How to authorize a RAM user to manage DTS with a custom policy-Data Transmission Service(DTS)-阿里云帮助中心

Prerequisites

You must grant the RAM user permissions to access cloud resources, such as ApsaraDB for RDS and ECS instances, that belong to your Alibaba Cloud account. This allows DTS to retrieve information about related cloud resources when configuring a DTS task. For more information, see Authorize DTS to access cloud resources.

Limitations

You cannot use a RAM user to configure a data synchronization task if the destination is a MaxCompute project. You must use your Alibaba Cloud account to configure this type of task.
When you configure a DTS task as a RAM user, if the database is accessed through Database Gateway (DG) or Cloud Enterprise Network (CEN), you must also grant the AliyunDGFullAccess (full access to Database Gateway (DG)) or AliyunCENFullAccess (full access to CEN) policy to the RAM user.

Step 1: Create a custom policy

Log in to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Permissions > Policies.
On the Policies page, click Create Policy.
On the Create Policy page, click the JSON Editor tab.

In the policy editor, enter the policy document.

A policy defines a set of permissions based on a specific structure and syntax. It specifies the allowed resources, actions, and conditions. For more information, see policy structure and syntax.
You can grant permissions at the resource and action levels.
You need to replace DTS instance ID in the following code with your actual DTS instance ID based on your business requirements.
Read-only permissions allow you to query task details and configurations for a specified DTS instance, but not modify them. Read and write permissions allow you to configure and manage the instance.

Important

Ensure that the custom policy grants permissions for the DescribeBasicConfigs and DescribeDomainRegions actions.

Sample custom policies:

Example 1

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "dts:Describe*",
            "Resource": "acs:dts:*:*:instance/DTS-instance-ID"
        }
    ],
    "Version": "1"
}

Example 2

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "dts:*",
            "Resource": [
                "acs:dts:*:*:instance/DTS-instance-ID",
                "acs:dts:*:*:instance/DTS-instance-ID"
            ]
        }
    ],
    "Version": "1"
}

Example 3

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dts:DescribeSynchronizationJobStatus",
                "dts:DescribeSynchronizationJobs"
            ],
            "Resource": "acs:dts:*:*:instance/DTS-instance-ID"
        }
    ],
    "Version": "1"
}

Example 4

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dts:DescribeSubscriptionInstances",
                "dts:StartSynchronizationJob",
                "dts:SuspendSynchronizationJob"
            ],
            "Resource": [
                "acs:dts:*:*:instance/DTS-instance-ID",
                "acs:dts:*:*:instance/DTS-instance-ID",
                "acs:dts:*:*:instance/DTS-instance-ID"
 	    ]
        }
    ],
    "Version": "1"
}

Example 1: Read-only permissions on a single instance
Example 2: Read and write permissions on multiple instances
Example 3: Permissions to view the configuration of a single data synchronization task
Example 4: Permissions to start or suspend multiple data synchronization tasks

Click OK.
In the Create Policy dialog box, enter a policy name and description, and then click OK.

Step 2: Grant a custom policy

Log in to the RAM console as a RAM administrator.
Optional: Create a RAM user.

For more information, see Create a RAM user.
In the left-side navigation pane, choose Identities > Users.
In the User Logon Name/Display Name column, find the target RAM user.
In the user's Actions column, click Add Permissions.
In the Add Permissions panel, select a resource scope. Account level: The permissions apply to the entire Alibaba Cloud account. Resource group level: The permissions apply only to the specified resource group. Important: To grant permissions by resource group, both the cloud service and the resource type must support them. For more information, see Cloud services that support resource groups. For an example, see Use resource groups to limit a RAM user to managing specific ECS instances.
1. From the Policy drop-down list, select Custom Policy.
2. In the search box, enter the name of the custom policy that you created in Step 1.
3. Click the custom policy to add it to the Selected Policy section.
Click OK.
Click Close.

Common scenarios for action-level authorization

Note

The DescribeDTSIP, DescribeSubscriptionInstances, and DescribeSynchronizationJobs permissions in the following table are used to retrieve the instance list. A RAM user must retrieve this list before performing related operations, as they may have permissions on only a subset of instances.
To grant a RAM user permissions to configure a data migration, data synchronization, or change tracking task, you must also create and attach a custom policy to the RAM user. For more information, see Grant permissions to DTS to access cloud resources.

API operations (new version)

Feature	Console actions	Policy
Purchase an instance	Purchase a DTS instance	CreateDtsInstance
Data migration or synchronization	Configure a data migration or synchronization task	ConfigureDtsJob
Change tracking	Configure a change tracking task	ConfigureSubscription
Start a task	Start a DTS task	StartDtsJob
Start tasks in batches	Start DTS tasks in batches	StartDtsJobs
Consumer group management	Create a consumer group for a change tracking task	CreateConsumerChannel
	Query consumer group details for a change tracking task	DescribeConsumerChannel
	Modify a consumer group for a change tracking task	ModifyConsumerChannel
	Delete a consumer group for a change tracking task	DeleteConsumerChannel
Query a task	Query the details of a DTS task	DescribeDtsJobDetail
Query a task	Query DTS tasks and their execution details	DescribeDtsJobs
Modify a DTS task	Modify a DTS data synchronization task	ModifyDtsJob
	Modify a DTS change tracking task	ModifySubscription
	Rename a DTS task	ModifyDtsJobName
Reset a task	Reset a DTS task	ResetDtsJob
Pause a task	Pause a DTS task	SuspendDtsJob
Pause tasks in batches	Pause DTS tasks in batches	SuspendDtsJobs
Stop a task	Stop a DTS task	StopDtsJob
Stop tasks in batches	Stop DTS tasks in batches	StopDtsJobs
Release an instance	Release a DTS instance	DeleteDtsJob
Release instances in batches	Release DTS instances in batches	DeleteDtsJobs
Task alerts	Create or modify an alert rule for a task	CreateJobMonitorRule
Task alerts	Query alert rules for a DTS task	DescribeJobMonitorRule
Query an ETL task	Query ETL task details	DescribeDtsEtlJobVersionInfo
Query an ETL task	Query ETL task logs	DescribeEtlJobLogs

API operations (legacy version)

Feature	Console actions	Policy
Data migration	Create a migration task	CreateMigrationJob
	View migration tasks	DescribeMigrationJobs
	View migration task details	DescribeMigrationJobs DescribeMigrationJobDetail DescribeMigrationJobStatus
	Rename a migration task	DescribeMigrationJobs ModifyMigrationObject
	Configure a migration task	DescribeMigrationJobs DescribeMigrationJobDetail DescribeMigrationJobStatus CreateMigrationJob
	View precheck details	DescribeMigrationJobs DescribeMigrationJobStatus
	Create a similar task	DescribeMigrationJobs DescribeMigrationJobDetail DescribeMigrationJobStatus CreateMigrationJob
	Monitoring and alerts	DescribeMigrationJobs DescribeMigrationJobAlert ConfigureMigrationJobAlert
	Modify password	DescribeMigrationJobs DescribeMigrationJobDetail ModifyMigrationObject
	Start a migration task	DescribeMigrationJobs StartMigrationJob DescribeMigrationJobDetail
	Pause a migration task	DescribeMigrationJobs SuspendMigrationJob
	View schema migration details	DescribeMigrationJobs DescribeMigrationJobStatus
	View full data migration details	DescribeMigrationJobs DescribeMigrationJobStatus
	View incremental data migration details	DescribeMigrationJobs DescribeMigrationJobStatus
	View full or incremental migration performance	DescribeMigrationJobs DescribeMigrationJobDetail
	View task logs	DescribeMigrationJobs DescribeMigrationJobDetail
Change tracking	Create a change tracking task	CreateSubscriptionInstance
	View change tracking tasks	DescribeSubscriptionInstances
	View change tracking task details	DescribeSubscriptionInstances DescribeSubscriptionInstanceStatus
	Rename a change tracking task	DescribeSubscriptionInstances ModifySubscriptionObject
	Modify tracked objects	DescribeSubscriptionInstances DescribeSubscriptionInstanceStatus ModifySubscriptionObject
	Create a consumer group	DescribeSubscriptionInstances CreateConsumerGroup
	View consumer groups	DescribeSubscriptionInstances DescribeConsumerGroup
	Modify a consumer group password	DescribeSubscriptionInstances ModifyConsumerGroupPassword
	Delete a consumer group	DescribeSubscriptionInstances DeleteConsumerGroup
	Modify instance password	DescribeSubscriptionInstances DescribeSubscriptionInstanceStatus ModifySubscriptionObject
	Release a change tracking task	DescribeSubscriptionInstances DeleteSubscriptionInstance
	Monitoring and alerts	DescribeSubscriptionInstances DescribeSubscriptionInstanceAlert ConfigureSubscriptionInstanceAlert
	Configure a change tracking task	DescribeSubscriptionInstances DescribeSubscriptionInstanceStatus ModifySubscriptionObject
	View task logs	DescribeSubscriptionInstances DescribeSubscriptionInstanceStatus
Data synchronization	Create a data synchronization task	CreateSynchronizationJob
	View data synchronization tasks	DescribeSynchronizationJobs
	View data synchronization task details	DescribeSynchronizationJobs DescribeSynchronizationJobStatus
	Rename a data synchronization task	DescribeSynchronizationJobs ModifySynchronizationObject
	View data synchronization task configuration	DescribeSynchronizationJobs DescribeSynchronizationJobStatus
	View synchronized objects	DescribeSynchronizationJobs DescribeSynchronizationJobStatus
	View schema and full data initialization status	DescribeSynchronizationJobs DescribeSynchronizationJobStatus
	View full or incremental data synchronization performance	DescribeSynchronizationJobs DescribeSynchronizationJobStatus
	View modification records for synchronized objects	DescribeSynchronizationJobs
	View task logs	DescribeSynchronizationJobs DescribeSynchronizationJobStatus
	Configure a data synchronization task	DescribeSynchronizationJobs DescribeSynchronizationJobStatus ModifySynchronizationObject
	Start a synchronization task	DescribeSynchronizationJobs StartSynchronizationJob
	Pause a synchronization task	DescribeSynchronizationJobs SuspendSynchronizationJob
	Modify synchronized objects	DescribeSynchronizationJobs DescribeSynchronizationJobStatus ModifySynchronizationObject
	Release a synchronization task	DescribeSynchronizationJobs DeleteSynchronizationJob
	Stop a synchronization task	DescribeSynchronizationJobs DeleteSynchronizationJob
	Monitoring and alerts	DescribeSynchronizationJobs DescribeSynchronizationJobAlert ConfigureSynchronizationJobAlert
	Modify instance password	DescribeSynchronizationJobs DescribeSynchronizationJobStatus ModifySubscriptionObject
Network settings	Query the CIDR blocks of DTS servers	DescribeDTSIP

Related actions

Log on to the Alibaba Cloud Management Console as a RAM user.
Call DTS APIs by using an SDK. For more information, see Python SDK example.

FAQ

Q: Why do I see an error message and an empty instance list when I log in to the DTS console as a RAM user?

A: This happens if a RAM user has permissions for only specific instances or no permissions at all, which is why the DTS console does not display the instance list. To manage a specific instance, get its instance ID from a RAM administrator and search for it in the DTS console.

Custom policies for DTS