Buying an RDS for PostgreSQL Instance and Connecting to It Using a PostgreSQL Client

Operation Process

Preparations

1. Sign up for a HUAWEI ID and enable Huawei Cloud services.
2. For fine-grained permissions management on Huawei Cloud resources, use Identity and Access Management (IAM) to create a user and user group and grant the user specific operation permissions. For details, see Creating a User and Granting Permissions.

Step 1: Buy an RDS for PostgreSQL DB Instance

1. Go to the Buy DB Instance page.
2. On the Quick Config page, set basic parameters.
   

   Only mandatory parameters are provided on the Quick Config page. If the available parameters do not match your workloads, try Custom Config.

   The following parameter settings are only for reference.

   Figure 1 Basic Settings
   

   Parameter	Example Value	Description
   Billing Mode	Pay-per-use	The billing mode of an instance. Yearly/Monthly: A prepaid billing mode in which you pay for resources before using it. Bills are settled based on the subscription period. The longer the subscription, the bigger the discount. This mode is a good option for long-term, stable services. Pay-per-use: A postpaid billing mode. You pay as you go and just pay for what you use. The DB instance usage is calculated by the second but billed every hour. This mode allows you to adjust resource usage easily. You neither need to prepare for resources in advance, nor end up with excessive or insufficient preset resources.
   Region	CN-Hong Kong	The region where your resources are located. NOTE: Products in different regions cannot communicate with each other through a private network. After a DB instance is created, the region cannot be changed. Therefore, exercise caution when selecting a region.
   DB Engine Version	16	The database version.
   DB Instance Type	Primary/Standby	The architecture type of an instance. Primary/Standby: An HA architecture. In a primary/standby pair, each instance has the same instance class. When a primary instance is being created, a standby instance is provisioned along with it to provide data redundancy. The standby instance is invisible to you after being created.
   Instance Class	General-purpose | 4 vCPU | 8 GB	The vCPUs and memory of an instance.
   Storage	Cloud SSD | 100 GB	The storage space of an instance. It contains the system overhead required for inodes, reserved blocks, and database operation.
   Disk Encryption	Disable	Enabling disk encryption improves data security, but slightly affects the read and write performance of the database. If a shared KMS key is used, the corresponding CTS events are createdatakey and decrydatakey. Only the key owner can receive the events.

3. Complete advanced configurations.
   Figure 2 Additional Options
   

   Parameter	Example Value	Description
   VPC	default_vpc	The virtual network in which your instance is located. A VPC can isolate networks for different workloads. If no VPC is available, click Create VPC. After a VPC is created, click . For details, see Creating a VPC and Subnet.
   Subnet	default_subnet	A subnet provides dedicated network resources that are logically isolated from other networks for network security.
   Security Group	default	It can enhance security by controlling access to RDS for PostgreSQL from other services.
   Enterprise Project	default	If your account has been associated with an enterprise project, select the target project from the Enterprise Project drop-down list. For more information about enterprise projects, see Enterprise Management User Guide.
   Quantity	1	The number of instances to be created in a batch.

4. Click Buy.
5. Check the purchased DB instance.
   Figure 3 Instance successfully purchased
   

Step 2: Buy an ECS

1. Go to the Elastic Cloud Server console.
2. Check whether there is a Linux ECS that meets the requirements.
   

   RDS for PostgreSQL supports the following client installation methods:

   • Download the PostgreSQL client installation package. This method is recommended for PostgreSQL 15 and earlier versions. It has requirements on ECS images. For details, see the official PostgreSQL documentation.
   • Download the source code. This method has no requirements on PostgreSQL versions or ECS images.
   • If yes, go to 3.
   • If no, purchase an ECS and select Linux (for example, CentOS 7) as its OS.

     To download the PostgreSQL client to the ECS, bind an EIP to the ECS. The ECS must be in the same region, VPC, and security group as the RDS for PostgreSQL DB instance for mutual communications.

     For details about how to purchase a Linux ECS, see Purchasing a Custom ECS in Elastic Cloud Server User Guide.

3. Check whether the ECS and RDS for PostgreSQL instance are in the same region and VPC.
   Figure 4 ECS information
   
   Figure 5 Overview
   
   • If they are not in the same region, purchase another ECS. The ECS and DB instance in different regions cannot communicate with each other. To reduce network latency, deploy your DB instance in the region nearest to your workloads.
   • If the ECS and DB instance are in different VPCs, change the VPC of the ECS to that of the DB instance. For details, see Changing a VPC.

Step 3: Test Connectivity and Install a PostgreSQL Client

Step 4: Connect to the DB Instance Using a CLI (SSL Connection)

1. On the Instances page of the RDS console, click the DB instance name to go to the Overview page.
2. In the navigation pane, choose Connectivity & Security.
3. In the Connection Information area, click next to the SSL field to download Certificate Download.zip, and extract the root certificate ca.pem and bundle ca-bundle.pem from the package.
   Figure 15 Downloading a certificate
   
4. Upload ca.pem to the ECS.
   

   • TLS v1.2 or later is recommended. Versions earlier than TLS v1.2 have security risks.
   • The recommended protocol algorithm is EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EDH+aRSA+AESGCM:EDH+aDSS+AESGCM:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!SRP:!RC4. Using other options have security risks.
   • ca-bundle.pem contains both the new certificate provided as of April 2017 and the old certificate.
   • Both ca.pem and ca-bundle.pem can be used for SSL connections because ca-bundle.pem contains ca.pem.
5. Run the following command on the ECS to connect to the DB instance:

   psql --no-readline -h <host> -p <port> "dbname=<database> user=<user> sslmode=verify-ca sslrootcert=<ca-file-directory>"

   Example:

   psql --no-readline -h 192.168.0.7 -p 5432 "dbname=postgres user=root sslmode=verify-ca sslrootcert=/root/ca.pem"

   Table 1 Parameter description

   Parameter	Example Value	Description
   <host>	192.168.0.7	Floating IP address obtained in 3.
   <port>	5432	Database port obtained in 3. The default value is 5432.
   <database>	postgres	Name of the database to be connected. The default database name is postgres.
   <user>	root	Administrator account root.
   <ca-file-directory>	/root/ca.pem	Directory of the CA certificate used for the SSL connection. This certificate should be stored in the directory where the command is executed.
   sslmode	verify-ca	SSL connection mode. Set it to verify-ca to use a CA to check whether the service is trusted.

6. Enter the password of the database account as prompted.

   Password:

   If the following information is displayed, the connection is successful.

   SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off)

Follow-up Operations

After logging in to the DB instance, you can create or migrate databases.

• Creating a PostgreSQL Database Using an API
• Managing PostgreSQL Databases Using DAS
• Migration Solution Overview