DocsICP FilingConsole
Documentation
Home Page ApsaraDB for MongoDB User Guide Global Active Database Grant DTS access to cloud resources

Grant DTS access to cloud resources

Updated at:
Copy as MD
Product
My Favorites

Global Distributed Cache requires Data Transmission Service (DTS) to access your cloud resources. Create a default role named AliyunDTSDefaultRole and attach the AliyunDTSRolePolicy system policy to grant this access. This one-time setup does not affect the performance of your ApsaraDB for MongoDB instances.

Note

If you log in to the RAM console with your primary account and the required permissions already exist, skip these steps and proceed to create a Global Distributed Cache instance group.

Prerequisites

Permission policy

The AliyunDTSRolePolicy system policy for the AliyunDTSDefaultRole default role includes partial management permissions for cloud resources such as ApsaraDB for RDS, Elastic Compute Service (ECS), PolarDB, ApsaraDB for MongoDB, ApsaraDB for Redis, PolarDB-X, DataHub, and Elasticsearch. For a detailed definition of the permissions, see AliyunDTSRolePolicy.

Note

For more information about permission policies, see Syntax and structure of permission policies.

Method 1: Quick authorization (Recommended)

Log in with your primary account and go to the AliyunDTSDefaultRole quick authorization page. In the Authorize Access to Cloud Resources dialog box, click Confirm Authorization. A success message confirms the authorization is complete.

Method 2: Use the RAM console

  1. Find the default role.

    1. Use an Alibaba Cloud account to log on to the RAM console.

    2. Optional: In the left-side navigation pane, choose Identities > Roles.

    3. In the search box to the right of Create Role, enter AliyunDTSDefaultRole and search for the role.

      Note

      If the AliyunDTSDefaultRole role does not exist, we recommend that you use Method 1.

  2. In the search results, click AliyunDTSDefaultRole.

  3. Grant precise permissions to the target RAM role.

    1. On the Permissions tab, click Precise Permission.

    2. Optional: In the Precise Permission panel, set Policy Type to System Policy.

    3. In the Policy Name text box, enter AliyunDTSRolePolicy.

    4. Click OK.

      On the Permissions tab, you can click the image refresh icon to check whether the permission is granted.

  4. After the permission is granted, click Close.

Verify the authorization

Note

You can follow these steps to verify the authorization for the default role.

  1. Use an Alibaba Cloud account to log on to the RAM console.

  2. Optional: In the left-side navigation pane, choose Identities > Roles.

  3. In the search box to the right of Create Role, enter AliyunDTSDefaultRole and search for the role.

  4. In the search results, click AliyunDTSDefaultRole.

  5. View the details of the AliyunDTSDefaultRole role.

    • The authorization is successful if the AliyunDTSDefaultRole role meets both of the following conditions:

      • The Trust Policy contains dts.aliyuncs.com.

        Specifically, the Service field in the Principal section of the trust policy JSON contains dts.aliyuncs.com. To modify the trust policy, click Edit Trust Policy.

      • The Permissions tab contains the AliyunDTSRolePolicy system policy.

    • If the AliyunDTSDefaultRole role does not meet these conditions, the authorization has failed, and you must authorize the role again.

      You can delete the AliyunDTSDefaultRole role and authorize it again.

      Note

Next steps

Create a Global Distributed Cache instance group

Previous：Global Active DatabaseNext：DynamoDB-compatible ApsaraDB for MongoDB Instances