Cross-account backup

(Optional) Step 1: Set a delegated administrator account

If you want to use a member account from a resource directory as the management account, you must first designate it as a delegated administrator account for Cloud Backup. You can do this from the Trusted Service page of the Resource Management console. For more information, see Manage delegated administrator accounts.

1. Log on to the Resource Management console by using the management account of your resource directory.

2. In the left-side navigation pane, choose Resource Directory > Trusted Services.

3. On the Trusted Services page, find Cloud Backup and click Manage in the Actions column.

4. In the Delegated Administrator Account section, click Add.

5. In the Add Delegated Administrator Account panel, select the member account that you want to set as the management account.

6. Click OK.

   After the account is added, Cloud Backup appears as a trusted service when you log on to the Resource Management console with the delegated administrator account.

Step 2: Add the account to be backed up

1. Log on to the Cloud Backup console by using the management account.

2. In the left-side navigation pane, choose Backup > Cross-Account Backup.

3. On the Cross-Account Backup page, switch to the region where the resources of the account to be backed up are located.

4. Click Add the account to be backed up.

5. In the Add the account to be backed up panel, configure the following parameters and then click OK.

   Parameter	Description
   Cross-account type	Select Based on Resource Directory.
   Select an account to be backed up	Select an account from the resource directory. Select one account at a time. You can search by keyword.

   Note

   For accounts that are already in a resource directory, we recommend using the Resource Directory-based method. However, you can also use the RAM role-based method if needed. For more information, see Add an account by using RAM role assumption.

   After the account is added, it appears in the account list. When an account is managed for the first time, Cloud Backup automatically creates the AliyunServiceRoleForHbrRd service-linked role:

   • Role name: AliyunServiceRoleForHbrRd

   • Permission policy: AliyunServiceRolePolicyForHbrRd

   • Permission description: Allows the backup service to access resources in other authorized accounts for cross-account backup and restore.

Step 1: Create a service-linked role

You need to authorize the management account by creating the AliyunServiceRoleForHbrCrossAccountBackup service-linked role.

• Role Name: AliyunServiceRoleForHbrCrossAccountBackup

• Permission Policy: AliyunServiceRolePolicyForHbrCrossAccountBackup

• Permission Description: Allows the backup service to access resources in other authorized accounts for cross-account backup and restore.

1. Log on to the Cloud Backup console by using the management account.

2. In the left-side navigation pane, choose Backup>Cross-Account Backup.

3. On the Cross-Account Backup page, select the region where the resources to be backed up are located.

4. Click Add the account to be backed up. In the Add the account to be backed up panel, select RAM Role Assumption for the Cross Account Type.

5. In the Cloud Backup Authorization dialog box, click OK.

   For more information, see Service-linked roles for Cloud Backup.

Step 2: Create a RAM role

1. Log on to the RAM console by using the account to be backed up.

2. In the left-side navigation pane, choose Identity Management > Roles.

3. On the Roles page, click Create Role.

4. On the Create Role page, for Principal Type, select Cloud Account. For Principal Name, select Other Account, enter the management account ID, and then click OK.

   Note

   You can go to the Security Settings page to view your Alibaba Cloud account ID.

5. In the Create Role dialog box, enter a name for the RAM role, such as hbrcrossrole, and then click OK.

Step 3: Grant permissions to the RAM role

The following steps show how to grant the AliyunHBRRolePolicy policy to the hbrcrossrole RAM role:

1. Log on to the RAM console by using the account to be backed up.

2. In the left-side navigation pane, choose Identity Management > Roles.

3. Find the target RAM role hbrcrossrole and go to its details page.

4. On the Permissions tab, click Precise Permission.

5. In the Precise Permission panel, select System Policy as the permission type. Enter AliyunHBRRolePolicy in the search box, select the policy, and then click OK.

6. After the authorization is successful, click Close.

7. Modify the trust policy of the RAM role.

   1. On the role details page, click the Trust Policy tab.

   2. Click Edit Trust Policy.

   3. Click the JSON Editor tab and replace the existing policy with the following code. Replace management_account_id with the ID of your management account.

      This policy allows the management account to obtain a temporary token through Cloud Backup to access the resources of the account to be backed up.

      {
       "Statement": [
           {
               "Action": "sts:AssumeRole",
               "Effect": "Allow",
               "Principal": {
                   "RAM": [
                       "acs:ram::management_account_id:role/AliyunServiceRoleForHbrCrossAccountBackup"
                   ]
               }
           }
       ],
       "Version": "1"
      }

   4. Click OK.

Step 4: Add the account to be backed up

1. Log on to the Cloud Backup console by using the management account.

2. In the left-side navigation pane, choose Backup>Cross-Account Backup.

3. On the Cross-Account Backup page, select the region where the resources to be backed up are located.

   Important

   You must add the account in the same region as its resources (ECS files, NAS, OSS, Tablestore, ECS databases, or ECS instances). Otherwise, Cloud Backup cannot find the resources, and backup plans or jobs will fail.

4. Click Add the account to be backed up. In the Add the account to be backed up panel, set Cross-account Type to RAM Role Assumption, configure the following parameters, and then click OK.

   Parameter	Description
   Cross-account type	Select RAM Role Based. If your management account is a delegated administrator for Cloud Backup in Resource Directory, we recommend that you see Add an account by using Resource Directory.
   Alibaba Cloud Account ID	Enter the ID of the account to be backed up.
   Role Name	Enter the name of the RAM role created by the account to be backed up, such as hbrcrossrole. Important Click Check Permissions to verify your authorization settings. If an error is reported, review your configuration and try again. If the check is successful, the message You are authorized to access the resources of this role. is displayed.
   Account Alias	Enter an alias for the account to help you identify it easily. We recommend using the name of the Alibaba Cloud account to be backed up.

Is the cross-account backup feature free?

Yes, the feature itself is free. However, the management account is billed for backup and restore operations, while the account being backed up is billed for services like snapshot services (for ECS instance backups) and OSS requests. For more information, see Billing.

Cross-account replication vs. cross-account backup

• Cross-account replication of backup vaults: This feature lets a source account replicate its existing backup data to another Alibaba Cloud account. Both accounts then hold a copy of the data, which is useful for data redundancy or sharing data across accounts.

• Cross-account backup: This feature lets a management account centrally define backup policies and manage backup data for multiple accounts. The backup data is stored in the management account, and only the management account can view or manage it. This is used for centralized data governance.

Both methods are widely used for enterprise data security and compliance, and both support data isolation for accounts within or outside a resource directory. Choose the method that best fits your needs, or use them together to achieve both centralized management and data redundancy.