Grant DTS permissions to access cloud resources - ApsaraDB RDS

When you use an RDS for MySQL database with Global Distributed Cache for the first time, you must create the default role named AliyunDTSDefaultRole and grant the AliyunDTSRolePolicy system policy to the role. This allows DTS to access your RDS and DTS cloud resources, which is required to configure and manage your database with Global Distributed Cache. This authorization ensures that the RDS service for databases with Global Distributed Cache works correctly and does not affect the performance of your RDS instances.

Note

If you log on to the Resource Access Management (RAM) console with your Alibaba Cloud account and find that the account already has the required permissions, you can skip the steps in this topic and start creating a database with Global Distributed Cache.

Prerequisites

An Alibaba Cloud account is created. For more information, see Create an Alibaba Cloud account.
For authorization, the Alibaba Cloud account must be a root account.

Permission policy

The AliyunDTSRolePolicy system policy for the AliyunDTSDefaultRole default role includes partial management permissions for cloud resources such as ApsaraDB for RDS, Elastic Compute Service (ECS), PolarDB, ApsaraDB for MongoDB, ApsaraDB for Redis, PolarDB-X, DataHub, and Elasticsearch. For a detailed definition of the permissions, see AliyunDTSRolePolicy.

Note

For more information about permission policies, see Syntax and structure of permission policies.

Method 1: Grant permissions using a quick authorization link (Recommended)

Use your Alibaba Cloud account to go to the quick authorization page for AliyunDTSDefaultRole. In the Cloud Resource Access Authorization dialog box, click Agree Authorization. A message is displayed, indicating that the authorization is successful.

Method 2: Grant permissions in the RAM console

Find the default role.
1. Use an Alibaba Cloud account to log on to the RAM console.
2. Optional: In the left-side navigation pane, choose Identities > Roles.
3. In the search box to the right of Create Role, enter AliyunDTSDefaultRole and search for the role.
  
  Note
  If the AliyunDTSDefaultRole role does not exist, we recommend that you use Method 1.
In the search results, click AliyunDTSDefaultRole.
Grant precise permissions to the target RAM role.
1. On the Permissions tab, click Precise Permission.
2. Optional: In the Precise Permission panel, set Policy Type to System Policy.
3. In the Policy Name text box, enter AliyunDTSRolePolicy.
4. Click OK.
  
  On the Permissions tab, you can click the refresh icon to check whether the permission is granted.
After the permission is granted, click Close.

Verify the authorization

Note

You can follow these steps to verify the authorization for the default role.

Use an Alibaba Cloud account to log on to the RAM console.
Optional: In the left-side navigation pane, choose Identities > Roles.
In the search box to the right of Create Role, enter AliyunDTSDefaultRole and search for the role.
In the search results, click AliyunDTSDefaultRole.
View the details of the AliyunDTSDefaultRole role.
- The authorization is successful if the AliyunDTSDefaultRole role meets both of the following conditions:
  - The Trust Policy contains dts.aliyuncs.com.
    
    Specifically, the Service field in the Principal section of the trust policy JSON contains dts.aliyuncs.com. To modify the trust policy, click Edit Trust Policy.
  - The Permissions tab contains the AliyunDTSRolePolicy system policy.
- If the AliyunDTSDefaultRole role does not meet these conditions, the authorization has failed, and you must authorize the role again.
  
  You can delete the AliyunDTSDefaultRole role and authorize it again.
  Note
  
  We recommend that you use Method 1.
  
  For more information about how to delete a RAM role, see Delete a RAM role.

Next steps

Creating a multi-active database