ApsaraDB RDS:Use the zero-ETL feature

ApsaraDB RDS for MySQL to ApsaraDB for ClickHouse

1. Create the AliyunServiceRoleForClickHouseZeroETL service-linked role.

   Note

   When you create a task and click the instance ID drop-down list, a message indicating that you must create the AliyunServiceRoleForClickHouseZeroETL role is displayed. The system automatically creates the role. No manual operations are required.

2. Grant a RAM user management permissions.

   To allow a RAM user to create zero-ETL tasks, you must grant the RAM user the following permissions. For more information, see Create custom policies.

   • Permissions on the RDS instance: You must attach the AliyunRDSFullAccess policy to the RAM user.

   • Permissions on the ApsaraDB for ClickHouse cluster: You must attach the custom policy to the RAM user. The following script describes the custom policy:

     {
         "Version": "1",
         "Statement": [
             {
                 "Action": "clickhouse:*",
                 "Resource": "*",
                 "Effect": "Allow"
             },
             {
                 "Action": "ram:CreateServiceLinkedRole",
                 "Resource": "*",
                 "Effect": "Allow",
                 "Condition": {
                     "StringEquals": {
                         "ram:ServiceName": "clickhouse.aliyuncs.com"
                     }
                 }
             }
         ]
     }

   • Permissions on Data Transmission Service (DTS): You must attach the custom policy to the RAM user. The following script describes the custom policy:

     {
         "Version": "1",
         "Statement": [
             {
                 "Action": "dts:*",
                 "Resource": "*",
                 "Effect": "Allow"
             },
             {
                 "Action": "ram:PassRole",
                 "Resource": "*",
                 "Effect": "Allow",
                 "Condition": {
                     "StringEquals": {
                         "acs:Service": "dts.aliyuncs.com"
                     }
                 }
             }
         ]
     }

ApsaraDB RDS for MySQL to AnalyticDB for MySQL 3.0

1. Create the AliyunServiceRoleForAnalyticDBForMySQL service-linked role.

   1. Log on to the RAM console. In the left-side navigation pane, click Roles. Check whether a service-linked role named AliyunServiceRoleForAnalyticDBForMySQL exists in the role list. If the service-linked role does not exist, create the role.

   2. In the upper-left corner of the page that appears, click Create Role.

   3. In the Select Role Type step, select Alibaba Cloud Service and click Next.

   4. Set the Role Type parameter to Service Linked Role and the Select Service parameter to AnalyticDB for MySQL.

   5. Click OK. Return to the Roles page and check whether the service-linked role is created.

2. Grant a RAM user management permissions.

   You can grant a RAM user permissions on all or specific ApsaraDB RDS for MySQL instances and AnalyticDB for MySQL clusters. For more information, see Create custom policies.

   The following section describes the scripts of custom policies:

   Grant permissions on all RDS instances and the AnalyticDB for MySQL cluster

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "dts:*",
               "Resource": [
                   "acs:adb:*:*:*",
                   "acs:rds:*:*:*"
               ]
           },
           {
               "Effect": "Allow",
               "Action": [
                   "dts:DescribeRegions",
                   "dts:DescribeConfigRelations",
                   "dts:DescribeSrcLinkConfig",
                   "dts:DescribeDestLinkConfig",
                   "dts:DescribeLinkConfig",
                   "dts:DescribeConciseJobStatics",
                   "dts:ListUserAuthorizationLogs",
                   "dts:CreateUserAuthorization"
               ],
               "Resource": [
                   "acs:dts:*:*:*"
               ]
           }
       ]
   }

   Grant permissions on specific RDS instances and the AnalyticDB for MySQL cluster

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "dts:*",
               "Resource": [
                   "acs:adb:*:*:dbcluster/am-2zeod8ax4b9a****", Use the ID of the AnalyticDB for MySQL cluster to be synchronized.
                   "acs:rds:*:*:dbinstance/rm-2ze6fs8ouh43****", Use the ID of the RDS instance to be synchronized.
               ]
           },
           {
               "Effect": "Allow",
               "Action": [
                   "dts:DescribeRegions",
                   "dts:DescribeConfigRelations",
                   "dts:DescribeSrcLinkConfig",
                   "dts:DescribeDestLinkConfig",
                   "dts:DescribeLinkConfig",
                   "dts:DescribeConciseJobStatics",
                   "dts:ListUserAuthorizationLogs",
                   "dts:CreateUserAuthorization"
               ],
               "Resource": "acs:dts:*:*:*"
           }
       ]
   }

ApsaraDB RDS for MySQL to AnalyticDB for PostgreSQL

1. Create a service-linked role named AliyunServiceRoleForADBPG.

   1. Log on to the RAM console. In the left-side navigation pane, click Roles. On the page that appears, check whether the AliyunServiceRoleForADBPG service-linked role exists. If the service-linked role does not exist, create the role.

   2. In the upper-left corner of the page that appears, click Create Role.

   3. In the Select Role Type step, select Alibaba Cloud Service and click Next.

   4. Set the Role Type parameter to Service Linked Role and the Select Service parameter to AnalyticDB for PostgreSQL.

   5. Click OK. Return to the Roles page and check whether the service-linked role is created.

2. Grant a RAM user management permissions.

   You can grant a RAM user permissions on all or specific ApsaraDB RDS for MySQL instances and AnalyticDB for PostgreSQL clusters. For more information, see Create custom policies.

   The following section describes the scripts of custom policies:

   Grant permissions on all RDS instances and the AnalyticDB for PostgreSQL cluster

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "dts:*",
               "Resource": [
                   "acs:gpdb:*:*:*",
                   "acs:rds:*:*:*"
               ]
           },
           {
               "Effect": "Allow",
               "Action": [
                   "dts:DescribeRegions",
                   "dts:DescribeConfigRelations",
                   "dts:DescribeSrcLinkConfig",
                   "dts:DescribeDestLinkConfig",
                   "dts:DescribeLinkConfig"
               ],
               "Resource": [
                   "acs:gpdb:*:*:*"
               ]
           }
       ]
   }

   Grant permissions on specific RDS instances and the AnalyticDB for PostgreSQL cluster

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "dts:*",
               "Resource": [
                   "acs:gpdb:*:*:dbinstanc/gp-bp1a740l3zx4****", Use the ID of the AnalyticDB for PostgreSQL cluster to be synchronized.
                   "acs:rds:*:*:dbinstance/rm-2ze6fs8ouh43****", Use the ID of the RDS instance to be synchronized.
               ]
           },
           {
               "Effect": "Allow",
               "Action": [
                   "dts:DescribeRegions",
                   "dts:DescribeConfigRelations",
                   "dts:DescribeSrcLinkConfig",
                   "dts:DescribeDestLinkConfig",
                   "dts:DescribeLinkConfig"
               ],
               "Resource": "acs:dts:*:*:*"
           }
       ]
   }