AliyunServiceRoleForDMS is the service-linked role for Data Management. This topic describes what the service-linked role can do and how to create and delete the service-linked role.
Background information
DMS service-linked role is a Resource Access Management (RAM) role. DMS can assume this role to access other cloud services and implement certain features. For more information about service-linked roles, see Service-linked roles.
Scenarios
DMS can assume the service-linked role to access Elastic Compute Service (ECS) instances, virtual private clouds (VPCs), RDS instances, and resources related to various databases and tools and implement certain features.
Description of the AliyunServiceRoleForDMS role
Role name: AliyunServiceRoleForDMS.
Policy name: AliyunServiceRolePolicyForDMS.
Role description: The service-linked role allows DMS to access ECS instances, VPCs, RDS instances, and resources related to various databases and tools.
Operations that can be performed:
Query the details of RDS, PolarDB, ApsaraDB for Lindorm, and other database resources to manage ApsaraDB instances.
Query the details of ECS instances and VPCs to manage self-managed databases hosted on ECS instances and the Internet.
Use Alibaba Cloud services such as Data Transmission Service (DTS) and Database Backup (DBS) to manage data centrally.
Permissions required to create the service-linked role
RAM identities must be granted the required permissions before the RAM identities can create the service-linked role for DMS.
If your RAM user does not have the required permissions, you must add the following policy and grant permissions to the RAM user. For more information about how to add a policy and how to grant permissions to a RAM user, see Create a custom policy and Grant permissions to the RAM user.
The following code shows the policy that allows authorized RAM identities to create the service-linked role for DMS:
{
"Action":"ram:CreateServiceLinkedRole",
"Resource":"*",
"Effect":"Allow",
"Condition":{
"StringEquals":{
"ram:ServiceName": "dms.aliyuncs.com"
}
}
}Create the service-linked role
If your RAM user already has the required permissions, you can directly create the service-linked role for DMS. Log on to the DMS console, and in the DMS Service-linked Role dialog box, click OK. Then, the system can automatically create the service-linked role for DMS. For more information about how to create a service-linked role, see Create a service-linked role.
Delete the service-linked role
Before you delete the AliyunServiceRoleForDMS role, you must remove all instances from the instance list in the DMS console. For more information about how to remove an instance and how to delete a service-linked role, see Remove database instances and Delete a service-linked role.