Data Management:Gunakan DMS lintas Akun Alibaba Cloud

Asumsikan akun Alibaba Cloud A ingin mendaftarkan resource dari akun Alibaba Cloud B ke tenant DMS akun A. RAM user di bawah akun B harus melakukan langkah-langkah berikut di konsol RAM:

1. Login ke RAM console menggunakan RAM user di bawah akun Alibaba Cloud B milik pemilik resource yang memiliki izin AliyunRAMFullAccess.

2. Di halaman Roles, buat RAM role dan konfigurasikan trust policy untuk akun A. Gunakan salah satu metode berikut:

   Metode 1: Editor visual

   1. Di halaman Create Role, klik Switch to Policy Editor.

      Untuk Select Trusted Entity, pilih Alibaba Cloud Account. Tombol Switch to Policy Editor berada di sisi kanan prompt di bagian bawah halaman.

   2. Di tab Visual Editor, atur Principal ke Cloud Service. Konfigurasikan parameter berikut:

      • Di kotak teks di bawah Other Account, masukkan UID Akun A.

      • Untuk Cloud Service, pilih Data Management/DMSEnterprise.

   3. Klik OK.

   Metode 2: Script editor

   1. Di halaman Create Role, klik Switch to Policy Editor.

   2. Di tab Script Editor, masukkan kebijakan berikut.

      Trust policy ini memungkinkan pengguna tertentu mengelola resource untuk pendaftaran instans cross-account.

      {
        "Statement": [
          {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "Service": [
                "<UID of Alibaba Cloud account A>@dms.aliyuncs.com"
              ]
            }
          }
        ],
        "Version": "1"
      }

   3. Klik OK.

3. Di halaman Policies, buat kebijakan kustom. Misalnya, beri nama kebijakan tersebut DmsCrossAccountPolicy.

   Jenis database dan metode akses (VPC) berikut didukung dalam kebijakan izin: Tair (Redis OSS-compatible), PolarDB-X, OceanBase, ApsaraDB for Lindorm, Hologres, GDB, SelectDB, dan ClickHouse Enterprise Edition.

   Catatan

   Untuk RDS, PolarDB for MySQL, PolarDB for PostgreSQL, dan PolarDB for PostgreSQL(Compatible with Oracle), lewati Langkah 3 dan 4, lalu lanjutkan ke Langkah 5.

   Klik di sini untuk melihat kebijakan izin untuk setiap jenis database.

   Redis

   {
     "Statement": [
       {
         "Action": [
           "kvstore:DescribeSecurityIps",
           "kvstore:ModifySecurityIps",
           "kvstore:DescribeRegions",
           "kvstore:DescribeInstances",
           "kvstore:DescribeInstanceAttribute",
           "kvstore:DescribeInstanceConfig"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   PolarDB-X 1.0

   {
     "Statement": [
       {
         "Action": [
           "drds:DescribeDrdsInstances",
           "drds:QueryInstanceInfoByConn",
           "drds:DescribeDrdsInstanceList",
           "drds:DescribeDrdsDBIpWhiteList",
           "drds:ModifyDrdsIpWhiteList",
           "drds:DescribeDrdsInstanceVersion"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   PolarDB-X 2.0

   {
     "Statement": [
       {
         "Action": [
           "polardbx:DescribeDBInstances",
           "polardbx:DescribeSecurityIps",
           "polardbx:ModifySecurityIps",
           "polardbx:DescribeDBInstanceAttribute",
           "polardbx:DescribeDBInstanceViaEndpoint"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   OceanBase

   {
     "Statement": [
       {
         "Action": [
           "oceanbase:DescribeAllTenantsConnectionInfo",
           "oceanbase:DescribeInstances"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   ApsaraDB for Lindorm

   {
     "Statement": [
       {
         "Action": [
           "lindorm:GetLindormInstanceList",
           "lindorm:GetLindormInstance",
           "lindorm:GetLindormInstanceListForDMS",
           "lindorm:GetLindormInstanceForDMS",
           "lindorm:GetLindormInstanceForDMSByConnStr",
           "lindorm:GetInstanceIpWhiteList",
           "lindorm:UpdateInstanceIpWhiteList"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   Hologres

   {
     "Statement": [
       {
         "Action": [
           "hologram:GetInstance",
           "hologram:ListInstances"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   GDB

   {
     "Statement": [
       {
         "Action": [
           "gdb:DescribeDbInstances"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   SelectDB

   {
     "Statement": [
       {
         "Action": [
           "selectdb:DescribeDBInstances",
           "selectdb:DescribeDBInstanceAttribute",
           "selectdb:DescribeDBInstanceNetInfo",
           "selectdb:DescribeSecurityIPList",
           "selectdb:ModifySecurityIPList"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   ClickHouse Enterprise Edition

   {
     "Statement": [
       {
         "Action": [
           "clickhouse:DescribeDBClusters",
           "clickhouse:DescribeDBInstances",
           "clickhouse:DescribeDBInstanceAttribute",
           "clickhouse:DescribeEndpoints",
           "clickhouse:DescribeSecurityIPList",
           "clickhouse:ModifySecurityIPList"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   Contoh kebijakan berikut memungkinkan pendaftaran database melalui VPC.

   {
     "Statement": [
       {
         "Action": [
           "vpc:DescribeVpcs"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

4. Di halaman Roles, sambungkan kebijakan DmsCrossAccountPolicy ke role yang dibuat pada Langkah 2. Untuk informasi selengkapnya, lihat Manage permissions for a RAM role.

5. Di halaman Roles, klik nama role tersebut dan salin ARN dari halaman detail role.

Daftarkan instans

Saat user A mendaftarkan database, masukkan ARN role tersebut.

Di kotak dialog Register Database, pada bagian Basic Information, atur Database Type ke MySQL dan konfigurasikan Instance Region. Di bidang Cross-account ARN, masukkan ARN yang disalin pada Langkah 4.