Data Transmission Service:Configure RAM authorization for cross-account DTS tasks

Step 1: Create a RAM role

1. Log on to the RAM console using the Alibaba Cloud account to which the source database belongs.

2. In the left-side navigation pane, choose Identities > Roles.

   

   Important

   Do not choose Identities > Users, as this will prevent DTS from accessing the database instance, resulting in an error.

3. Click Create Role on the Roles page.

4. In the Create Role panel, select Alibaba Cloud Account as the trusted entity and then click Next.

5. Configure the RAM role in the page that appears.

   

   Parameters	Description
   RAM Role Name	The name of the RAM role. In this example, ram-for-dts is specified. Note The role name must be equal to or less than 64 characters in length and can contain letters, digits, and hyphens (-).
   Note	Optional. The description for the RAM role.
   Select Trusted Alibaba Cloud Account	Select Other Alibaba Cloud Account, and enter the ID of the Alibaba Cloud account to which the destination database belongs. Note For more information, see Obtain the ID of the Alibaba Cloud account to which the destination database belongs in the Preparations section of this topic.

6. Click OK.

Step 2: Grant permissions to the RAM role

Step 3: Edit the trust policy of a RAM role

Step 1: Create a RAM role

1. Log on to the RAM console using the Alibaba Cloud account to which the destination database belongs.

2. In the left-side navigation pane, choose Identities > Roles.

   

   Important

   Do not choose Identities > Users, as this will prevent DTS from accessing the database instance, resulting in an error.

3. Click Create Role on the Roles page.

4. In the Create Role panel, select Alibaba Cloud Account as the trusted entity and then click Next.

5. Configure the RAM role in the page that appears.

   

   Configuration options	Configuration description
   RAM Role Name	The name of the RAM role. In this example, ram-for-dts is specified. Note The role name must be equal to or less than 64 characters in length and can contain letters, digits, and hyphens (-).
   Note	Optional. The description for the RAM role.
   Select Trusted Alibaba Cloud Account	Select Other Cloud Account, and enter the ID of the Alibaba Cloud account to which the source database belongs. Note For more information, see Obtain the ID of the Alibaba Cloud account to which the source database belongs in the Preparations section of this topic.

6. Click OK.

Step 2: Grant permissions to the RAM role

Step 3: Edit the trust policy of the RAM role

Step 1: Configure RAM authorization by using the Alibaba Cloud account to which the source database belongs

1. Create a RAM role.

   1. Log on to the RAM console using the Alibaba Cloud account to which the source database belongs.

   2. In the left-side navigation pane, choose Identities > Roles.

      

      Important

      Do not choose Identities > Users, as this will prevent DTS from accessing the database instance, resulting in an error.

   3. Click Create Role on the Roles page.

   4. In the Create Role panel, select Alibaba Cloud Account as the trusted entity and then click Next.

   5. Configure the RAM role in the page that appears.

      

      Parameter	Description
      RAM Role Name	The name of the RAM role. In this example, ram-for-dts is specified. Note The role name must be equal to or less than 64 characters in length and can contain letters, digits, and hyphens (-).
      Note	Optional. The description for the RAM role.
      Select Trusted Alibaba Cloud Account	Select Other Cloud Account, and enter the ID of the Alibaba Cloud account that is used to create a DTS task. Note For more information, see Obtain the ID of the Alibaba Cloud account that is used to create a DTS task in the Preparations section of this topic.

   6. Click OK.

2. Grant permissions to the RAM role.

   On the page where a role is successfully created

   1. Click Input and Attach.

   2. On the Permissions tab, click Precise Permission.

      

   3. In the Precise Permission panel, select Type to System Policy.

      

   4. Enter a Policy Name. In this example, AliyunDTSRolePolicy is specified.

   5. Click OK.

   6. Click Close in the panel that appears.

   On the Roles page

   1. Go to the Roles page.

      1. Log on to the RAM console using the Alibaba Cloud account to which the source database belongs.

      2. In the left-side navigation pane, choose Identities > Roles.

         

         Important

         Do not choose Identities > Users, as this will prevent DTS from accessing the database instance, resulting in an error.

      3. Find and click a role that you want to manage on the Roles page.

         

   2. On the Permissions tab, click Precise Permission.

      

   3. In the Precise Permission panel, select Type to System Policy.

      

   4. Enter a Policy Name. In this example, AliyunDTSRolePolicy is specified.

   5. Click OK.

   6. Click Close in the panel that appears.

3. Edit the trust policy of the RAM role.

   On the Trust Policy tab

   1. Click the Trust Policy tab.

      

   2. Click Edit Trust Policy.

   3. Replace the policy text with the following sample code.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   4. Replace the two <Alibaba Cloud account IDs> in the sample code with the ID of the Alibaba Cloud account that is used to create a DTS task.

      Note

      For more information, see Obtain the ID of the Alibaba Cloud account that is used to create a DTS task in the Preparations section of this topic.

   5. Click Save trust policy document.

   On the Roles page

   1. Go to the Roles page.

      1. Log on to the RAM console using the Alibaba Cloud account to which the source database belongs.

      2. In the left-side navigation pane, choose Identities > Roles.

         

         Important

         Do not choose Identities > Users, as this will prevent DTS from accessing the database instance, resulting in an error.

      3. Find and click a role that you want to manage on the Roles page.

         

   2. Click the Trust Policy tab.

      

   3. Click Edit Trust Policy.

   4. Replace the policy text with the following sample code.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   5. Replace the two <Alibaba Cloud account IDs> in the sample code with the ID of the Alibaba Cloud account that is used to create a DTS task.

      Note

      For more information, see Obtain the ID of the Alibaba Cloud account that is used to create a DTS task in the Preparations section of this topic.

   6. Click Save trust policy document.

Step 2: Configure RAM authorization by using the Alibaba Cloud account to which the destination database belongs

1. Create a RAM role.

   1. Log on to the RAM console using the Alibaba Cloud account to which the destination database belongs.

   2. In the left-side navigation pane, choose Identities > Roles.

      

      Important

      Do not choose Identities > Users, as this will prevent DTS from accessing the database instance, resulting in an error.

   3. Click Create Role on the Roles page.

   4. In the Create Role panel, select Alibaba Cloud Account as the trusted entity and then click Next.

   5. Configure the RAM role in the page that appears.

      

      Parameters	Description
      RAM Role Name	The name of the RAM role. In this example, ram-for-dts is specified. Note The role name must be equal to or less than 64 characters in length and can contain letters, digits, and hyphens (-).
      Note	Optional. The description for the RAM role.
      Select Trusted Alibaba cloud Account	Select Other Cloud Account, and enter the ID of the Alibaba Cloud account that is used to create a DTS task. Note For more information, see Obtain the ID of the Alibaba Cloud account that is used to create a DTS task in the Preparations section of this topic.

   6. Click OK.

2. Grant permissions to the RAM role.

   On the page where a role is successfully created

   1. Click Input and Attach.

   2. On the Permissions tab, click Precise Permission.

      

   3. In the Precise Permission panel, select Type to System Policy.

      

   4. Enter a Policy Name. In this example, AliyunDTSRolePolicy is specified.

   5. Click OK.

   6. Click Close in the panel that appears.

   On the Roles page

   1. Go to the Roles page.

      1. Log on to the RAM console using the Alibaba Cloud account to which the destination database belongs.

      2. In the left-side navigation pane, choose Identities > Roles.

         

         Important

         Do not choose Identities > Users, as this will prevent DTS from accessing the database instance, resulting in an error.

      3. Find and click a role that you want to manage on the Roles page.

         

   2. On the Permissions tab, click Precise Permission.

      

   3. In the Precise Permission panel, select Type to System Policy.

      

   4. Enter a Policy Name. In this example, AliyunDTSRolePolicy is specified.

   5. Click OK.

   6. Click Close in the panel that appears.

3. Edit the trust policy of the RAM role.

   On the Trust Policy tab

   1. Click the Trust Policy tab.

      

   2. Click Edit Trust Policy.

   3. Replace the policy text with the following sample code.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   4. Replace the two <Alibaba Cloud account IDs> in the sample code with the ID of the Alibaba Cloud account that is used to create a DTS task.

      Note

      For more information, see Obtain the ID of the Alibaba Cloud account that is used to create a DTS task in the Preparations section of this topic.

   5. Click Save trust policy document.

   On the Roles page

   1. Go to the Roles page.

      1. Log on to the RAM console using the Alibaba Cloud account to which the destination database belongs.

      2. In the left-side navigation pane, choose Identities > Roles.

         

         Important

         Do not choose Identities > Users, as this will prevent DTS from accessing the database instance, resulting in an error.

      3. Find and click a role that you want to manage on the Roles page.

         

   2. Click the Trust Policy tab.

      

   3. Click Edit Trust Policy.

   4. Replace the policy text with the following sample code.

      {
          "Statement": [
              {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                      "RAM": [
                          "acs:ram::<Alibaba Cloud account ID>:root"
                      ],
                      "Service": [
                          "<Alibaba Cloud account ID>@dts.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version": "1"
      }

   5. Replace the two <Alibaba Cloud account IDs> in the sample code with the ID of the Alibaba Cloud account that is used to create a DTS task.

      Note

      For more information, see Obtain the ID of the Alibaba Cloud account that is used to create a DTS task in the Preparations section of this topic.

   6. Click Save trust policy document.