Cross-region replication (CRR) within the same account allows the automatic and asynchronous (near real-time) replication of Object Storage Service (OSS) objects from a bucket in a region to another bucket in another region within the same Alibaba Cloud account. CRR within the same account replicates operations, such as the creation, overwriting, and deletion of objects, from a source bucket to a destination bucket. This topic describes how to perform CRR within the same account.
Prerequisites
Bucket A, which works as the source bucket of a CRR task, is created in a region within an Alibaba Cloud account. The ID of the Alibaba Cloud account, the name of Bucket A, and the region in which Bucket A is located are recorded.
Bucket B, which works as the destination bucket of the CRR task, is created in another region within the same Alibaba Cloud account. The name of Bucket B and the region in which Bucket B is located are recorded.
Role types
When you perform CRR within the same account, you must specify the role that is used to replicate objects between the source and destination buckets. You can select one of the following RAM roles to perform CRR within the same account.
You can create a RAM role by using a RAM user. The RAM user must have the following permissions: ram:CreateRole
, ram:GetRole
, ram:ListPoliciesForRole
, and ram:AttachPolicyToRole
. However, it is risky to grant a RAM user permissions such as ram:CreateRole
and ram:GetRole
. You can use the Alibaba Cloud account with which the RAM user is associated to create a RAM role and grant the required permissions to the RAM role. Then, the RAM user can assume the RAM role that is created by the Alibaba Cloud account.
(Recommended) New RAM role
When you create a rule to perform CRR within the same account, you can create a RAM role. After you select New RAM Role from the RAM Role Name drop-down list, a RAM role in the oss-replication-{uuid}
format is automatically created and different policies are attached to the role based on whether you set Replicate Objects Encrypted based on KMS to Yes.
Set Replicate Objects Encrypted based on KMS to Yes
After you create the RAM role, follow the on-screen instructions to attach the required policies to the role. Then, the RAM role is attached to the policy to replicate data from the source bucket to the destination bucket and the AliyunKMSFullAccess policy to manage Key Management Service (KMS).
Set Replicate Objects Encrypted based on KMS to No
After you create the RAM role, follow the on-screen instructions to attach the required policies to the role. Then, the RAM role is attached to the policy to replicate data from the source bucket to the destination bucket.
AliyunOSSRole
When you create a rule to perform CRR within the same account, you can select the AliyunOSSRole role to complete the data replication task. After you select AliyunOSSRole, different policies are attached to the AliyunOSSRole role based on whether you set Replicate Objects Encrypted based on KMS to Yes.
Set Replicate Objects Encrypted based on KMS to Yes
After you select AliyunOSSRole, the following policies are automatically attached to the AliyunOSSRole role: AliyunOSSFullAccess (permissions to manage OSS) and AliyunKMSFullAccess (permissions to manage KMS).
WarningThe AliyunOSSRole role has the permissions to perform all operations on all buckets within the current Alibaba Cloud account and KMS. Exercise caution when you use this role.
Set Replicate Objects Encrypted based on KMS to No
After you select AliyunOSSRole, the AliyunOSSFullAccess policy is automatically attached to the AliyunOSSRole role.
WarningThe AliyunOSSRole role has the permissions to perform all operations on all buckets within the current Alibaba Cloud account. Exercise caution when you use this role.
Custom role
When you create a rule to perform CRR within the same account, you can use a custom role to complete the data replication task. You need to create a custom role in the RAM console and attach the required policies to the custom role.
Create a normal service role.
When you create the role, set Select Trusted Entity to Alibaba Cloud Service, Role Type to Normal Service Role, and then Select Trusted Service to OSS. For more information, see Create a regular service role.
Grant permissions to the RAM role.
You can use one of the following methods to grant the permissions to the RAM role:
Attach the required system policy to the RAM role
WarningAttach the
AliyunOSSFullAccess
system policy to the RAM role. The RAM role to which theAliyunOSSFullAccess
system policy is attached has the permissions to perform all operations on all buckets within the current Alibaba Cloud account. Proceed with caution when you attach the system policy to the RAM role.If you want to replicate objects encrypted by KMS to the destination bucket, you must attach the
AliyunKMSFullAccess
system policy to the RAM role.For more information, see Grant permissions to a RAM role.
Attach a custom policy to the RAM role
You can attach a custom policy to the RAM role to grant the role the minimum permissions required to perform CRR on the source bucket and the destination bucket.
NoteReplace src-bucket and dest-bucket with the name of the source bucket and the name of the destination bucket based on your business requirements.
{ "Version":"1", "Statement":[ { "Effect":"Allow", "Action":[ "oss:ReplicateList", "oss:ReplicateGet" ], "Resource":[ "acs:oss:*:*:src-bucket", "acs:oss:*:*:src-bucket/*" ] }, { "Effect":"Allow", "Action":[ "oss:ReplicateList", "oss:ReplicateGet", "oss:ReplicatePut", "oss:ReplicateDelete" ], "Resource":[ "acs:oss:*:*:dest-bucket", "acs:oss:*:*:dest-bucket/*" ] } ] }
For more information, see Grant permissions to a RAM role.
NoteIf you want to replicate objects encrypted by KMS to the destination bucket, you must attach the
AliyunKMSFullAccess
system policy to the RAM role.