From e5f8fdd3c15484f20e5e40dfcbd6a54e5c0a58d4 Mon Sep 17 00:00:00 2001 From: Howard Chen Date: Thu, 20 Aug 2026 16:54:55 +0800 Subject: [PATCH 01/11] Add changefeed OSS configuration for premium. --- .../changefeed-sink-to-cloud-storage.md | 48 ++++++++++++++++++- 1 file changed, 46 insertions(+), 2 deletions(-) diff --git a/tidb-cloud/changefeed-sink-to-cloud-storage.md b/tidb-cloud/changefeed-sink-to-cloud-storage.md index da0afce453b23..65f1bf041b77d 100644 --- a/tidb-cloud/changefeed-sink-to-cloud-storage.md +++ b/tidb-cloud/changefeed-sink-to-cloud-storage.md @@ -1,27 +1,47 @@ --- title: Sink to Cloud Storage -summary: This document explains how to create a changefeed to stream data from TiDB Cloud to Amazon S3, Google Cloud Storage (GCS), or Azure Blob Storage. It includes restrictions, configuration steps for the destination, replication, and specification, as well as starting the replication process. +summary: This document explains how to create a changefeed to stream data from TiDB Cloud to cloud storage. It includes restrictions, configuration steps for the destination, replication, and specification, as well as starting the replication process. --- # Sink to Cloud Storage -This document describes how to create a changefeed to stream data from TiDB Cloud to cloud storage. Currently, Amazon S3, Google Cloud Storage (GCS), and Azure Blob Storage are supported. + +This document describes how to create a changefeed to stream data from TiDB Cloud to cloud storage. > **Note:** > + +> - To stream data to cloud storage, make sure that your TiDB cluster version is v7.1.1 or later. To upgrade your TiDB Cloud Dedicated cluster to v7.1.1 or later, [contact TiDB Cloud Support](/tidb-cloud/tidb-cloud-support.md). +> - For [{{{ .premium }}}](/tidb-cloud/select-cluster-tier.md#premium) instances, see [Sink to Cloud Storage](/tidb-cloud/changefeed-sink-to-cloud-storage.md?plan=premium). + + +> - For [{{{ .dedicated }}}](/tidb-cloud/select-cluster-tier.md#tidb-cloud-dedicated) instances, see [Sink to Cloud Storage](/tidb-cloud/changefeed-sink-to-cloud-storage.md). + > - To stream data to cloud storage, make sure that your TiDB cluster version is v7.1.1 or later. To upgrade your TiDB Cloud Dedicated cluster to v7.1.1 or later, [contact TiDB Cloud Support](/tidb-cloud/tidb-cloud-support.md). + > - For [{{{ .starter }}}](/tidb-cloud/select-cluster-tier.md#starter) instances, the changefeed feature is unavailable. > - For [{{{ .essential }}}](/tidb-cloud/select-cluster-tier.md#essential) instances, the changefeed feature is only available upon request. For more information, see [Changefeed](/tidb-cloud/essential-changefeed-overview.md). + ## Restrictions + - For each TiDB Cloud Dedicated cluster, you can create up to 100 changefeeds. + + +- For each TiDB Cloud Premium instance, you can create up to 100 changefeeds. + - Because TiDB Cloud uses TiCDC to establish changefeeds, it has the same [restrictions as TiCDC](https://docs.pingcap.com/tidb/stable/ticdc-overview#unsupported-scenarios). - If the table to be replicated does not have a primary key or a non-null unique index, the absence of a unique constraint during replication could result in duplicated data being inserted downstream in some retry scenarios. ## Step 1. Configure destination + Navigate to the overview page of the target TiDB Cloud Dedicated cluster. Click **Data** > **Changefeed** in the left navigation pane, click **Create Changefeed** to go to the **Destination** page, and then select **Amazon S3**, **GCS**, or **Azure Blob Storage** as the destination, depending on the cloud provider on which your TiDB Cloud Dedicated cluster is hosted. The configuration process varies depending on the destination you choose. + + +Navigate to the overview page of the target TiDB Cloud Premium cluster. Click **Data** > **Changefeed** in the left navigation pane, click **Create Changefeed** to go to the **Destination** page, and then select **Amazon S3** or **Alibaba Cloud OSS** as the destination, depending on the cloud provider on which your TiDB Cloud Premium cluster is hosted. The configuration process varies depending on the destination you choose. +
@@ -63,6 +83,7 @@ To use an access key for authentication, follow these steps: - **Secret Access Key**
+
For **GCS**, before filling **GCS Endpoint**, you need to first grant the GCS bucket access. Take the following steps: @@ -158,6 +179,29 @@ For **Azure Blob Storage**, you must configure the container and get a SAS token - **SAS Token**: enter the generated SAS token obtained in step 3.
+ + +
+For **Alibaba Cloud OSS**, follow these steps to configure the changefeed: + +1. In the [Alibaba Cloud console](https://www.alibabacloud.com/), perform the following prerequisite steps: + + 1. Create an OSS bucket in the same region as your TiDB cluster. For detailed instructions, see [Create buckets](https://www.alibabacloud.com/help/en/oss/user-guide/create-buckets). + 2. Create a RAM user for the changefeed and generate an AccessKey pair. For detailed instructions, see [Create an AccessKey pair](https://www.alibabacloud.com/help/en/ram/user-guide/create-an-accesskey-pair). + 3. Grant the RAM user OSS permissions. For the required permissions, see [OSS permissions and access control](https://www.alibabacloud.com/help/en/oss/user-guide/permissions-and-access-control-overview). The RAM user needs at least the following permissions: + + - `oss:ListObjects` + - `oss:GetObject` + - `oss:PutObject` + - `oss:DeleteObject` + +2. On the **Destination** page for Alibaba Cloud OSS, fill in the following fields: + + - **Bucket URI**: enter the OSS URI in the format `oss:////`. + - **Access Key ID**: enter the AccessKey ID from the RAM user. + - **Access Key Secret**: enter the AccessKey Secret from the RAM user. +
+ Click **Next** to establish the connection from the TiDB Cloud Dedicated cluster to Amazon S3, GCS, or Azure Blob Storage. TiDB Cloud will automatically test and verify if the connection is successful. From b2e7e1a6b4c0d5c88d79d27650e635917fa8d5d6 Mon Sep 17 00:00:00 2001 From: Grace Cai Date: Thu, 20 Aug 2026 18:41:28 +0800 Subject: [PATCH 02/11] Update tidb-cloud/changefeed-sink-to-cloud-storage.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --- tidb-cloud/changefeed-sink-to-cloud-storage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tidb-cloud/changefeed-sink-to-cloud-storage.md b/tidb-cloud/changefeed-sink-to-cloud-storage.md index 65f1bf041b77d..4131d2374a6ea 100644 --- a/tidb-cloud/changefeed-sink-to-cloud-storage.md +++ b/tidb-cloud/changefeed-sink-to-cloud-storage.md @@ -40,7 +40,7 @@ This document describes how to create a changefeed to stream data from TiDB Clou Navigate to the overview page of the target TiDB Cloud Dedicated cluster. Click **Data** > **Changefeed** in the left navigation pane, click **Create Changefeed** to go to the **Destination** page, and then select **Amazon S3**, **GCS**, or **Azure Blob Storage** as the destination, depending on the cloud provider on which your TiDB Cloud Dedicated cluster is hosted. The configuration process varies depending on the destination you choose. -Navigate to the overview page of the target TiDB Cloud Premium cluster. Click **Data** > **Changefeed** in the left navigation pane, click **Create Changefeed** to go to the **Destination** page, and then select **Amazon S3** or **Alibaba Cloud OSS** as the destination, depending on the cloud provider on which your TiDB Cloud Premium cluster is hosted. The configuration process varies depending on the destination you choose. +Navigate to the overview page of the target TiDB Cloud Premium instance. Click **Data** > **Changefeed** in the left navigation pane, click **Create Changefeed** to go to the **Destination** page, and then select **Amazon S3** or **Alibaba Cloud OSS** as the destination, depending on the cloud provider on which your TiDB Cloud Premium instance is hosted. The configuration process varies depending on the destination you choose. From 8980b7ea897a5bc2eebb5c5bd731e9b6fdea6393 Mon Sep 17 00:00:00 2001 From: Grace Cai Date: Fri, 21 Aug 2026 16:41:09 +0800 Subject: [PATCH 03/11] update the formatting of CustomContent --- tidb-cloud/changefeed-sink-to-cloud-storage.md | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/tidb-cloud/changefeed-sink-to-cloud-storage.md b/tidb-cloud/changefeed-sink-to-cloud-storage.md index 4131d2374a6ea..a543bb719914e 100644 --- a/tidb-cloud/changefeed-sink-to-cloud-storage.md +++ b/tidb-cloud/changefeed-sink-to-cloud-storage.md @@ -25,22 +25,21 @@ This document describes how to create a changefeed to stream data from TiDB Clou ## Restrictions - -- For each TiDB Cloud Dedicated cluster, you can create up to 100 changefeeds. - - -- For each TiDB Cloud Premium instance, you can create up to 100 changefeeds. - +- For each TiDB Cloud Dedicated clusterTiDB Cloud Premium instance, you can create up to 100 changefeeds. - Because TiDB Cloud uses TiCDC to establish changefeeds, it has the same [restrictions as TiCDC](https://docs.pingcap.com/tidb/stable/ticdc-overview#unsupported-scenarios). - If the table to be replicated does not have a primary key or a non-null unique index, the absence of a unique constraint during replication could result in duplicated data being inserted downstream in some retry scenarios. ## Step 1. Configure destination + Navigate to the overview page of the target TiDB Cloud Dedicated cluster. Click **Data** > **Changefeed** in the left navigation pane, click **Create Changefeed** to go to the **Destination** page, and then select **Amazon S3**, **GCS**, or **Azure Blob Storage** as the destination, depending on the cloud provider on which your TiDB Cloud Dedicated cluster is hosted. The configuration process varies depending on the destination you choose. + + Navigate to the overview page of the target TiDB Cloud Premium instance. Click **Data** > **Changefeed** in the left navigation pane, click **Create Changefeed** to go to the **Destination** page, and then select **Amazon S3** or **Alibaba Cloud OSS** as the destination, depending on the cloud provider on which your TiDB Cloud Premium instance is hosted. The configuration process varies depending on the destination you choose. + @@ -83,7 +82,9 @@ To use an access key for authentication, follow these steps: - **Secret Access Key** + +
For **GCS**, before filling **GCS Endpoint**, you need to first grant the GCS bucket access. Take the following steps: @@ -179,8 +180,11 @@ For **Azure Blob Storage**, you must configure the container and get a SAS token - **SAS Token**: enter the generated SAS token obtained in step 3.
+ + +
For **Alibaba Cloud OSS**, follow these steps to configure the changefeed: @@ -200,6 +204,7 @@ For **Alibaba Cloud OSS**, follow these steps to configure the changefeed: - **Bucket URI**: enter the OSS URI in the format `oss:////`. - **Access Key ID**: enter the AccessKey ID from the RAM user. - **Access Key Secret**: enter the AccessKey Secret from the RAM user. +
From ae8606e0a022a357753f92cdcced6250bdc49882 Mon Sep 17 00:00:00 2001 From: Grace Cai Date: Fri, 21 Aug 2026 16:55:45 +0800 Subject: [PATCH 04/11] update customcontent --- .../changefeed-sink-to-cloud-storage.md | 33 ++++++++++++++----- 1 file changed, 24 insertions(+), 9 deletions(-) diff --git a/tidb-cloud/changefeed-sink-to-cloud-storage.md b/tidb-cloud/changefeed-sink-to-cloud-storage.md index a543bb719914e..52f97c9206596 100644 --- a/tidb-cloud/changefeed-sink-to-cloud-storage.md +++ b/tidb-cloud/changefeed-sink-to-cloud-storage.md @@ -6,22 +6,28 @@ summary: This document explains how to create a changefeed to stream data from T # Sink to Cloud Storage -This document describes how to create a changefeed to stream data from TiDB Cloud to cloud storage. +This document describes how to create a changefeed to stream data from TiDB Cloud DedicatedTiDB Cloud Premium to cloud storage. + + > **Note:** > - -> - To stream data to cloud storage, make sure that your TiDB cluster version is v7.1.1 or later. To upgrade your TiDB Cloud Dedicated cluster to v7.1.1 or later, [contact TiDB Cloud Support](/tidb-cloud/tidb-cloud-support.md). -> - For [{{{ .premium }}}](/tidb-cloud/select-cluster-tier.md#premium) instances, see [Sink to Cloud Storage](/tidb-cloud/changefeed-sink-to-cloud-storage.md?plan=premium). +> - To stream data from {{{ .dedicated }}} to cloud storage, make sure that your TiDB cluster version is v7.1.1 or later. To upgrade your TiDB Cloud Dedicated cluster to v7.1.1 or later, [contact TiDB Cloud Support](/tidb-cloud/tidb-cloud-support.md). +> - For [{{{ .starter }}}](/tidb-cloud/select-cluster-tier.md#starter) instances, the changefeed feature is unavailable. +> - For [{{{ .essential }}}](/tidb-cloud/select-cluster-tier.md#essential) instances, the changefeed feature is only available upon request. For more information, see [Changefeed](/tidb-cloud/essential-changefeed-overview.md). +> - For [{{{ .premium }}}](/tidb-cloud/select-cluster-tier.md#premium) instances, see [Sink to Cloud Storage](https://docs.pingcap.com/tidbcloud/changefeed-sink-to-cloud-storage/?plan=premium). + + -> - For [{{{ .dedicated }}}](/tidb-cloud/select-cluster-tier.md#tidb-cloud-dedicated) instances, see [Sink to Cloud Storage](/tidb-cloud/changefeed-sink-to-cloud-storage.md). - -> - To stream data to cloud storage, make sure that your TiDB cluster version is v7.1.1 or later. To upgrade your TiDB Cloud Dedicated cluster to v7.1.1 or later, [contact TiDB Cloud Support](/tidb-cloud/tidb-cloud-support.md). - + +> **Note:** +> > - For [{{{ .starter }}}](/tidb-cloud/select-cluster-tier.md#starter) instances, the changefeed feature is unavailable. > - For [{{{ .essential }}}](/tidb-cloud/select-cluster-tier.md#essential) instances, the changefeed feature is only available upon request. For more information, see [Changefeed](/tidb-cloud/essential-changefeed-overview.md). +> - For [{{{ .dedicated }}}](/tidb-cloud/select-cluster-tier.md#tidb-cloud-dedicated) clusters, see [Sink to Cloud Storage](https://docs.pingcap.com/tidbcloud/changefeed-sink-to-cloud-storage/). + ## Restrictions @@ -34,6 +40,7 @@ This document describes how to create a changefeed to stream data from TiDB Clou Navigate to the overview page of the target TiDB Cloud Dedicated cluster. Click **Data** > **Changefeed** in the left navigation pane, click **Create Changefeed** to go to the **Destination** page, and then select **Amazon S3**, **GCS**, or **Azure Blob Storage** as the destination, depending on the cloud provider on which your TiDB Cloud Dedicated cluster is hosted. The configuration process varies depending on the destination you choose. + @@ -140,6 +147,11 @@ For **GCS**, before filling **GCS Endpoint**, you need to first grant the GCS bu 7. In the TiDB Cloud console, go to the Changefeed's **Destination** page, and fill in the **bucket gsutil URI** field. + + + + +
For **Azure Blob Storage**, you must configure the container and get a SAS token in the Azure portal first. Take the following steps: @@ -183,9 +195,10 @@ For **Azure Blob Storage**, you must configure the container and get a SAS token - +
+ For **Alibaba Cloud OSS**, follow these steps to configure the changefeed: 1. In the [Alibaba Cloud console](https://www.alibabacloud.com/), perform the following prerequisite steps: @@ -206,7 +219,9 @@ For **Alibaba Cloud OSS**, follow these steps to configure the changefeed: - **Access Key Secret**: enter the AccessKey Secret from the RAM user.
+ + Click **Next** to establish the connection from the TiDB Cloud Dedicated cluster to Amazon S3, GCS, or Azure Blob Storage. TiDB Cloud will automatically test and verify if the connection is successful. From 14568aba853920f4d7117f99efdf3f40b809babc Mon Sep 17 00:00:00 2001 From: Howard Chen Date: Thu, 20 Aug 2026 17:05:32 +0800 Subject: [PATCH 05/11] Add toc. --- TOC-tidb-cloud-premium.md | 1 + 1 file changed, 1 insertion(+) diff --git a/TOC-tidb-cloud-premium.md b/TOC-tidb-cloud-premium.md index 93aeceaa0b66c..015e36ce1b9e6 100644 --- a/TOC-tidb-cloud-premium.md +++ b/TOC-tidb-cloud-premium.md @@ -140,6 +140,7 @@ - [Changefeed Overview](/tidb-cloud/changefeed-overview.md) - [To MySQL Sink](/tidb-cloud/changefeed-sink-to-mysql.md) - [To Kafka Sink](/tidb-cloud/changefeed-sink-to-apache-kafka.md) + - [To Cloud Storage](tidb-cloud/changefeed-sink-to-cloud-storage.md) - Reference - [Set Up Self-Hosted Kafka Private Link Service in AWS](/tidb-cloud/setup-aws-self-hosted-kafka-private-link-service.md) - [Set Up Private Endpoint for Changefeeds](/tidb-cloud/premium/set-up-sink-private-endpoint-premium.md) From 1e8e6c8a501d4f8c76e4b0768a5cbbc82f19fe66 Mon Sep 17 00:00:00 2001 From: Howard Chen Date: Fri, 21 Aug 2026 19:57:02 +0800 Subject: [PATCH 06/11] Update an oss doc link. --- tidb-cloud/changefeed-sink-to-cloud-storage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tidb-cloud/changefeed-sink-to-cloud-storage.md b/tidb-cloud/changefeed-sink-to-cloud-storage.md index 52f97c9206596..9fd0e217ea406 100644 --- a/tidb-cloud/changefeed-sink-to-cloud-storage.md +++ b/tidb-cloud/changefeed-sink-to-cloud-storage.md @@ -203,7 +203,7 @@ For **Alibaba Cloud OSS**, follow these steps to configure the changefeed: 1. In the [Alibaba Cloud console](https://www.alibabacloud.com/), perform the following prerequisite steps: - 1. Create an OSS bucket in the same region as your TiDB cluster. For detailed instructions, see [Create buckets](https://www.alibabacloud.com/help/en/oss/user-guide/create-buckets). + 1. Create an OSS bucket in the same region as your TiDB cluster. For detailed instructions, see [Create a bucket](https://www.alibabacloud.com/help/en/oss/user-guide/create-a-bucket-4). 2. Create a RAM user for the changefeed and generate an AccessKey pair. For detailed instructions, see [Create an AccessKey pair](https://www.alibabacloud.com/help/en/ram/user-guide/create-an-accesskey-pair). 3. Grant the RAM user OSS permissions. For the required permissions, see [OSS permissions and access control](https://www.alibabacloud.com/help/en/oss/user-guide/permissions-and-access-control-overview). The RAM user needs at least the following permissions: From bb4ac46d89db5d921e245c08608a6e447f5538d9 Mon Sep 17 00:00:00 2001 From: Howard Chen Date: Fri, 21 Aug 2026 20:08:55 +0800 Subject: [PATCH 07/11] Add policy example. --- .../changefeed-sink-to-cloud-storage.md | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/tidb-cloud/changefeed-sink-to-cloud-storage.md b/tidb-cloud/changefeed-sink-to-cloud-storage.md index 9fd0e217ea406..dbc84ae88aae6 100644 --- a/tidb-cloud/changefeed-sink-to-cloud-storage.md +++ b/tidb-cloud/changefeed-sink-to-cloud-storage.md @@ -212,6 +212,29 @@ For **Alibaba Cloud OSS**, follow these steps to configure the changefeed: - `oss:PutObject` - `oss:DeleteObject` + The following JSON example shows a policy with the required permissions. Replace `` with the name of your OSS bucket. + + ```json + { + "Version": "1", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "oss:ListObjects", + "oss:GetObject", + "oss:PutObject", + "oss:DeleteObject" + ], + "Resource": [ + "acs:oss:*:*:", + "acs:oss:*:*:/*" + ] + } + ] + } + ``` + 2. On the **Destination** page for Alibaba Cloud OSS, fill in the following fields: - **Bucket URI**: enter the OSS URI in the format `oss:////`. From dc73e25ec8e0471d221c8dc30fe8fd16cea7445e Mon Sep 17 00:00:00 2001 From: qiancai Date: Mon, 24 Aug 2026 10:16:55 +0800 Subject: [PATCH 08/11] Update changefeed-sink-to-cloud-storage.md --- tidb-cloud/changefeed-sink-to-cloud-storage.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tidb-cloud/changefeed-sink-to-cloud-storage.md b/tidb-cloud/changefeed-sink-to-cloud-storage.md index dbc84ae88aae6..ece655c1c8c09 100644 --- a/tidb-cloud/changefeed-sink-to-cloud-storage.md +++ b/tidb-cloud/changefeed-sink-to-cloud-storage.md @@ -58,7 +58,7 @@ For **Amazon S3**, you can use either **AWS Role ARN** or **AWS access key** for To use an IAM Role for authentication, follow these steps: -1. On the **Destination** page for Amazon S3, enter the **S3 URI**. Make sure that the S3 bucket is in the same AWS region as your TiDB cluster. +1. On the **Destination** page for Amazon S3, enter the **S3 URI**. Make sure that the S3 bucket is in the same AWS region as your TiDB Cloud Dedicated clusterTiDB Cloud Premium instance. 2. Under **Bucket Access**, select **AWS Role ARN**. 3. To create a new Role ARN, click **Click here to create new one with AWS CloudFormation**. This template automatically configures the required permissions. @@ -81,7 +81,7 @@ To use an IAM Role for authentication, follow these steps: To use an access key for authentication, follow these steps: -1. On the **Destination** page for Amazon S3, enter the **S3 URI**. Make sure that the S3 bucket is in the same AWS region as your TiDB cluster. +1. On the **Destination** page for Amazon S3, enter the **S3 URI**. Make sure that the S3 bucket is in the same AWS region as your TiDB Cloud Dedicated clusterTiDB Cloud Premium instance. 2. Under **Bucket Access**, select **AWS Access Key**. 3. Fill in the following fields: From aebdc16dd5fc8b0ca03d238dd3d6b3840dbadf00 Mon Sep 17 00:00:00 2001 From: Grace Cai Date: Mon, 24 Aug 2026 10:18:21 +0800 Subject: [PATCH 09/11] Apply suggestions from code review --- TOC-tidb-cloud-premium.md | 2 +- tidb-cloud/changefeed-sink-to-cloud-storage.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/TOC-tidb-cloud-premium.md b/TOC-tidb-cloud-premium.md index 015e36ce1b9e6..135b1e6bdbf86 100644 --- a/TOC-tidb-cloud-premium.md +++ b/TOC-tidb-cloud-premium.md @@ -140,7 +140,7 @@ - [Changefeed Overview](/tidb-cloud/changefeed-overview.md) - [To MySQL Sink](/tidb-cloud/changefeed-sink-to-mysql.md) - [To Kafka Sink](/tidb-cloud/changefeed-sink-to-apache-kafka.md) - - [To Cloud Storage](tidb-cloud/changefeed-sink-to-cloud-storage.md) + - [To Cloud Storage](/tidb-cloud/changefeed-sink-to-cloud-storage.md) - Reference - [Set Up Self-Hosted Kafka Private Link Service in AWS](/tidb-cloud/setup-aws-self-hosted-kafka-private-link-service.md) - [Set Up Private Endpoint for Changefeeds](/tidb-cloud/premium/set-up-sink-private-endpoint-premium.md) diff --git a/tidb-cloud/changefeed-sink-to-cloud-storage.md b/tidb-cloud/changefeed-sink-to-cloud-storage.md index ece655c1c8c09..d9de21deb98fb 100644 --- a/tidb-cloud/changefeed-sink-to-cloud-storage.md +++ b/tidb-cloud/changefeed-sink-to-cloud-storage.md @@ -237,7 +237,7 @@ For **Alibaba Cloud OSS**, follow these steps to configure the changefeed: 2. On the **Destination** page for Alibaba Cloud OSS, fill in the following fields: - - **Bucket URI**: enter the OSS URI in the format `oss:////`. + - **Bucket URI**: enter the OSS URI in the format `oss:////`. - **Access Key ID**: enter the AccessKey ID from the RAM user. - **Access Key Secret**: enter the AccessKey Secret from the RAM user. @@ -247,7 +247,7 @@ For **Alibaba Cloud OSS**, follow these steps to configure the changefeed: -Click **Next** to establish the connection from the TiDB Cloud Dedicated cluster to Amazon S3, GCS, or Azure Blob Storage. TiDB Cloud will automatically test and verify if the connection is successful. +Click **Next** to establish the connection from the TiDB Cloud Dedicated clusterTiDB Cloud Premium instance to your cloud storage. TiDB Cloud will automatically test and verify if the connection is successful. - If yes, you are directed to the next step of configuration. - If not, a connectivity error is displayed, and you need to handle the error. After the error is resolved, click **Next** to retry the connection. From 434358be716b357d1f930fdb487245cee7736356 Mon Sep 17 00:00:00 2001 From: Howard Chen Date: Mon, 24 Aug 2026 10:35:22 +0800 Subject: [PATCH 10/11] Add more detail to custom RAM policy setup. --- tidb-cloud/changefeed-sink-to-cloud-storage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tidb-cloud/changefeed-sink-to-cloud-storage.md b/tidb-cloud/changefeed-sink-to-cloud-storage.md index d9de21deb98fb..a5d488b4b6e90 100644 --- a/tidb-cloud/changefeed-sink-to-cloud-storage.md +++ b/tidb-cloud/changefeed-sink-to-cloud-storage.md @@ -205,7 +205,7 @@ For **Alibaba Cloud OSS**, follow these steps to configure the changefeed: 1. Create an OSS bucket in the same region as your TiDB cluster. For detailed instructions, see [Create a bucket](https://www.alibabacloud.com/help/en/oss/user-guide/create-a-bucket-4). 2. Create a RAM user for the changefeed and generate an AccessKey pair. For detailed instructions, see [Create an AccessKey pair](https://www.alibabacloud.com/help/en/ram/user-guide/create-an-accesskey-pair). - 3. Grant the RAM user OSS permissions. For the required permissions, see [OSS permissions and access control](https://www.alibabacloud.com/help/en/oss/user-guide/permissions-and-access-control-overview). The RAM user needs at least the following permissions: + 3. Grant the RAM user custom RAM policy permissions to strictly limit access to the changefeed bucket prefix (least privilege). For policy structure, see [OSS permissions and access control](https://www.alibabacloud.com/help/en/oss/user-guide/permissions-and-access-control-overview). - `oss:ListObjects` - `oss:GetObject` From cf49cfddd502d6f0da349950321493777f3a0eb4 Mon Sep 17 00:00:00 2001 From: Ginkgoch Date: Mon, 24 Aug 2026 11:11:03 +0800 Subject: [PATCH 11/11] Apply suggestions from code review Co-authored-by: Grace Cai --- tidb-cloud/changefeed-sink-to-cloud-storage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tidb-cloud/changefeed-sink-to-cloud-storage.md b/tidb-cloud/changefeed-sink-to-cloud-storage.md index a5d488b4b6e90..25d5c9f80816c 100644 --- a/tidb-cloud/changefeed-sink-to-cloud-storage.md +++ b/tidb-cloud/changefeed-sink-to-cloud-storage.md @@ -205,7 +205,7 @@ For **Alibaba Cloud OSS**, follow these steps to configure the changefeed: 1. Create an OSS bucket in the same region as your TiDB cluster. For detailed instructions, see [Create a bucket](https://www.alibabacloud.com/help/en/oss/user-guide/create-a-bucket-4). 2. Create a RAM user for the changefeed and generate an AccessKey pair. For detailed instructions, see [Create an AccessKey pair](https://www.alibabacloud.com/help/en/ram/user-guide/create-an-accesskey-pair). - 3. Grant the RAM user custom RAM policy permissions to strictly limit access to the changefeed bucket prefix (least privilege). For policy structure, see [OSS permissions and access control](https://www.alibabacloud.com/help/en/oss/user-guide/permissions-and-access-control-overview). + 3. Create and attach a custom RAM policy to the RAM user to grant only the minimum permissions required by the changefeed. For more information, see [Control access to OSS resources with RAM policies](https://www.alibabacloud.com/help/en/oss/user-guide/ram-policy). - `oss:ListObjects` - `oss:GetObject`