Configure RAM authorization for cross-account VPC access - Data Transmission Service

After you configure RAM authorization, Data Transmission Service (DTS) can access a VPC in another Alibaba Cloud account during data migration or synchronization. This allows you to migrate or synchronize data from a self-managed database connected through Express Connect in another account to a cloud database in your account.

Prerequisites

The DTS RAM role must be authorized to access the cloud resources of the Alibaba Cloud account that owns the Express Connect circuit. For more information, see Grant permissions to DTS to access cloud resources.
Log on to the Alibaba Cloud accounts that own the source and destination databases. Navigate to the Security Settings page and obtain the Account ID .

Background

If your on-premises IDC or third-party cloud is connected to Alibaba Cloud through Express Connect, VPN Gateway, or Smart Access Gateway, you can transfer a self-managed database over a VPC to a cloud database in another Alibaba Cloud account.

Important

Before you use DTS to transfer data from a self-managed database in a VPC across Alibaba Cloud accounts, you must configure RAM authorization. In the source account (which owns the Express Connect circuit), add the destination account (which owns the destination database) as a trusted entity and grant it permission to access the required cloud resources.

Usage notes

For cross-account scenarios, a self-managed database connected via VPC (with the Access Method set to Express Connect, VPN Gateway, or Smart Access Gateway) is supported only as a source database, not as a destination. For a list of supported databases, see Supported databases for cross-account access.

Step 1: Create a RAM role and grant it default DTS permissions

Log on to the RAM console by using the Alibaba Cloud account that owns the Express Connect circuit and the source database (the source account).
Important
If you perform this step as a RAM user, you may encounter an authorization error when you create the DTS task.
In the left-side navigation pane, choose Identities > Role.
Important
Do not choose Identities > Users. Otherwise, DTS cannot access the database instance and an error occurs.
error occurs.
On the Roles page, click Create Role.
In the Create Role panel, configure the RAM role.
1. For Principal Type, select Cloud Account.
2. For Principal Name, select Other Account, and then enter the ID of the Alibaba Cloud root account that owns the source database.
3. At the bottom of the page, click OK.
4. In the Create Role panel, enter a name for the RAM role and click OK.
  In this example, enter ram-for-dts.
On the Permissions tab, click Grant Permission.
g">Permissions tab, click Grant Permission.
In the Grant Permission panel, grant permissions to the RAM role.
1. For Policy Type, select System Policy.
2. In the Policy Name field, enter AliyunDTSRolePolicy.
  /b> field, enter AliyunDTSRolePolicy.
3. Click OK.
  You can click the refresh icon on the right side of the Permissions tab to confirm that the permission has been granted.
  side of the Permissions tab to confirm that the permission has been granted.

Step 2: Authorize the RAM role to access the VPC

Log on to the RAM console by using the Alibaba Cloud account that owns the Express Connect circuit and the source database (the source account).
Important
If you perform this step as a RAM user, you may encounter an authorization error when you create the DTS task.
In the left-side navigation pane, choose Identities > Role.
Important
Do not choose Identities > Users. Otherwise, DTS cannot access the database instance and an error occurs.
error occurs.
Find the RAM role that you created in Step 1 and click the role name.
Grant additional permissions to the RAM role.
1. On the Permissions tab, click Grant Permission.
2. In the Grant Permission panel, configure the authorization settings.
  1. Select the authorization scope.
    This example selects Alibaba Cloud Account. For more information, see Manage the permissions of a RAM role.
  2. From the Select Policy drop-down list, select System Policy.
    b> drop-down list, select System Policy.
  3. Select a policy.
    In the search box, enter AliyunVPCReadOnlyAccess, find the policy, and click it to add it to the Selected section.
  4. Click OK. You can then click the refresh icon on the right side of the Permissions tab to verify that the permission is granted.
3. After the permission is granted, click Close.
Modify the trust policy of the RAM role.
1. Click the Trust Policy tab.
  Click Edit Trust Policy.
  >
  Click Edit Trust Policy.
2. On the Trust Policy tab, click Edit Trust Policy.
  >Trust Policy tab, click Edit Trust Policy.
3. On the JSON tab, replace the existing code in the policy editor with the following code.
```
{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "RAM": [
                    "acs:ram::<Alibaba Cloud account ID>:root"
                ],
                "Service": [
                    "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                ]
            }
        }
    ],
    "Version": "1"
}
```
  /div>
4. Replace both <Alibaba Cloud account ID> placeholders with the ID of the Alibaba Cloud account (main account) that owns the destination database.
5. Click OK to save the trust policy.<Alibaba Cloud account ID>@dts.aliyuncs.com" to "dts.aliyuncs.com", it indicates that the specified <Alibaba Cloud account ID> is incorrect. Make sure that you provide the ID of the Alibaba Cloud account that owns the destination database, not the source database.is incorrect. Make sure that you provide the ID of the Alibaba Cloud account that owns the destination database, not the source database.is incorrect. Make sure that you provide the ID of the Alibaba Cloud account that owns the destination database, not the source database.is incorrect. Make sure that you provide the ID of the Alibaba Cloud account that owns the destination database, not the source database.
  If, after you save the trust policy, the Service section of the code automatically changes from "<Alibaba Cloud account ID>@dts.aliyuncs.com" to "dts.aliyuncs.com", the <Alibaba Cloud account ID> is incorrectly configured. You need to enter the Alibaba Cloud account ID of the destination database, but you entered the Alibaba Cloud account ID of the source database.
  Note
  For more information about which Alibaba Cloud account to use for signing in and which account ID to specify in the trust policy, see Account information.-node="17089" baseurl="t17089_v1_14_13.xdita" data-tag="xref" id="40bb40df41xbf" href="#ae3f1fb80bnxf">Account information.-node="17089" baseurl="t17089_v1_14_13.xdita" data-tag="xref" id="40bb40df41xbf" href="#ae3f1fb80bnxf">Account information.-node="17089" baseurl="t17089_v1_14_13.xdita" data-tag="xref" id="40bb40df41xbf" href="#ae3f1fb80bnxf">Account information.

Step 3: Configure the DTS task

Note

The following example uses a data synchronization task to show how to configure a cross-account DTS task.

Using the Alibaba Cloud account that owns the destination database, log on and navigate to the Configurations for Source and Destination Databases page.
1. Go to the data synchronization task list page in the destination region. You can do this in one of two ways.
  DTS console
  Log on to the DTS console.
  In the navigation pane on the left, click Data Synchronization.
  In the upper-left corner of the page, select the region where the synchronization instance is located.
  DMS console
  Note
  The actual steps may vary depending on the mode and layout of the DMS console. For more information, see Simple mode console and Customize DMS console layout and style.
  Log on to the DMS console.
  In the top menu bar, choose Data + AI > DTS (DTS) > Data Synchronization.
  To the right of Data Synchronization Tasks, select the region of the synchronization instance.
2. Click Create Task to open the task configuration page.

Configure the source database information.

The following table describes the key parameters.

Parameter	Description
Select Existing Connection	This parameter is not required for this example.
Database Type	Select the type of your database.
Access Method	Select Express Connect, VPN Gateway, or Smart Access Gateway.
Instance Region	Select the region where your instance is located.
Replicate Data Across Alibaba Cloud Accounts	Select Yes.
Alibaba Cloud Account	Enter the Account ID of the source Alibaba Cloud account.
RAM Role Name	Enter the name of the RAM role that you created in the source Alibaba Cloud account in Step 1.
Connected VPC	Select the VPC that is connected to your source database. Note If an error occurs, see Common errors for solutions.

Complete the remaining configurations as needed, following the on-screen instructions.