Cloud Backup:Cross-account backup

(Optional) Step 1: Set a delegated administrator account for the Cloud Backup service

To use a member account of the resource directory as the backup management account, set this account as the delegated administrator account for the Cloud Backup service in the trusted services of the resource directory in the Resource Management console. For more information, see Manage a delegated administrator account.

1. Log on to the Resource Management console using the management account of the resource directory.

2. In the navigation pane on the left, choose Resource Directory > Trusted Services.

3. On the Trusted Services page, click Manage in the Actions column for the Cloud Backup service.

4. In the Delegated Administrator Account section, click Add.

5. In the Add Delegated Administrator Account panel, select the backup management account.

6. Click OK.

   After the account is added, the Cloud Backup service appears in the trusted services of the resource directory when you log on to the Resource Management console using the delegated administrator account.

Step 2: Add a resource account in the backup management account

1. Log on to the using the backup management account. Log on to the Cloud Backup console.

2. In the navigation pane on the left, choose Backup > Cross-Account Backup.

3. On the Cross-Account Backup page, switch to the region where the resources of the resource account are located.

4. Click the Add Account To Back Up button.

5. In the Add Resource Account panel, configure the following parameters and click OK.

   Parameter	Description
   Cross-account type	Select Based on Resource Directory.
   Select Account To Back Up	Select a resource account from the resource directory. You can select only one account at a time. You can enter a keyword to quickly find the member account.

   Note

   For accounts that are in a resource directory, we recommend that you configure cross-account backup based on the resource directory. You can also configure cross-account backup based on RAM role-based authorization. For more information, see Add a resource account based on RAM role-based authorization.

   After the account is added, you can see the resource account in the account list.When a resource account is managed for the first time, Cloud Backup automatically creates the service-linked role AliyunServiceRoleForHbrRd:

   • Role name: AliyunServiceRoleForHbrRd

   • Access policy: AliyunServiceRolePolicyForHbrRd

   • Description: Allows the backup service to access resources of other authorized accounts for cross-account backup and recovery.

Step 1: Create a service-linked role for the backup management account

You must grant the service-linked role AliyunServiceRoleForHbrCrossAccountBackup to the backup management account.

• Role name: AliyunServiceRoleForHbrCrossAccountBackup

• Access policy: AliyunServiceRolePolicyForHbrCrossAccountBackup

• Description: Allows the backup service to access resources of other authorized accounts for cross-account backup and recovery.

1. Log on to the using the backup management account. Log on to the Cloud Backup console.

2. In the navigation pane on the left, choose Backup > Cross-Account Backup.

3. On the Cross-Account Backup page, switch to the region where the resources to be backed up are located.

4. Click Add Resource Account. In the Add Resource Account panel, set Cross-account type to Based on RAM Role.

5. In the Cloud Backup Authorization dialog box, click OK.

   For more information, see Service-linked roles for Cloud Backup.

Step 2: Create a RAM role in the resource account

1. Log on to the RAM console using the resource account.

2. In the navigation pane on the left, choose Identities > Roles.

3. On the Roles page, click Create Role.

4. On the Create Role page, set Select Trusted Entity to Alibaba Cloud Account. Set Select Trusted Alibaba Cloud Account to Other Alibaba Cloud Account. Enter the ID of the backup management account and click OK.

   

   Note

   Go to the Security Settings page to view your Alibaba Cloud account ID.

5. In the Create Role dialog box, enter a RAM role name, such as hbrcrossrole, and click OK.

Step 3: Grant permissions to the RAM role in the resource account

The following example shows how to grant the AliyunHBRRolePolicy policy to the RAM role hbrcrossrole:

1. Log on to the RAM console using the resource account.

2. In the navigation pane on the left, choose Identities > Roles.

3. Find the destination RAM role hbrcrossrole and go to its details page.

4. On the Permissions tab, click Grant Permission.

5. In the Grant Permission dialog box, set the permission type to System Policy, enter AliyunHBRRolePolicy as the policy name, and then click OK.

6. A message appears indicating that the permission is granted. Click Close.

7. Modify the trust policy of the RAM role.

   1. On the details page of the current role, click the Trust Policy tab.

   2. Click Edit Trust Policy.

   3. Click the Script tab and copy the following code to the text box. Replace ID of the destination account with the ID of the backup management account.

      This policy allows the backup management account to obtain a temporary token through Cloud Backup to operate on the resources of the resource account.

      Note

      You can go to the Security Settings page to view your Alibaba Cloud account ID.

      {
       "Statement": [
           {
               "Action": "sts:AssumeRole",
               "Effect": "Allow",
               "Principal": {
                   "RAM": [
                       "acs:ram::ID of the destination account:role/AliyunServiceRoleForHbrCrossAccountBackup"
                   ]
               }
           }
       ],
       "Version": "1"
      }

   4. Click OK.

Step 4: Add the resource account in the backup management account

1. Log on to the using the backup management account. Log on to the Cloud Backup console.

2. In the navigation pane on the left, choose Backup > Cross-Account Backup.

3. On the Cross-Account Backup page, switch to the region where the resources to be backed up are located.

   Important

   The backup management account must add the resource account in the same region where the ECS files, NAS, OSS, Tablestore, ECS databases, or ECS instances to be backed up are located. Otherwise, Cloud Backup cannot find the resources, and backup plan configuration or backup job execution will fail.

4. Click Add Accounts To Back Up, select Cross-account Type as Based On RAM Role Assumption in the Add Accounts To Back Up panel, configure the following parameters, and then click OK.

   

   Parameter	Description
   Cross-account type	Select Based on RAM Role. If the backup management account is a delegated administrator account for the Cloud Backup service in a resource directory, we recommend that you see Add a resource account based on a resource directory.
   Alibaba Cloud Account ID	Enter the Alibaba Cloud account ID. This is the ID of the resource account. Note You can go to the Security Settings page to view your Alibaba Cloud account ID.
   Role Name	Enter the name of the RAM role created in the resource account, such as hbrcrossrole. Important Click Check Permissions to verify the permission settings. If an error is reported, check the settings and try again. If the check is successful, the message You are authorized to access the resources of this role. appears.
   Account Alias	Set an easy-to-identify name for the backup account. We recommend that you use the Alibaba Cloud account name of the resource account.

Is the cross-account backup feature free?

The feature itself is free. The backup management account is responsible for the fees incurred during backup and recovery. However, the resource account is still responsible for the snapshot service fees for ECS instance backups and OSS request fees. For more information, see Billing.

What is the difference between cross-account replication of backup vaults and cross-account backup? What are their respective scenarios?

• Cross-account replication of backup vaults: The source account has already performed backups and generated backup data. The source account copies the data from its own backup vault to another Alibaba Cloud account. In this case, both accounts have a copy of the backup data. This achieves data redundancy or allows cross-account use.

• Cross-account backup: The backup management account centrally issues backup policies to resource accounts. The backup data from the resource accounts is stored in the backup management account. The backup management account can use this data for on-demand recovery operations, achieving centralized management of backup data. The resource accounts cannot view or manage the backed-up data.

Both methods are widely used in enterprise data security and compliance scenarios. Both support account-level data isolation for accounts within and outside a resource directory. Choose the method based on your enterprise's specific needs. You can also use both methods together to achieve both centralized management and redundancy of backup data.