Configure External Storage Access for TiDB Cloud Dedicated

Configure the bucket access for TiDB Cloud and get the Role ARN as follows:

1. In the TiDB Cloud console, get the corresponding TiDB Cloud account ID and external ID of the target TiDB cluster.

   1. Navigate to the Clusters page of your project.

      Tip

      If you have multiple projects, you can click in the lower-left corner and switch to another project.

   2. Click the name of your target cluster to go to its overview page, and then click Import in the left navigation pane.

   3. On the Import page, select Import data from S3.

      If this is your first time importing data into this cluster, select Import From Amazon S3.

   4. On the Import Data from Amazon S3 page, click the link under Role ARN. The Add New Role ARN dialog is displayed.

   5. Expand Create Role ARN manually to get the TiDB Cloud Account ID and TiDB Cloud External ID. Take a note of these IDs for later use.

2. In the AWS Management Console, create a managed policy for your Amazon S3 bucket.

   1. Sign in to the AWS Management Console and open the Amazon S3 console at https://console.aws.amazon.com/s3/.

   2. In the Buckets list, choose the name of your bucket with the source data, and then click Copy ARN to get your S3 bucket ARN (for example, arn:aws:s3:::tidb-cloud-source-data). Take a note of the bucket ARN for later use.

      

   3. Open the IAM console at https://console.aws.amazon.com/iam/, click Policies in the navigation pane on the left, and then click Create Policy.

      

   4. On the Create policy page, click the JSON tab.

   5. Copy the following access policy template and paste it to the policy text field.

      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Sid": "VisualEditor0",
                  "Effect": "Allow",
                  "Action": [
                      "s3:GetObject",
                      "s3:GetObjectVersion"
                  ],
                  "Resource": "<Your S3 bucket ARN>/<Directory of your source data>/*"
              },
              {
                  "Sid": "VisualEditor1",
                  "Effect": "Allow",
                  "Action": [
                      "s3:ListBucket",
                      "s3:GetBucketLocation"
                  ],
                  "Resource": "<Your S3 bucket ARN>"
              }
          ]
      }
      

      In the policy text field, update the following configurations to your own values.

      • "Resource": "<Your S3 bucket ARN>/<Directory of the source data>/*"

        For example, if your source data is stored in the root directory of the tidb-cloud-source-data bucket, use "Resource": "arn:aws:s3:::tidb-cloud-source-data/*". If your source data is stored in the mydata directory of the bucket, use "Resource": "arn:aws:s3:::tidb-cloud-source-data/mydata/*". Make sure that /* is added to the end of the directory so TiDB Cloud can access all files in this directory.

      • "Resource": "<Your S3 bucket ARN>"

        For example, "Resource": "arn:aws:s3:::tidb-cloud-source-data".

      • If you have enabled AWS Key Management Service key (SSE-KMS) with customer-managed key encryption, make sure the following configuration is included in the policy. "arn:aws:kms:ap-northeast-1:105880447796:key/c3046e91-fdfc-4f3a-acff-00597dd3801f" is a sample KMS key of the bucket.

        {
            "Sid": "AllowKMSkey",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt"
            ],
            "Resource": "arn:aws:kms:ap-northeast-1:105880447796:key/c3046e91-fdfc-4f3a-acff-00597dd3801f"
        }
        

        If the objects in your bucket have been copied from another encrypted bucket, the KMS key value needs to include the keys of both buckets. For example, "Resource": ["arn:aws:kms:ap-northeast-1:105880447796:key/c3046e91-fdfc-4f3a-acff-00597dd3801f","arn:aws:kms:ap-northeast-1:495580073302:key/0d7926a7-6ecc-4bf7-a9c1-a38f0faec0cd"].

   6. Click Next.

   7. Set a policy name, add a tag of the policy (optional), and then click Create policy.

3. In the AWS Management Console, create an access role for TiDB Cloud and get the role ARN.

   1. In the IAM console at https://console.aws.amazon.com/iam/, click Roles in the navigation pane on the left, and then click Create role.

      

   2. To create a role, fill in the following information:

      • Under Trusted entity type, select AWS account.
      • Under An AWS account, select Another AWS account, and then paste the TiDB Cloud account ID to the Account ID field.
      • Under Options, click Require external ID to avoid the confused deputy problem, and then paste the TiDB Cloud External ID to the External ID field. If the role is created without "Require external ID", anyone with your S3 bucket URI and IAM role ARN might be able to access your Amazon S3 bucket. If the role is created with both the account ID and external ID, only TiDB clusters running in the same project and the same region can access the bucket.

   3. Click Next to open the policy list, choose the policy you just created, and then click Next.

   4. Under Role details, set a name for the role, and then click Create role in the lower-right corner. After the role is created, the list of roles is displayed.

   5. In the list of roles, click the name of the role that you just created to go to its summary page, and then copy the role ARN.

      

4. In the TiDB Cloud console, go to the Data Import page where you get the TiDB Cloud account ID and external ID, and then paste the role ARN to the Role ARN field.