Same-region replication (SRR) within the same account allows the automatic and asynchronous (near real-time) replication of Object Storage Service (OSS) objects from a bucket in a region to another bucket in the same region within the same Alibaba Cloud account. SRR within the same account replicates operations, such as the creation, update, and deletion of objects, from a source bucket to a destination bucket. This topic describes how to perform SRR within the same account.
Prerequisites
Bucket A, which works as the source bucket of an SRR task, is created in a region within an Alibaba Cloud account. The ID of the Alibaba Cloud account, the name of Bucket A, and the region in which Bucket A is located are recorded.
Bucket B, which works as the destination bucket of the SRR task, is created in the same region within the same Alibaba Cloud account. The name of Bucket B is recorded.
Role types
When you perform SRR within the same account, you must specify the role that is used to replicate objects from the source bucket to the destination bucket. You can select one of the following roles to perform SRR within the same account.
You can create a RAM role by using a RAM user. The RAM user must have the following permissions: ram:CreateRole
, ram:GetRole
, ram:ListPoliciesForRole
, and ram:AttachPolicyToRole
. However, it is risky to grant a RAM user the permissions such as ram:CreateRole
and ram:GetRole
. You can use the Alibaba Cloud account with which the RAM user is associated to create a RAM role and grant the required permissions to the RAM role. Then, the RAM user can assume the RAM role that is created by the Alibaba Cloud account.
(Recommended) New RAM role
When you create a rule to perform SRR within the same account, you can create a RAM role. After you select New RAM Role from the RAM Role Name drop-down list, a RAM role in the oss-replication-{uuid}
format is automatically created and different policies are attached to the role based on whether you set Replicate Objects Encrypted based on KMS to Yes.
Set Replicate Objects Encrypted based on KMS to Yes
After you create the RAM role, follow the on-screen instructions to attach the required policies to the role. Then, the RAM role is attached to the policy to replicate data from the source bucket to the destination bucket and the AliyunKMSFullAccess policy to manage Key Management Service (KMS).
Set Replicate Objects Encrypted based on KMS to No
After you create the RAM role, follow the on-screen instructions to attach the required policies to the role. Then, the RAM role is attached to the policy to replicate data from the source bucket to the destination bucket.
AliyunOSSRole
When you create a rule to perform SRR within the same account, you can select the AliyunOSSRole role to complete the data replication task. After you select AliyunOSSRole, different policies are attached to the AliyunOSSRole role based on whether you set Replicate Objects Encrypted based on KMS to Yes.
Set Replicate Objects Encrypted based on KMS to Yes
After you select AliyunOSSRole, the following policies are automatically attached to the AliyunOSSRole role: AliyunOSSFullAccess (permissions to manage OSS) and AliyunKMSFullAccess (permissions to manage KMS).
WarningThe AliyunOSSRole role has the permissions to perform all operations on all buckets within the current Alibaba Cloud account and KMS. Exercise caution when you use this role.
Set Replicate Objects Encrypted based on KMS to No
After you select AliyunOSSRole, the AliyunOSSFullAccess policy is automatically attached to the AliyunOSSRole role.
WarningThe AliyunOSSRole role has the permissions to perform all operations on all buckets within the current Alibaba Cloud account. Exercise caution when you use this role.
Custom role
When you create a rule to perform SRR within the same account, you can use a custom role to complete the data replication task. You need to create a custom role in the RAM console and attach the required policies to the custom role.
Create a normal service role.
When you create the role, set Select Trusted Entity to Alibaba Cloud Service, Role Type to Normal Service Role, and then Select Trusted Service to OSS. For more information, see Create a regular service role.
Grant permissions to the RAM role.
You can use one of the following methods to grant the permissions to the RAM role:
Attach the required system policy to the RAM role
WarningAttach the
AliyunOSSFullAccess
system policy to the RAM role. The RAM role to which theAliyunOSSFullAccess
system policy is attached has the permissions to perform all operations on all buckets within the current Alibaba Cloud account. Exercise caution when you attach the system policy to the RAM role.If you want to replicate objects encrypted by KMS to the destination bucket, you must attach the
AliyunKMSFullAccess
system policy to the RAM role.For more information, see Grant permissions to a RAM role.
Attach a custom policy to the RAM role
We recommend that you attach a custom RAM policy to grant the RAM role the minimum permissions required to perform SRR within the same account on the source and destination buckets.
NoteReplace src-bucket and dest-bucket with the name of the source bucket and the name of the destination bucket based on your business requirements.
{ "Version":"1", "Statement":[ { "Effect":"Allow", "Action":[ "oss:ReplicateList", "oss:ReplicateGet" ], "Resource":[ "acs:oss:*:*:src-bucket", "acs:oss:*:*:src-bucket/*" ] }, { "Effect":"Allow", "Action":[ "oss:ReplicateList", "oss:ReplicateGet", "oss:ReplicatePut", "oss:ReplicateDelete" ], "Resource":[ "acs:oss:*:*:dest-bucket", "acs:oss:*:*:dest-bucket/*" ] } ] }
For more information, see Grant permissions to a RAM role.
NoteIf you want to replicate objects encrypted by KMS to the destination bucket, you must attach the
AliyunKMSFullAccess
system policy to the RAM role.