This topic describes the service-linked role of Data Management (DMS)named AliyunServiceRoleForDMS.
Background information
A service-linked role is a Resource Access Management (RAM) role. For more information, see RAM role overview. The service-linked role allows DMS to access other cloud services and implement certain features in some scenarios. For more information, see Service-linked roles.
Scenarios
DMS
You can assume the service-linked role of DMS to allow certain DMS features to access Elastic Compute Service (ECS) instances, virtual private clouds (VPCs), RDS instances, and resources related to various databases and tools.
Service-linked role
AliyunServiceRoleForDMS
Role name: AliyunServiceRoleForDMS.
Policy name: AliyunServiceRolePolicyForDMS.
Role description: The service-linked role allows DMS to access ECS instances, VPCs, RDS instances, and resources related to various databases and tools.
Operations that can be performed:
Query the details of RDS, PolarDB, Lindorm, and other database resources to manage ApsaraDB instances.
Query the details of ECS instances and VPCs to manage self-managed databases hosted on ECS instances and the Internet.
Use Alibaba Cloud services such as Data Transmission Service (DTS) and Database Backup (DBS) to manage data centrally.
Permissions required to create the AliyunServiceRoleForDMS role
DMS
Your RAM user must be granted the required permissions before the AliyunServiceRoleForDMS role is created for DMS.
If your RAM user does not have the required permissions, you must add the following policy and grant permissions to the RAM user. For more information, see Create custom policies and Grant permissions to a RAM user.
The following code shows the policy that allows authorized RAM users to create the AliyunServiceRoleForDMS role for DMS:
{
"Action":"ram:CreateServiceLinkedRole",
"Resource":"*",
"Effect":"Allow",
"Condition":{
"StringEquals":{
"ram:ServiceName": "dms.aliyuncs.com"
}
}
}Create the AliyunServiceRoleForDMS role
DMS
If your RAM user already has the required permissions to create the AliyunServiceRoleForDMS role for DMS, you can log on to the DMS console and click OK in the DMS Service-linked Role dialog box. This way, the system can automatically create the AliyunServiceRoleForDMS role for DMS. For more information, see the Create a service-linked role section of the "Service-linked roles" topic.
View the details of the AliyunServiceRoleForDMS role
DMS
After the AliyunServiceRoleForDMS role is created for DMS, you can view the role details in the RAM console, including the basic information, trust policy, and permissions of the AliyunServiceRoleForDMS role.
Delete the AliyunServiceRoleForDMS role
DMS
Before you delete the AliyunServiceRoleForDMS role, you must remove all instances from the instance list in the DMS console. For more information about how to remove an instance and delete a service-linked role, see Remove one or more instances and Delete a service-linked role.