Grant DTS access to cloud resources-ApsaraDB for MongoDB(MongoDB)-阿里云帮助中心

Before you can use Global Distributed Cache, you must grant Data Transmission Service (DTS) access to your cloud resources. To do this, create a default role named AliyunDTSDefaultRole and attach the AliyunDTSRolePolicy system policy to it. This one-time setup is required for configuring and managing Global Distributed Cache. It does not affect the performance of your ApsaraDB for MongoDB instances.

Note

If you are logged in to the RAM console with your primary account and find that the required permissions already exist, you can skip these steps and proceed to create a Global Distributed Cache instance group.

Prerequisites

An Alibaba Cloud account is created. For more information, see Register an Alibaba Cloud Account.
You must use your primary account to grant the permissions.

Policy

The AliyunDTSRolePolicy system policy for the AliyunDTSDefaultRole default role grants limited management permissions on cloud resources such as RDS, ECS, PolarDB, MongoDB, Redis, PolarDB-X, DataHub, and Elasticsearch. For the complete policy definition, see AliyunDTSRolePolicy.

Note

For more information about policies, see Policy syntax and structure.

Method 1: Quick authorization (Recommended)

Log in with your primary account and go to the AliyunDTSDefaultRole quick authorization page. In the Authorize Access to Cloud Resources dialog box, click Confirm Authorization. A success message confirms that the authorization is complete.

Method 2: Use the RAM console

Find the default role.
1. Log on to the RAM console with your Alibaba Cloud account.
2. Optional: In the left-side navigation pane, choose Identities > Roles.
3. In the search box to the right of Create Role, enter AliyunDTSDefaultRole and search for the role.
  
  Note
  If the AliyunDTSDefaultRole role does not exist, use Method 1 to grant the authorization.
In the search results, click AliyunDTSDefaultRole.
Grant permissions to the RAM role.
1. On the Permissions tab, click Grant Permission.
2. Optional: In the Grant Permission panel, select System Policy for the Policy Type parameter.
3. In the Policy Name search box, enter AliyunDTSRolePolicy.
4. Click OK.
  
  On the Permissions tab, click the icon on the right side to refresh the page and verify that the permission was granted.
After the permission is granted, click Close.

Verify the authorization result

Note

Follow these steps to verify that the default role is authorized correctly.

Log on to the RAM console with your Alibaba Cloud account.
Optional: In the left-side navigation pane, choose Identities > Roles.
In the search box to the right of Create Role, enter AliyunDTSDefaultRole and search for the role.
In the search results, click AliyunDTSDefaultRole.
View the details of the AliyunDTSDefaultRole role.
- The authorization is successful if the AliyunDTSDefaultRole role meets the following two conditions:
  - The Trust Policy specifies dts.aliyuncs.com as a trusted entity.
  - On the Permissions tab, the AliyunDTSRolePolicy system policy is attached.
- If the AliyunDTSDefaultRole role does not meet the preceding conditions, the authorization is invalid and must be performed again.
  
  To do this, delete the AliyunDTSDefaultRole role and authorize it again.
  Note
  
  We recommend using Method 1 to grant the authorization.
  
  For instructions on deleting a RAM role, see Delete a RAM role.

Next steps

Create a Global Distributed Cache instance group