Configure RAM authorization for cross-account VPC access - Data Transmission Service

After configuring RAM authorization as described in this topic, Data Transmission Service (DTS) can access a VPC in another Alibaba Cloud account when you configure a data migration or data synchronization task. This enables you to migrate or synchronize data from a self-managed database connected via Express Connect in another Alibaba Cloud account to a cloud database in your account.

Prerequisites

The DTS RAM role must be authorized to access the cloud resources of the Alibaba Cloud account that owns the Express Connect circuit. For more information, see Grant permissions to DTS to access cloud resources.
Log on to the Alibaba Cloud accounts that own the source and destination databases. Navigate to the Security Settings page and obtain the Account ID .

Background

An on-premises IDC or a third-party cloud has been connected to Alibaba Cloud by using Express Connect, VPN Gateway, or Smart Access Gateway. You now want to transfer a self-managed database in the on-premises IDC or third-party cloud over a VPC to a cloud database in another Alibaba Cloud account.

Important

Before you can use DTS to transfer data from a self-managed database in a VPC across Alibaba Cloud accounts, you must first configure RAM authorization. In the source account (which owns the Express Connect circuit), set the destination account (which owns the destination database) as a trusted entity and grant it permission to access the required cloud resources.

Usage notes

For cross-account scenarios, a self-managed database connected via VPC (with the Access Method set to Express Connect, VPN Gateway, or Smart Access Gateway) is supported only as a source database, not as a destination. For a list of supported databases, see Supported databases for cross-account access.

Step 1: Create a RAM role and grant it default DTS permissions

Log on to the RAM console by using the Alibaba Cloud account that owns the Express Connect circuit and the source database (the source account).

Important
If you perform this step as a RAM user, you may encounter an authorization error when you create the DTS task.
In the left-side navigation pane, choose Identities > Role.

Important
Do not choose Identities > Users. Otherwise, DTS cannot access the database instance and an error occurs.
On the Roles page, click Create Role.
In the Create Role panel, configure the RAM role.
1. For Principal Type, select Cloud Account.
2. For Principal Name, select Other Account, and then enter the ID of the Alibaba Cloud root account that owns the source database.
3. At the bottom of the page, click OK.
4. In the Create Role panel, enter a name for the RAM role and click OK.
  
  In this example, enter ram-for-dts.
On the Permissions tab, click Grant Permission.
In the Grant Permission panel, grant permissions to the RAM role.
1. For Policy Type, select System Policy.
2. In the Policy Name field, enter AliyunDTSRolePolicy.
3. Click OK.
  
  You can click the refresh icon on the right side of the Permissions tab to confirm that the permission has been granted.

Step 2: Authorize the RAM role to access the VPC

Log on to the RAM console by using the Alibaba Cloud account that owns the Express Connect circuit and the source database (the source account).

Important
If you perform this step as a RAM user, you may encounter an authorization error when you create the DTS task.
In the left-side navigation pane, choose Identities > Role.

Important
Do not choose Identities > Users. Otherwise, DTS cannot access the database instance and an error occurs.
Find the RAM role that you created in Step 1 and click the role name.
Grant additional permissions to the RAM role.
1. On the Permissions tab, click Grant Permission.
2. In the Grant Permission panel, configure the authorization settings.
  1. Select the authorization scope.
    
    This example selects Alibaba Cloud Account. For more information, see Manage the permissions of a RAM role.
  2. In the Select Policy section, select System Policy.
  3. Select a policy.
    
    In the search box, enter AliyunVPCReadOnlyAccess, find the policy, and click it to add it to the Selected section.
  4. Click OK. You can then click the refresh icon on the right side of the Permissions tab to verify that the permission is granted.
3. After the permission is granted, click Close.
Modify the trust policy of the RAM role.
1. Click the Trust Policy tab.
2. On the Trust Policy tab, click Edit Trust Policy.
3. On the JSON tab, replace the existing code in the policy editor with the following code.
```
{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "RAM": [
                    "acs:ram::<Alibaba Cloud account ID>:root"
                ],
                "Service": [
                    "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                ]
            }
        }
    ],
    "Version": "1"
}
```
4. Replace both <Alibaba Cloud account ID> placeholders with the ID of the Alibaba Cloud account (main account) that owns the destination database.
5. Click OK to save the trust policy.
  
  After you save the trust policy, if the Service value automatically changes from "<Alibaba Cloud account ID>@dts.aliyuncs.com" to "dts.aliyuncs.com", it indicates that the specified <Alibaba Cloud account ID> is incorrect. Make sure that you provide the ID of the Alibaba Cloud account that owns the destination database, not the source database.
  
  Note
  For more information about which Alibaba Cloud account to use for signing in and which account ID to specify in the trust policy, see Account information.

Step 3: Configure the DTS task

Note

This section uses a data synchronization task as an example to demonstrate how to configure a cross-account DTS task.

Using the Alibaba Cloud account that owns the destination database, log on and navigate to the Configurations for Source and Destination Databases page.
1. Go to the data synchronization task list page in the destination region. You can do this in one of two ways.
  DTS console
  Log on to the DTS console.
  In the navigation pane on the left, click Data Synchronization.
  In the upper-left corner of the page, select the region where the synchronization instance is located.
  DMS console
  Note
  The actual steps may vary depending on the mode and layout of the DMS console. For more information, see Simple mode console and Customize the layout and style of the DMS console.
  Log on to the DMS console.
  In the top menu bar, choose Data + AI > DTS (DTS) > Data Synchronization.
  To the right of Data Synchronization Tasks, select the region of the synchronization instance.
2. Click Create Task to open the task configuration page.

Configure the source database information.

The following table describes the key parameters.

Parameter	Description
Select Existing Connection	This parameter is not required for this example.
Database Type	Select the type of your database.
Access Method	Select Express Connect, VPN Gateway, or Smart Access Gateway.
Instance Region	Select the region where your instance is located.
Replicate Data Across Alibaba Cloud Accounts	Select Yes.
Alibaba Cloud Account	Enter the Account ID of the source Alibaba Cloud account.
RAM Role Name	Enter the name of the RAM role that you created in the source Alibaba Cloud account in Step 1.
Connected VPC	Select the VPC that is connected to your source database. Note If an error occurs, see Common errors for solutions.

Complete the remaining configurations as needed, following the on-screen instructions.