Configure External Storage Access for TiDB Cloud Serverless

In the Add New ARN dialog described in previous instructions, click Having trouble? Create Role ARN manually. You will get the TiDB Cloud Account ID and TiDB Cloud External ID.

In the AWS Management Console, create a managed policy for your Amazon S3 bucket.

1. Sign in to the AWS Management Console and open the Amazon S3 console.

2. In the Buckets list, choose the name of your bucket with the source data, and then click Copy ARN to get your S3 bucket ARN (for example, arn:aws:s3:::tidb-cloud-source-data). Take a note of the bucket ARN for later use.

   

3. Open the IAM console, click Policies in the left navigation pane, and then click Create Policy.

   

4. On the Create policy page, click the JSON tab.

5. Configure the policy in the policy text field according to your needs. The following is an example that you can use to export data from and import data to a TiDB Cloud Serverless cluster.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "VisualEditor0",
               "Effect": "Allow",
               "Action": [
                   "s3:GetObject",
                   "s3:GetObjectVersion",
                   "s3:PutObject"
               ],
               "Resource": "<Your S3 bucket ARN>/<Directory of your source data>/*"
           },
           {
               "Sid": "VisualEditor1",
               "Effect": "Allow",
               "Action": [
                   "s3:ListBucket"
               ],
               "Resource": "<Your S3 bucket ARN>"
           }
       ]
   }
   

   In the policy text field, replace the following configurations with your own values.

   • "Resource": "<Your S3 bucket ARN>/<Directory of the source data>/*". For example,

     • If your source data is stored in the root directory of the tidb-cloud-source-data bucket, use "Resource": "arn:aws:s3:::tidb-cloud-source-data/*".
     • If your source data is stored in the mydata directory of the bucket, use "Resource": "arn:aws:s3:::tidb-cloud-source-data/mydata/*".

     Make sure that /* is added to the end of the directory so TiDB Cloud can access all files in this directory.

   • "Resource": "<Your S3 bucket ARN>", for example, "Resource": "arn:aws:s3:::tidb-cloud-source-data".

   • If you have enabled AWS Key Management Service key (SSE-KMS) with customer-managed key encryption, make sure the following configuration is included in the policy. "arn:aws:kms:ap-northeast-1:105880447796:key/c3046e91-fdfc-4f3a-acff-00597dd3801f" is a sample KMS key of the bucket.

     {
         "Sid": "AllowKMSkey",
         "Effect": "Allow",
         "Action": [
             "kms:Decrypt"
         ],
         "Resource": "arn:aws:kms:ap-northeast-1:105880447796:key/c3046e91-fdfc-4f3a-acff-00597dd3801f"
     }
     

   • If the objects in your bucket have been copied from another encrypted bucket, the KMS key value needs to include the keys of both buckets. For example, "Resource": ["arn:aws:kms:ap-northeast-1:105880447796:key/c3046e91-fdfc-4f3a-acff-00597dd3801f","arn:aws:kms:ap-northeast-1:495580073302:key/0d7926a7-6ecc-4bf7-a9c1-a38f0faec0cd"].

6. Click Next.

7. Set a policy name, add a tag of the policy (optional), and then click Create policy.

In the AWS Management Console, create an access role for TiDB Cloud and get the role ARN.

1. In the IAM console, click Roles in the left navigation pane, and then click Create role.

   

2. To create a role, fill in the following information:

   • In Trusted entity type, select AWS account.
   • In An AWS account, select Another AWS account, and then paste the TiDB Cloud account ID to the Account ID field.
   • In Options, click Require external ID (Best practice when a third party will assume this role), and then paste the TiDB Cloud External ID to the External ID field. If the role is created without a Require external ID, once the configuration is done for one TiDB cluster in a project, all TiDB clusters in that project can use the same Role ARN to access your Amazon S3 bucket. If the role is created with the account ID and external ID, only the corresponding TiDB cluster can access the bucket.

3. Click Next to open the policy list, choose the policy you just created, and then click Next.

4. In Role details, set a name for the role, and then click Create role in the lower-right corner. After the role is created, the list of roles is displayed.

5. In the list of roles, click the name of the role that you just created to go to its summary page, and then you can get the role ARN.