Authorize DTS to access cloud resources-ApsaraDB RDS(RDS)-阿里云帮助中心

Before you set up a disaster recovery instance group for ApsaraDB RDS for SQL Server for the first time, you must create a RAM role named AliyunDTSDefaultRole and attach the AliyunDTSRolePolicy system policy to the role. This allows DTS to access your ApsaraDB RDS and DTS cloud resources to set up and manage the disaster recovery instance group. This authorization ensures the ApsaraDB RDS disaster recovery feature functions correctly and does not affect the performance of your ApsaraDB RDS instances.

Note

If you log in to the RAM console with your Alibaba Cloud account and find that the required permissions are already granted, you can skip this topic and proceed to set up a disaster recovery instance group.

Prerequisites

You have Step 1: Register an Alibaba Cloud account.
You must use an Alibaba Cloud account to perform the authorization.

Permission policy

The AliyunDTSRolePolicy system policy for the AliyunDTSDefaultRole default role includes partial management permissions for cloud resources such as ApsaraDB for RDS, Elastic Compute Service (ECS), PolarDB, ApsaraDB for MongoDB, ApsaraDB for Redis, PolarDB-X, DataHub, and Elasticsearch. For a detailed definition of the permissions, see AliyunDTSRolePolicy.

Note

For more information about permission policies, see Syntax and structure of permission policies.

Method 1: Use the quick authorization link (Recommended)

Log in to the Alibaba Cloud console with your Alibaba Cloud account and visit the quick authorization page for AliyunDTSDefaultRole, and in the dialog box that appears, click Confirm Authorization. A success message indicates that the authorization is complete.

The authorization page uses the AliyunDTSRolePolicy system policy.

Method 2: Authorize in the RAM console

Find the default role.
1. Use an Alibaba Cloud account to log on to the RAM console.
2. Optional: In the left-side navigation pane, choose Identities > Roles.
3. In the search box to the right of Create Role, enter AliyunDTSDefaultRole and search for the role.
  
  Note
  If the AliyunDTSDefaultRole role does not exist, we recommend that you use Method 1.
In the search results, click AliyunDTSDefaultRole.
Grant precise permissions to the target RAM role.
1. On the Permissions tab, click Precise Permission.
2. Optional: In the Precise Permission panel, set Policy Type to System Policy.
3. In the Policy Name text box, enter AliyunDTSRolePolicy.
4. Click OK.
  
  On the Permissions tab, you can click the refresh icon to check whether the permission is granted.
After the permission is granted, click Close.

Verify the authorization

Note

You can follow these steps to verify the authorization for the default role.

Use an Alibaba Cloud account to log on to the RAM console.
Optional: In the left-side navigation pane, choose Identities > Roles.
In the search box to the right of Create Role, enter AliyunDTSDefaultRole and search for the role.
In the search results, click AliyunDTSDefaultRole.
View the details of the AliyunDTSDefaultRole role.
- The authorization is successful if the AliyunDTSDefaultRole role meets both of the following conditions:
  - The Trust Policy contains dts.aliyuncs.com.
    
    Specifically, the Service field in the Principal section of the trust policy JSON contains dts.aliyuncs.com. To modify the trust policy, click Edit Trust Policy.
  - The Permissions tab contains the AliyunDTSRolePolicy system policy.
- If the AliyunDTSDefaultRole role does not meet these conditions, the authorization has failed, and you must authorize the role again.
  
  You can delete the AliyunDTSDefaultRole role and authorize it again.
  Note
  
  We recommend that you use Method 1.
  
  For more information about how to delete a RAM role, see Delete a RAM role.

Next steps

Create a disaster recovery RDS instance