  7. Click Complete.
  8. On the Basic Information page of the RAM role, click the Trust Policy Management tab.
  9. Click Edit Trust Policy, and replace the policy content with the following sample statements.
    {
        "Statement": [
            {
                "Action": "sts:AssumeRole",
                "Effect": "Allow",
                "Principal": {
                    "RAM": [
                        "acs:ram::<ID of the Alibaba Cloud account to which the destination instance belongs>:root"
                    ],
                    "Service": [
                        "<ID of the Alibaba Cloud account to which the destination instance belongs>@dts.aliyuncs.com"
                    ]
                }
            }
        ],
        "Version": "1"
    }
    Note To obtain the ID of the Alibaba Cloud account to which the destination instance belongs, you must log on to the Account Management console by using this account. The account ID is displayed on the Security Settings page. Then, you must replace the <ID of the Alibaba Cloud account to which the destination instance belongs> in the preceding statements with the obtained account ID.
  10. Click OK.

Configurations for data synchronization or migration across different Alibaba Cloud accounts

Synchronize or migrate data across Alibaba Cloud accounts