Data Management (DMS) provides three control modes — Flexible Management, Stable Change, and Security Collaboration — to govern how database instances are accessed, changed, and audited. Assign a control mode to each instance based on your team size, security requirements, and change governance needs.
Choose a control mode
The three modes are ordered from lowest to highest in terms of security level, governance over R&D and change processes, team scale, feature breadth, and cost.
| Control mode | Best for | Billing |
|---|---|---|
| Flexible Management | Single-user or low-governance environments where tickets don't require approval | Free |
| Stable Change | Small teams requiring high availability, lock-free changes, and SQL review | Paid (subscription or pay-as-you-go) |
| Security Collaboration | Large teams requiring enterprise-grade security, compliance, and customizable DevOps workflows | Paid (subscription or pay-as-you-go) |
Flexible Management supports visualized data and schema management for 30+ database types. Run SQL statements or use point-and-click operations directly on the SQL Console. Data management features have some limits.
Stable Change includes everything in Flexible Management, with relaxed feature limits and additional stability tools such as lock-free changes and SQL review.
Security Collaboration includes everything in Flexible Management and Stable Change, plus the DevOps feature for customizing design specifications, R&D processes, and approval workflows.
For pricing details, see Billable items and prices and Purchase the DMS service.
Configure the control mode of an instance
Register an instance and set its control mode
NoteWhen registering an instance as a DMS administrator or database administrator (DBA), enable security hosting for the instance. With security hosting enabled, the DMS administrator, DBA, and regular users can log on without passwords.
Change the control mode of an instance
NoteChanging from Flexible Management to Stable Change or Security Collaboration incurs fees. See Pricing. Before changing modes, verify that the change does not affect your business — feature availability differs across modes (see the feature matrix below).
Features supported by each control mode
Category | Feature | Flexible Management | Stable Change | Security Collaboration |
Instance management | Requires a database account and password. Note If security hosting is enabled for the instance, you do not need to use the account and password. For more information, see Enable security hosting. | Uses Alibaba Cloud account authentication. You do not need to use the database account and password. | ||
Yes | Yes | Yes. | ||
N Note If security hosting is enabled for the instance, you can manage instance permissions. For more information, see Enable security hosting. | Yes | |||
Yes | Yes: Must be configured one by one. | Yes: Can be enabled globally and restricted to office network access. | ||
N | No | Yes | ||
Resource authorization granularity | Instance-level authorization and database account access. Note If security hosting is enabled for the instance, permissions on databases, tables, fields, and rows are supported. For more information, see Enable security hosting. | On-demand permissions for databases, tables, fields, and rows. | ||
Operation authorization granularity | - | Feature-level authorization | Query, export, and change. | |
Authorization period | - | - | Customizable period. Permissions are automatically recycled upon expiration. | |
Row-level permission management | N | N | Yes | |
Data export | Yes | Yes | Yes | |
Yes | Yes | Yes | ||
Export to OSS | Yes | Yes | Yes | |
Permission verification and approval flow | - | - | Yes | |
Daily limit on free row exports | 1 million rows | 20 million rows | Unlimited | |
Limit on the number of tables per export | Unlimited | Unlimited | Unlimited | |
Limit on the capacity of tables per export | 10 GB | Unlimited | Unlimited | |
Security and Specifications | Yes: You can view log data within one day. | Y: You can access and view log data at any time during the 3 year retention period. | ||
Y | Y | Y | ||
Y | Y | Y | ||
Y: Paid feature. Fine-grained access control is not supported. | Y: Paid feature. Fine-grained access control is not supported. | Y: Paid feature included in Sensitive Data Management. | ||
N | N | Y | ||
Y | Y | N | ||
Data classification and grading | Y: A paid feature included in Sensitive Data Management. | Y: A paid feature included in Sensitive Data Management. | Y: A paid feature included in Sensitive Data Management. | |
Schema evolution | N | N | Y | |
Y | Y | Y | ||
Y | Y | Y | ||
N | Y | Y | ||
Data modification | N | Y | Y | |
N | Y | Y | ||
N | Y | Y | ||
Y | Y | Y | ||
Y | Y | Y | ||
Pre-change Fraud Detection | N | Y | Y | |
Post-change threat control | N | Y | Y | |
Database stability | Binlogs from the last hour. | No limit. Supports batch downloads. | Unlimited. Supports batch downloads. | |
Yes, you can configure approval rules, but not flow approvals. | Y: Supports setting approval rules. Approval flows are not supported. | Y: Supports configuring approval rules and approval flows. | ||
Operations management | N | N | Y | |
N | N | Y | ||
R&D efficiency | Collaborative development | N | N | Y |
Cross-instance query | N | N | Y | |
Automatic test data generation | A single operation can contain a maximum of one million lines. | Yes. A single operation is limited to 100 million rows. | The quota for a single operation is 100 million rows. | |
Development flow approval | N | N | Y: Customizable as needed | |
Logical database configuration | N | N | Y | |
Batch operations | Y | Y | Y | |
Auto-triggered task scheduling in Data Development | N | N | Y | |
SQL window | Y | - | Y | |
N Note Super SQL Mode is available if security hosting is enabled for the instance. To enable security hosting, see Enable security hosting. | Y | Y | ||
Y | Y | Y | ||
Y | Y | Y | ||
N | N | Y | ||
Y | Y | Yes. This is supported after the cross-database query feature is enabled. | ||
Y | Y | Y | ||
Y | Y | Y | ||
SQL command | Y | Y | Y | |
Copy SQL result set | Y | Y | Y | |
Execution plan | Y | Y | Y | |
Character set switch | Y | Y | Y | |
Break on SQL query timeout | N | N | Y | |
Daily query row limit | N | N | Y | |
Daily query limit | N | N | Y | |
Saved Queries | Y | Y | Y | |
Full table scan limit for large tables | N | N | Y | |
Maximum rows per query | 3,000 rows. Supports pagination. | 3,000 rows. Supports pagination. | 3,000 rows. Customizable as needed. Pagination is configurable. | |
Visualization of data query results | Y | Y | Y | |
SQL format | Y | Y | Y | |
SQL code hinting | Y | Y | Y | |
Table schema management | Table schema comparison | Y | Y | Y |
Table schema editing | Y | Y | Y | |
Table schema synchronization | Y | Y | Y | |
Data dictionary export | 5 | Unlimited | Unlimited | |
Table schema design guidelines | N | N | Y | |
Table schema development flow | N | N | Supports access across different Alibaba Cloud accounts, databases, and self-managed databases. | |
Retains 3 database versions. | Retains 20 database versions. | Retains 50 database versions. | ||
Code generator | N | N | Y | |
Sync dictionary | N | N | Y | |
Topology | - | - | Y | |
Instance management
| Feature | Flexible Management | Stable Change | Security Collaboration |
|---|---|---|---|
| Instance logon | Database account and password required ¹ | Password-free logon via Alibaba Cloud account | Password-free logon via Alibaba Cloud account |
| Data dictionary synchronization | Y | Y | Y |
| Instance permission management | N ¹ | Y | Y |
| Access IP whitelist | Y | Y — source IPs controlled individually | Y — globally enabled over office networks only |
| Metadata access control | N | N | Y |
| Resource authorization granularity | Database account level ¹ | Databases, tables, columns, and rows | Databases, tables, columns, and rows |
| Operation authorization granularity | — | Feature-level | Query, export, change, and design operations per table |
| Authorization period | — | — | Customizable; permissions auto-revoked on expiry |
| Row-level data permission management | N | N | Y |
¹ If security hosting is enabled, database accounts and passwords are not required for logon, instance permission management is supported, and resource authorization granularity extends to databases, tables, columns, and rows. See Enable security hosting.
Data export
| Feature | Flexible Management | Stable Change | Security Collaboration |
|---|---|---|---|
| SQL result set export | Y | Y | Y |
| Database export | Y | Y | Y |
| Permission verification and process approval | — | — | Y |
| Max rows exported for free per day | 1 million | 20 million | Unlimited |
| Max tables per export | Unlimited | Unlimited | Unlimited |
| Max capacity per export | 10 GB | Unlimited | Unlimited |
Security and specifications
| Feature | Flexible Management | Stable Change | Security Collaboration |
|---|---|---|---|
| Operation audit | Previous day's logs only | Logs retained for 3 years, accessible anytime | Logs retained for 3 years, accessible anytime |
| Data watermark | Y | Y | Y |
| Sensitive data management | Y — charged; fine-grained permission management not supported | Y — charged; fine-grained permission management not supported | Y — charged; enable in the Sensitive Data module |
| Security rule management | N | N | Y |
| Database clone | Y | Y | N |
| Data classification | Y — charged; enable in the Sensitive Data module | Y — charged; enable in the Sensitive Data module | Y — charged; enable in the Sensitive Data module |
Schema change
| Feature | Flexible Management | Stable Change | Security Collaboration |
|---|---|---|---|
| Schema design | N | N | Y |
| Schema synchronization | Y | Y | Y |
| Shadow table synchronization | Y | Y | Y |
| Lock-free DDL operations | N | Y | Y |
Data change
| Feature | Flexible Management | Stable Change | Security Collaboration |
|---|---|---|---|
| Normal data change | N | Y | Y |
| Lock-free DML operations | N | Y | Y |
| Historical data deletion | N | Y | Y |
| Programmable object change | Y | Y | Y |
| Data import | Y | Y | Y |
| Risk identification before changes | N | Y | Y |
| Risk management after changes | N | Y | Y |
Database stability
| Feature | Flexible Management | Stable Change | Security Collaboration |
|---|---|---|---|
| Data tracking | Binary logs from the previous 1 hour only | Unlimited; batch download supported | Unlimited; batch download supported |
| SQL review | Review rule configuration supported; process approvals not supported | Review rule configuration supported; process approvals not supported | Review rule configuration and process approvals supported |
O&M management
| Feature | Flexible Management | Stable Change | Security Collaboration |
|---|---|---|---|
| Database grouping | N | N | Y |
| Metadata access control | N | N | Y |
R&D efficiency
| Feature | Flexible Management | Stable Change | Security Collaboration |
|---|---|---|---|
| Collaborative R&D | N | N | Y |
| Cross-instance query | N | N | Y |
| Automatic test data generation | Max 1 million rows | Max 100 million rows | Max 100 million rows |
| R&D process approval | N | N | Y — customizable approval workflows |
| Logical database configuration | N | N | Y |
| Operations on multiple tables | Y | Y | Y |
| Scheduling recurring data development tasks | N | N | Y |
SQL Console
| Feature | Flexible Management | Stable Change | Security Collaboration |
|---|---|---|---|
| Schema query and change | Y | — | Y |
| Super SQL mode | N ² | Y | Y |
| Schema version management | Y | Y | Y |
| Field sensitivity level adjustment | Y | Y | Y |
| Data quality check | N | N | Y |
| Cross-database query | Y | Y | Y — requires cross-database query feature to be enabled |
| Database performance diagnosis and optimization | Y | Y | Y |
| SQL statements | Y | Y | Y |
| SQL result set copies | Y | Y | Y |
| Execution plans | Y | Y | Y |
| Character set change | Y | Y | Y |
| SQL query timeout and interruption | N | N | Y |
| Daily query row limit | N | N | Y |
| Daily query count limit | N | N | Y |
| Frequently used SQL statement management | Y | Y | Y |
| Full-table scan table size threshold | N | N | Y |
| Max rows returned per query | 3,000 rows; pagination supported | 3,000 rows; pagination supported | 3,000 rows; pagination optional |
| Visualization of query results | Y | Y | Y |
| SQL formatting | Y | Y | Y |
| Intelligent SQL prompts | Y | Y | Y |
² If security hosting is enabled, Super SQL mode is supported. See Enable security hosting.
Schema management
| Feature | Flexible Management | Stable Change | Security Collaboration |
|---|---|---|---|
| Schema comparison | Y | Y | Y |
| Schema editing | Y | Y | Y |
| Table schema synchronization | Y | Y | Y |
| Max data dictionaries exported | 5 | Unlimited | Unlimited |
| Table schema design specifications | N | N | Y |
| R&D process for table schemas | N | N | Tables created by other accounts, in other databases, and in self-managed databases |
| Schema version management | 3 versions retained | 20 versions retained | 50 versions retained |
| Code generator | N | N | Y |
| Data dictionary synchronization | N | N | Y |
| Topology | — | — | Y |
Legend: Y = supported, N = not supported, — = not applicable
FAQ
Can multiple instances share the same Security Collaboration quota?
Yes, but not at the same time. After DMS completes data or schema changes on an instance in Security Collaboration mode, the DMS administrator or DBA can switch that instance back to Flexible Management, then switch another instance to Security Collaboration.
Can I run UPDATE or DELETE statements directly on the SQL Console for Stable Change instances?
No. Direct data modification via the SQL Console is not supported for instances in Stable Change mode. Submit a ticket instead. See Lock-free data changes and Lock-free schema changes.
Can I switch a paid instance back to its original control mode?
Yes. See Change the control mode of an instance.