Configure Amazon S3 Access and GCS Access

Configure the bucket access for TiDB Cloud and get the Role ARN as follows:

1. In the TiDB Cloud console, get the TiDB Cloud account ID and external ID of the target TiDB cluster.

   1. Navigate to the Clusters page of your project.

      Tip

      If you have multiple projects, you can click in the lower-left corner and switch to another project.

   2. Click the name of your target cluster to go to its overview page, and then click Import in the left navigation pane.

   3. On the Import page, click Import Data in the upper-right corner and select From S3.

   4. On the Import from S3 page, click Guide for getting the required Role ARN to get the TiDB Cloud Account ID and TiDB Cloud External ID. Take a note of these IDs for later use.

2. In the AWS Management Console, create a managed policy for your Amazon S3 bucket.

   1. Sign in to the AWS Management Console and open the Amazon S3 console at https://console.aws.amazon.com/s3/.

   2. In the Buckets list, choose the name of your bucket with the source data, and then click Copy ARN to get your S3 bucket ARN (for example, arn:aws:s3:::tidb-cloud-source-data). Take a note of the bucket ARN for later use.

      

   3. Open the IAM console at https://console.aws.amazon.com/iam/, click Policies in the navigation pane on the left, and then click Create Policy.

      

   4. On the Create policy page, click the JSON tab.

   5. Copy the following access policy template and paste it to the policy text field.

      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Sid": "VisualEditor0",
                  "Effect": "Allow",
                  "Action": [
                      "s3:GetObject",
                      "s3:GetObjectVersion"
                  ],
                  "Resource": "<Your S3 bucket ARN>/<Directory of your source data>/*"
              },
              {
                  "Sid": "VisualEditor1",
                  "Effect": "Allow",
                  "Action": [
                      "s3:ListBucket",
                      "s3:GetBucketLocation"
                  ],
                  "Resource": "<Your S3 bucket ARN>"
              }
          ]
      }
      

      In the policy text field, update the following configurations to your own values.

      • "Resource": "<Your S3 bucket ARN>/<Directory of the source data>/*"

        For example, if your source data is stored in the root directory of the tidb-cloud-source-data bucket, use "Resource": "arn:aws:s3:::tidb-cloud-source-data/*". If your source data is stored in the mydata directory of the bucket, use "Resource": "arn:aws:s3:::tidb-cloud-source-data/mydata/*". Make sure that /* is added to the end of the directory so TiDB Cloud can access all files in this directory.

      • "Resource": "<Your S3 bucket ARN>"

        For example, "Resource": "arn:aws:s3:::tidb-cloud-source-data".

      • If you have enabled AWS Key Management Service key (SSE-KMS) with customer-managed key encryption, make sure the following configuration is included in the policy. "arn:aws:kms:ap-northeast-1:105880447796:key/c3046e91-fdfc-4f3a-acff-00597dd3801f" is a sample KMS key of the bucket.

        {
            "Sid": "AllowKMSkey",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt"
            ],
            "Resource": "arn:aws:kms:ap-northeast-1:105880447796:key/c3046e91-fdfc-4f3a-acff-00597dd3801f"
        }
        

        If the objects in your bucket have been copied from another encrypted bucket, the KMS key value needs to include the keys of both buckets. For example, "Resource": ["arn:aws:kms:ap-northeast-1:105880447796:key/c3046e91-fdfc-4f3a-acff-00597dd3801f","arn:aws:kms:ap-northeast-1:495580073302:key/0d7926a7-6ecc-4bf7-a9c1-a38f0faec0cd"].

   6. Click Next: Tags, add a tag of the policy (optional), and then click Next:Review.

   7. Set a policy name, and then click Create policy.

3. In the AWS Management Console, create an access role for TiDB Cloud and get the role ARN.

   1. In the IAM console at https://console.aws.amazon.com/iam/, click Roles in the navigation pane on the left, and then click Create role.

      

   2. To create a role, fill in the following information:

      • Under Trusted entity type, select AWS account.
      • Under An AWS account, select Another AWS account, and then paste the TiDB Cloud account ID to the Account ID field.
      • Under Options, click Require external ID (Best practice when a third party will assume this role), and then paste the TiDB Cloud External ID to the External ID field. If the role is created without "Require external ID", once the configuration is done for one TiDB cluster in a project, all TiDB clusters in that project can use the same Role ARN to access your Amazon S3 bucket. If the role is created with the account ID and external ID, only the corresponding TiDB cluster can access the bucket.

   3. Click Next to open the policy list, choose the policy you just created, and then click Next.

   4. Under Role details, set a name for the role, and then click Create role in the lower-right corner. After the role is created, the list of roles is displayed.

   5. In the list of roles, click the name of the role that you just created to go to its summary page, and then copy the role ARN.

      

4. In the TiDB Cloud console, go to the Data Import page where you get the TiDB Cloud account ID and external ID, and then paste the role ARN to the Role ARN field.