All Products
Search

This Product

    ApsaraDB for MongoDB:Grant DTS access to cloud resources

    Document Center

    ApsaraDB for MongoDB:Grant DTS access to cloud resources

    Last Updated:Mar 28, 2026

    Before you can configure MongoDB Global Distributed Cache (formerly Global Active Database, or GAD), grant Data Transmission Service (DTS) the permissions it needs to access your MongoDB and other cloud resources. This is a one-time setup: create the default service role AliyunDTSDefaultRole and attach the AliyunDTSRolePolicy system policy to it. The authorization has no impact on your MongoDB instance performance.

    Note

    If you log on to the RAM console and the role AliyunDTSDefaultRole with the AliyunDTSRolePolicy permission already exists, skip this topic and create a Global Distributed Cache instance group.

    Prerequisites

    Before you begin, ensure that you have:

    • An Alibaba Cloud account. For details, see Create an Alibaba Cloud account

    • Access to the Alibaba Cloud account (the primary account — RAM users cannot perform this authorization)

    Policy description

    The AliyunDTSRolePolicy system policy grants the AliyunDTSDefaultRole service role permissions to manage the following cloud resources on behalf of DTS:

    • ApsaraDB for RDS

    • ECS

    • PolarDB

    • ApsaraDB for MongoDB

    • ApsaraDB for Redis

    • PolarDB-X

    • DataHub

    • Elasticsearch

    For the full list of permissions in this policy, see AliyunDTSRolePolicy. For background on policy structure, see Policy structure and syntax.

    Choose an authorization method

    ScenarioMethod
    First-time authorization, or the role AliyunDTSDefaultRole does not existMethod 1: Quick authorization from the RAM console (recommended)
    The role exists but the AliyunDTSRolePolicy permission is not attachedMethod 2: Attach the policy manually

    Method 1: Quick authorization from the RAM console

    Log on to the AliyunDTSDefaultRole quick authorization page using your Alibaba Cloud account. In the Cloud Resource Access Authorization dialog box, click Agree To Authorization. A success message confirms the authorization is complete.

    Method 2: Attach the policy manually

    1. Log on to the RAM console.

    2. (Optional) In the left-side navigation pane, choose Identities > Roles.

    3. In the text box next to Create Role, enter AliyunDTSDefaultRole and click the search icon.

      If the role is not found, use Method 1 instead.

    4. Click the role name in the search results.

    5. On the Permissions tab, click Precise Permission.

      image

    6. (Optional) In the Precise Permission panel, select System Policy for the Type parameter.

      4-1

    7. In the Policy Name field, enter AliyunDTSRolePolicy.

    8. Click OK.

    9. To verify the change, click the image icon on the right side of the Permissions tab to refresh the page.

    10. Click Close.

    Verify the authorization

    1. Log on to the RAM console.

    2. (Optional) In the left-side navigation pane, choose Identities > Roles.

    3. In the text box next to Create Role, enter AliyunDTSDefaultRole and click the search icon.

    4. Click the role name in the search results, then click AliyunDTSDefaultRole to view its details.

    5. Confirm both of the following conditions:

      • Trust Policy tab: dts.aliyuncs.com appears in the Service field. image

      • Permissions tab: the AliyunDTSRolePolicy policy is listed. image

      If either condition is not met, the authorization failed. Delete the role AliyunDTSDefaultRole and repeat the authorization using Method 1. For instructions on deleting a RAM role, see Delete a RAM role.

    What's next

    Create a Global Distributed Cache instance group