Data Transmission Service (DTS) allows you to configure a DTS task across Alibaba Cloud accounts for scenarios such as resource migration or merging across Alibaba Cloud accounts and business architecture adjustment.
Background information
Two databases, such as two ApsaraDB RDS for MySQL instances or two self-managed databases that are connected to Alibaba Cloud over Express Connect, VPN Gateway, or Smart Access Gateway, belong to two different Alibaba Cloud accounts. You want to migrate data from the database of Account A to the database of Account B.
Supported databases
The following table describes the databases for which you can configure the Replicate Data Across Alibaba Cloud Accounts parameter when you configure a DTS task.
The setting of the Replicate Data Across Alibaba Cloud Accounts parameter for the source database does not affect the setting of the Database Type parameter for the destination database.
Database instance | Alibaba Cloud database instance | Self-managed database |
Source database | ApsaraDB RDS for MySQL, ApsaraDB RDS for MariaDB, ApsaraDB RDS for PostgreSQL, ApsaraDB RDS for SQL Server, PolarDB-X 1.0, PolarDB-X 2.0, PolarDB for PostgreSQL, PolarDB for PostgreSQL (Compatible with Oracle), PolarDB for MySQL, ApsaraDB for Redis, Tair, ApsaraDB for MongoDB, and ApsaraDB for OceanBase (MySQL mode). |
|
Destination database | ApsaraDB RDS for MySQL, PolarDB for MySQL, ApsaraDB for SelectDB, and ApsaraDB for ClickHouse. | Not supported. |
Prerequisites
The source and destination instances are created.
The Resource Access Management (RAM) role of DTS is authorized to access the cloud resources within the Alibaba Cloud accounts to which the source and destination database instances belong. For more information, see Authorize DTS to access Alibaba Cloud resources.
The IDs of the Alibaba Cloud accounts to which the source and destination database instances belong and the ID of the Alibaba Cloud account that is used to create a DTS task are obtained. To obtain the ID of an Alibaba Cloud account, log on to the Account Management Console by using the account, go to the Security Settings page, and then view the value of the Account ID parameter.
Usage notes
You can configure a two-way synchronization task across Alibaba Cloud accounts only between ApsaraDB RDS for MySQL instances.
NoteIf the Replicate Data Across Alibaba Cloud Accounts parameter is unavailable for a DTS task, you can use CEN to configure the DTS task across Alibaba Cloud accounts. For more information, see the Connect databases to DTS across Alibaba Cloud accounts or regions section of the Connect an on-premises database to DTS by using CEN topic.
You cannot use DTS to synchronize data between accounts of different infrastructures. For example, you cannot use DTS to synchronize data between an Alibaba Finance Cloud account and an Alibaba Gov Cloud account.
Procedure
In this example, a synchronization task is configured to show how to configure a DTS task across Alibaba Cloud accounts.
Create a RAM role for the database instance.
NoteIf you grant permissions to a RAM role by using a RAM user, an error message about invalid permissions may appear when you configure a DTS task.
You do not need to create a RAM role for the database instance of a DTS task for which the Replicate Data Across Alibaba Cloud Accounts parameter is unavailable or is set to No.
Log on to the RAM console by using the Alibaba Cloud account to which the source or destination instance belongs.
In the left-side navigation pane, choose .
ImportantDo not choose
. Otherwise, DTS cannot access the instance, and an error may be reported.On the Roles page, click Create Role.
On the Create Role page, set the Select Trusted Entity parameter to Alibaba Cloud Account and click Next.
In the Configure Role step, configure parameters for the RAM role.
Parameter
Description
RAM Role Name
The name of the RAM role. In this example, ram-for-dts is specified.
NoteThe name must be 1 to 64 characters in length and can contain letters, digits, and hyphens (-).
Note
Optional. The description of the RAM role.
Select Trusted Alibaba Cloud Account
Select Other Alibaba Cloud Account and enter the ID of the Alibaba Cloud account that is used to create the DTS task.
Click OK.
Grant permissions to the created RAM role.
Click Input and Attach.
On the Permissions tab, click Precise Permission.
In the Precise Permission panel, set Type to System Policy.
In the Policy Name field, enter AliyunDTSRolePolicy.
In the message that appears, click OK.
Click Close.
Modify the trust policy.
Optional. On the Roles page, find the created RAM role and click its name.
On the details page of the RAM role, click the Trust Policy tab.
On the Trust Policy tab, click Edit Trust Policy.
Copy the following code to the code editor:
{ "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "RAM": [ "acs:ram::<Alibaba Cloud account ID>:root" ], "Service": [ "<Alibaba Cloud account ID>@dts.aliyuncs.com" ] } } ], "Version": "1" }
Replace
<Alibaba Cloud account ID>
in the preceding code with the ID of the Alibaba Cloud account that is used to create the DTS task.Click Save trust policy document.
Create a data synchronization task.
Log on to the Data Management (DMS) console by using the Alibaba Cloud account ID that is specified in the trust policy.
In the top navigation bar, choose .
NoteIf you use the DMS console in simple mode, you can move the pointer over the icon in the upper-left corner, and choose Customize the layout and style of the DMS console.
. For more information, seeClick Create Task. On the Create Data Synchronization Task page, configure the source and destination databases. The following table describes the parameters.
Configure the Database Type, Access Method, and Instance Region parameters based on your business requirements.
Configure information about the Alibaba Cloud account to which the database instance belongs.
Parameter
Description
Replicate Data Across Alibaba Cloud Accounts
Specifies whether to synchronize data across Alibaba Cloud accounts. In this example, Yes is selected.
Alibaba Cloud Account
The ID of the Alibaba Cloud account to which the database instance belongs.
NoteTo obtain the ID of the Alibaba Cloud account to which the database instance belongs, log on to the Account Management Console by using this account. The account ID is displayed on the Security Settings page.
RAM Role Name
The name of the RAM role that you created in Step 1. In this example, ram-for-dts is specified.
ImportantDo not enter the default role name AliyunDTSDefaultRole of DTS.
Configure the DTS task across Alibaba Cloud accounts based on the source and destination instance types. For more information about how to configure the DTS task, see Overview of data synchronization scenarios, Overview of data migration scenarios, and Overview of change tracking scenarios.
FAQ
What Alibaba Cloud accounts do I use in different stages of a cross-account DTS task?
In a cross-account DTS task, the use of each Alibaba Cloud account is related to the database of the Alibaba Cloud account. Take note of the following items when you decide to use an Alibaba Cloud account:
NoteThe accounts that you use during the DTS task are Alibaba Cloud accounts.
If a database to be used during the task does not belong to the Alibaba Cloud account that you use to create the DTS task, set the Replicate Data Across Alibaba Cloud Accounts parameter of the database to Yes.
The Replicate Data Across Alibaba Cloud Accounts parameter is available only if you select MySQL or ClickHouse for the Database Type parameter in the Destination Database section.
The following table describes how to decide the Alibaba Cloud accounts that you need to use in different stages of the cross-account DTS task. You must decide the across-account database that you want to use first. Find the row that meets your business requirements based on the Across-account database column. Then, you can view the Alibaba Cloud accounts that you need to use in different stages of the cross-account DTS task.
Across-account database
Alibaba Cloud account that is used to log on to the RAM console
Alibaba Cloud account that is specified in the trust policy
Alibaba Cloud Account that is used to create the DTS task
Alibaba Cloud account that is configured for the Alibaba Cloud Account parameter
Source database
Alibaba Cloud account to which the source database belongs
Alibaba Cloud account to which the destination database belongs
Alibaba Cloud account to which the destination database belongs
Set the Alibaba Cloud Account parameter in the Source Database section to the Alibaba Cloud account to which the source database belongs.
Destination database
Alibaba Cloud account to which the destination database belongs
Alibaba Cloud account to which the source database belongs
Alibaba Cloud account to which the source database belongs
Set the Alibaba Cloud Account parameter in the Destination Database section to the Alibaba Cloud account to which the destination database belongs.
Source and destination databases
Each of the Alibaba Cloud accounts to which the source and destination database belong
Specific Alibaba Cloud account
Specific Alibaba Cloud account
Set the Alibaba Cloud Account parameter in the Source Database section to the Alibaba Cloud account to which the source database belongs.
Set the Alibaba Cloud Account parameter in the Destination Database section to the Alibaba Cloud account to which the destination database belongs.
How do I handle the errors that occur when I configure a cross-account DTS task?
The following table shows the common error messages that appear when you configure a cross-account DTS task and provides the corresponding solutions.
Error message
Solution
The value of the Alibaba Cloud Account parameter is invalid. Check whether you enter a valid ID of the Alibaba Cloud account to which the source or destination instance belongs. For more information, see the Preparations section of this topic.
These errors may occur due to the following reasons:
The value of the RAM Role Name parameter is invalid. Check whether you enter a valid RAM role name of the Alibaba Cloud account to which the source or destination instance belongs.
The required permissions are not granted to the RAM role. Use the Alibaba Cloud account to which the source or destination instance belongs to grant permissions.
NoteFor more information, see the Preparations section of this topic.
These errors may occur due to the following reasons:
The value of the RAM Role Name parameter is invalid. Check whether you enter a valid RAM role name of the Alibaba Cloud account to which the source or destination instance belongs.
The required permissions are not granted to the RAM role. Check whether you have granted the required permissions to the RAM role.
The trust policy of the RAM role is not modified. Check whether you have modified the trust policy for the RAM role.
NoteFor more information, see the Preparations section of this topic.
The RAM role that you specify in the RAM Role Name parameter is not granted the required permissions. To grant the required permissions to the RAM role, go to the details page of the RAM role. On the Permissions tab, click Precise Permission and specify the policy in the Precise Permission panel. Then, create the task again. For example, you must grant the required permissions to the RAM role of the Alibaba Cloud account to which the source instance belongs. For information about how to grant permissions to a RAM role, see the "Grant permissions to an existing RAM role" section of the Configure RAM authorization for cross-account DTS tasks topic.
The value of the RAM Role Name parameter is invalid. Enter the RAM role that you create during preparations instead of the default role AliyunDTSDefaultRole of DTS.