Help Center/ Cloud Eye/ User Guide/ Data Dump/ Dumping Data to Another Account
Updated on 2025-08-07 GMT+08:00

Dumping Data to Another Account

You can dump cloud service monitoring data to DMS for Kafka in real time and query the metrics on the DMS for Kafka console or using an open-source Kafka client.

When adding a data dump task on Cloud Eye, you can set Destination to a Kafka instance under another tenant account.

  • An account can create up to 20 data dump tasks.
  • Data dump is available only for whitelisted customers.

Prerequisites

You have created two agencies and performed DMS and IAM fine-grained authorization for the two agencies.

  1. DMS resource query agency: The delegating party creates a delegating account for the delegated party. This account is used to obtain the project list, DMS instance list, and topic list of the delegating party for a data dump task on the console.
  2. Cloud Eye account agency: The delegating party creates an agency for the op_svc_ces account to dump metric data of the delegated party to the delegating DMS instance.

    A delegating party is an account that owns DMS resources, and a delegated party is an account that has the metric data to be dumped.

Creating a Cloud Eye Account Agency

Create a DMS resource query agency and a CES account agency by referring to Creating an Agency

During the creation, set the delegator account correctly, as shown in Figure 1.
  • The agency name must be CloudServiceAgency2CESAutoConfig, and the delegated account must be op_svc_ces (case sensitive).
  • If the CloudServiceAgency2CESAutoConfig agency already exists, skip this step.
Figure 1 Creating an agency

After the two agencies are created, you need to add authorization information for them.

DMS Agency Authorization

The following provides the procedure for a delegating party to grant DMS fine-grained permissions to a delegated party, which is similar to that for a Cloud Eye account agency.

  1. On the Identity and Access Management page, locate the delegated account, and click Authorize in the Operation column.
    Figure 2 Authorization
  2. On the Select Policy/Rope page, click Create Policy in the upper right corner.
    Figure 3 Creating a policy
  3. On the Create Policy page, enter a policy name, click Select service for Policy Content, enter Distributed Message Service or DMS in the search box, and click Distributed Message Service (DMS).
    Figure 4 Selecting a service
  4. Click Actions: 2, search for dms:instance:get and dms:instance:list and select them.
    Figure 5 Selecting actions
  5. Click Next and select the created policy.
    Figure 6 Selecting a policy

  6. Click OK to complete the fine-grained authorization for the delegated account.

Required Permissions for the Delegated Party

If the delegated account is a management account, no permission needs to be configured. If the delegated account is a member account, the data dump permissions are required.

Project-level permissions are as follows:
{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ces:quotas:get",
        "ces:dataShareJob:get",
        "ces:dataShareTask:delete",
        "ces:dataShareJob:action",
        "ces:dataShareTask:list",
        "ces:namespaces:list",
        "ces:sysEventsNames:list",
        "ces:dataShareTask:get",
        "ces:dataShareTask:action",
        "ces:dataShareJob:list",
        "ces:dataShareTask:put",
        "ces:dataShareTask:create",
        "ces:dataShareJob:action",
        "ces:dataShareJob:delete",
        "ces:dataShareJob:create",
        "dms:instance:list",
        "dms:instance:get",
        "ces:dataShareJob:listDmsInstancesByAgency",
        "ces:dataShareJob:listAgencyProjects",
        "ces:dataShareJob:listDmsTopicsByAgency",
        "ces:agency:get",
        "ces:agency:post",
        "ces:namespacesDimensions:list",
        "mqs:instance:list",
        "mqs:instance:get",
        "ces:i18n:list"
      ]
    }
  ]
}

In addition, you must obtain the following permissions (global permissions) to manage IAM agencies, so that data dump tasks can be created and run properly:
{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:agencies:assume",
        "iam:agencies:createAgency",
        "iam:agencies:listAgencies",
        "iam:permissions:grantRoleToAgency",
        "iam:permissions:grantRoleToAgencyOnProject",
        "iam:permissions:listRolesForAgency",
        "iam:permissions:listRolesForAgencyOnDomain",
        "iam:permissions:listRolesForAgencyOnProject",
        "iam:permissions:revokeRoleFromAgency",
        "iam:roles:createRole",
        "iam:roles:listRoles",
        "iam:roles:updateRole"
      ]
    }
  ]
}

For details about how to obtain project-level and global permissions, see Creating a Custom Policy.

Configuring a Data Dump Task by the Delegated Party

After the agency and fine-grained authorization are complete, you can configure a data dump task on the console of the delegated party. The procedure is as follows:

  1. Log in to the Cloud Eye console using the delegated account.
  2. In the navigation pane, choose Data Dump.
  3. Click Add Dump Task.
  4. On the displayed page, set parameters.
    Table 1 Parameters for configuring a dump task

    Parameter

    Description

    Name

    Dump task name.

    Only letters, digits, underscores (_), and hyphens (-) are allowed. You can enter 1 to 64 characters.

    Example value: dataShareJob-ECSMetric

    Resource Type

    Type of resources monitored by Cloud Eye.

    Example value: Elastic Cloud Server

    Dimension

    Dimension of the monitored object.

    For details, see Metrics and Dimension on the monitoring metric description page.

    • If All is selected, all metrics of the selected service will be dumped to DMS for Kafka.
    • If ECSs is selected, ECS metrics will be dumped to DMS for Kafka.

    Example value: All

    Monitoring Scope

    The scope can only be All resources, indicating that all metrics of the specified monitored object will be dumped to DMS for Kafka.

    Resource Type

    Resource type. Only Distributed Message Service for Kafka is supported.

    Destination

    The destination location for saving dumped data. Select Other account.

    Delegator Account

    Delegator account ID. For details, see Appendix.

    Agency Name

    Agency name of the delegated account. For details, see Appendix.

    Project Name

    Project of the resource.

    Kafka

    Name of the Kafka instance where metric data is dumped to.

    If no Kafka instance is available, see Buying a Kafka Instance.

    Topic

    Name of the topic to which data is dumped.

    If no topic is available, see Creating a Topic.

    Figure 7 Configuring a dump task
  5. After setting the parameters, click Add to create a dump task.

    You can query the dumped data in DMS for Kafka using the delegator account ID. For details, see Viewing Kafka Messages.

Appendix

To search for an agency, perform the following steps:

  1. Log in to the management console using the delegator account.
  2. Hover your mouse over the username in the upper right corner and choose Identity and Access Management.

  1. In the navigation pane, choose Agencies.
    Figure 8 Viewing agencies

To search for an account ID, perform the following steps:

  1. Log in to the management console, hover your mouse over the username in the upper right corner and choose My Credentials.

  2. On the My Credentials page, obtain the Account ID.
    Figure 9 My credentials