You can use cross-region replication (CRR) across accounts to replicate Object Storage Service (OSS) objects from a bucket in a region within Alibaba Cloud account A to another bucket in another region within Alibaba Cloud account B.
Prerequisites
Bucket A, which works as the source bucket of a CRR task, is created in a region within Account A. Record the UID of Account A, the name of Bucket A, and the region in which Bucket A is located.
Account A must have the following permissions:
oss:PutBucketReplication
,oss:GetBucketReplication
,oss:DeleteBucketReplication
, oss:GetBucketReplicationLocation, and oss:GetBucketReplicationProgress. For more information, see Grant custom permissions to a RAM user.Bucket B, which works as the destination bucket of the CRR task, is created in another region within Account B. Record the UID of Account B, the name of Bucket B, and the region in which Bucket B is located.
Role authorization
Two buckets that belong to different Alibaba Cloud accounts are required for data replication across accounts. The following items describe the trust policy and minimum permissions required by the RAM role for data replication across accounts:
Use Account A to perform the following operations:
Create a service role.
ImportantYou can use a RAM user to create a role. The RAM user must have the following permissions:
ram:CreateRole
,ram:GetRole
,ram:ListRoles
,ram:ListPoliciesForRole
, andram:AttachPolicyToRole
. However, granting a RAM user permissions such asram:CreateRole
andram:GetRole
poses high risks. You can use the Alibaba Cloud account associated with the RAM user to create a RAM role and grant permissions to the RAM role. Then, the RAM user can assume the RAM role that is created by the Alibaba Cloud account.When you create a role, select Alibaba Cloud Service for Trusted entity type and Object Storage Service for Select trusted service. For more information, see Create a service role.
NoteAfter the role is created, record the RAM role ARN in the Basic Information section for subsequent permission granting.
Grant the RAM role the permissions to perform CRR on the source bucket.
You can use one of the following methods to grant permissions to the RAM role:
Grant a system policy to the RAM role
WarningYou can grant the
AliyunOSSFullAccess
system policy to the RAM role.AliyunOSSFullAccess
grants permissions to perform all operations on all buckets in the current account. Exercise caution when you use this policy.Grant a custom policy to the RAM role
You can use a RAM policy to grant the RAM role the minimum permissions required to perform CRR on the source bucket (src-bucket).
NoteReplace src-bucket with the name of the source bucket based on your business requirements.
{ "Version":"1", "Statement":[ { "Effect":"Allow", "Action":[ "oss:ReplicateList", "oss:ReplicateGet" ], "Resource":[ "acs:oss:*:*:src-bucket", "acs:oss:*:*:src-bucket/*" ] } ] }
If you want to replicate objects encrypted based on KMS from the source bucket to the destination bucket, you must also grant the
AliyunKMSFullAccess
system policy to the role. For more information, see Grant permissions to a RAM role.
Use Account B to grant the RAM role the permissions to receive the objects that you want to replicate to the destination bucket.
(Recommended) Method 1: Add a policy by using the graphical editor
Log on to the OSS console.
In the left-side navigation pane, click Buckets, and then click the name of the destination bucket
dest-bucket
.In the left-side navigation pane, choose
.On the Bucket Policy page, click the Add in GUI tab, and then click Receive Objects to Replicate.
In the Receive Objects to Replicate panel, select Obtain From Source Replication RAM Role ARN for Obtain UID and RAM Role From, select the ARN of the role created in Step 1 for Source RAM Role ARN for Replication, and select CRR Across Accounts for Authorization Purpose.
Click Generate Policy.
Method 2: Add a policy by specifying policy statements
In the left-side navigation pane, choose Permission Control > Bucket Policy.
On the Bucket Policy page, click the Add by Syntax tab, and then click Edit.
In the code editor, enter the following bucket policy.
ImportantIf you configure a bucket policy by specifying policy statements to grant the RAM role the required permissions, the new bucket policy overwrites the existing bucket policy. Make sure that the new bucket policy contains the content of the existing bucket policy. Otherwise, the authorization of the existing bucket policy may fail.
Replace the custom role name (If the custom role name contains uppercase letters, you must convert the uppercase letters to lowercase letters. For example, if the created role name is AliyunOssDrsRole, you need to convert AliyunOssDrsRole to aliyunossdrsrole), the name of the destination bucket (dest-bucket), the UID of the account to which the source bucket belongs (137918634953xxxx), and the UID of the account to which the destination bucket belongs (111933544165xxxx).
{ "Version":"1", "Statement":[ { "Effect":"Allow", "Action":[ "oss:ReplicateList", "oss:ReplicateGet", "oss:ReplicatePut", "oss:ReplicateDelete" ], "Principal": [ "arn:sts::137918634953xxxx:assumed-role/aliyunossdrsrole/*" ], "Resource":[ "acs:oss:*:111933544165xxxx:dest-bucket", "acs:oss:*:111933544165xxxx:dest-bucket/*" ] } ] }
Click Save.
Replicate objects encrypted based on KMS
Objects encrypted by using SSE-KMS can be replicated to buckets in the following regions: China (Hangzhou), China (Shanghai), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Chengdu), China East 2 Finance, China (Hong Kong), Singapore, Malaysia (Kuala Lumpur), Indonesia (Jakarta), Philippines (Manila), Thailand (Bangkok), Japan (Tokyo), US (Silicon Valley), US (Virginia), Germany (Frankfurt), and UK (London).
If you want to copy objects encrypted by using SSE-KMS from a source bucket that belongs to Account A to a destination bucket that belongs to Account B, use Account B to perform the following steps:
Log on to the Instance Management page of the Key Management Service console. Purchase and enable a KMS instance in the same region as the destination bucket. When you purchase a KMS instance, make sure that Number Of Access Control is set to a value greater than or equal to 2. Retain the default values for other parameters. For more information, see Purchase and enable a KMS instance.
Create a key in the KMS instance. The key type cannot be Default. We recommend that you use software keys. For more information, see Create a software key.
NoteAfter the key is created, record the key ARN in the Basic Information section for subsequent creation of replication rules.
Configure a policy for the key. When you configure a key policy, select Other Account Users and specify the ARN of the role created in the preceding steps for Other Account Users. For more information, see Configure a key policy.
ImportantTo replicate encrypted data across accounts, the key policy must include at least the decryption (
kms:Decrypt
) and data key generation (kms:GenerateDataKey
) permissions. When you configure a key policy in the KMS console, the preceding permissions are added by default. If you configure a custom key policy by using OpenAPI, make sure that the policy includes at least thekms:Decrypt
andkms:GenerateDataKey
permissions.