Cross-account access configuration-DataWorks(DataWorks)-阿里云帮助中心

If the data source type is set to Alibaba Cloud instance mode and the instance belongs to a different Alibaba Cloud account, you must grant the account that owns the synchronization task read permission on the instance before data synchronization can proceed.

Background

When you add a data source in Alibaba Cloud instance mode and the instance belongs to a different account than the one used for DataWorks Data Integration, you must configure cross-account authorization.

Prerequisite

A network connection must exist between the data source instance's VPC and the DataWorks resource group, for example, through Cloud Enterprise Network (CEN). For more information, see Network connectivity solutions.

Procedure

Complete the following steps to configure cross-account authorization:

Actions on the data source account

Log on to the RAM console and create a RAM role. For more information, see Create a RAM role for a trusted Alibaba Cloud account.

Key parameters:
- Principal Type: Select Cloud Account.
- Role Name: Enter a custom name.
- Principal Name: Select Another Alibaba Cloud Account, and then enter the UID of the Alibaba Cloud account that owns the DataWorks workspace.

Grant the required permissions to the newly created RAM role. For more information, see Grant permissions to a RAM role.

Key parameters:

Permission Policy: Select System Policy.

Policy Name: Select a policy based on the instance type as described in the following table.

Instance type	Policy name
RDS (MySQL, SQL Server, PostgreSQL, MariaDB)	AliyunDataWorksAccessingRdsReadOnlyPolicy
Hive	AliyunDataWorksAccessingDLFReadOnlyPolicy, AliyunDataWorksAccessingEMRReadOnlyPolicy
Kafka	AliyunDataWorksAccessingAlikafkaPolicy
AnalyticDB for MySQL 3.0	AliyunADBReadOnlyAccess

Modify the trust policy of the newly created RAM role. For more information, see Modify the trusted entity of a RAM role to an Alibaba Cloud account.

Trust policy:

{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "<Alibaba Cloud account ID of the DataWorks user>@cdp.aliyuncs.com"
                ]
            }
        }
    ],
    "Version": "1"
}

Note

Replace <Alibaba Cloud account ID of the DataWorks user> with the UID of the Alibaba Cloud account that owns your DataWorks workspace.

Actions on the DataWorks account

Log on to the DataWorks console. In the target region, click Data Integration > Data Integration in the left-side navigation pane. Select a workspace from the drop-down list and click Go to Data Integration.

Add an RDS, Hive, or Kafka data source.

Key parameters:

Parameter	Description
Data Source Type	ApsaraDB for RDS.
Instance Owner	Select Another Alibaba Cloud Account or Other Alibaba Cloud Account. Note Select an option based on the data source configuration.
UID of Another Alibaba Cloud Account	Enter the UID of the Alibaba Cloud account that owns the RDS, Hive, or Kafka instance.
RAM Role Name	Enter the name of the RAM role that you created.

Test the connectivity.