Adding and Authorizing Database Assets

Adding a User-Built Database Instance

You can add and delete user-built database instances. For details about the database types and versions supported by DSC, see Data Source Types and Versions Supported by DSC.

Before adding a user-built database asset, you can use the Database Scan function to detect the IP address and port and determine whether it is a database asset based on the returned result.

This section describes how to add a user-built database on the cloud.

1. Log in to the DSC console.
2. Click in the upper left corner and select a region or project.
3. In the navigation pane on the left, choose Asset Center > Asset Management.
4. Choose Databases > Self-built databases. The Databases tab is displayed.
5. Click the Database Instances tab.
6. Click Add Instance in the upper left corner of the database instance list. The Add Database Instance dialog box is displayed. Set related parameters based on Table 2 and click OK to add a user-built database instance.
   Figure 1 Adding a database instance
   

   Table 2 Configuring database instance information

   Parameter	Description
   Region	By default, it is the region selected in the upper left corner of the console.
   Organization Member Account	This parameter is displayed if you have added an organization member to DSC based on Multi-Account Management. Click to select an account and view its information.
   ECS	Select the ECS of the user-built database instance from the drop-down list.
   Security Group	Select a security group from the drop-down list.
   Database Engine	Select a DB engine from the drop-down list. Currently, the DB engines in Data Source Types and Versions Supported by DSC are supported.
   Version	Select a DB engine version from the drop-down list box.
   Connection Method	This parameter is displayed when Database Engine is set to Oracle. Select a connection mode from the drop-down list. Service Name: Enter the service name. SID: Enter the SID.
   Schema	Enter the database schema name when Database Engine is set to DMDBMS.
   Database Server Address	Select a server address from the drop-down list box. If the database is deployed in the cluster mode and data masking is required, set this parameter to the IP address of the primary node.
   Port	Enter an integer ranging from 0 to 65535.
   Database	Enter a database name.
   Username/Password	Enter the username and password of the database.
   Asset	Enter 4 to 255 characters. Only letters, digits, hyphens (-), and "_" are allowed. The value must start with a letter.
   Creating a metadata drawing task	Databases of a metadata task are supported. After this function is enabled, metadata tasks are automatically delivered based on the default database of the instance to obtain the database, table, and column information of the instance. If Database Engine is set to SQL Server, Oracle, MongoDB, or GaussDB, metadata drawing tasks cannot be created.

7. After an instance is added, if you need to identify and mask sensitive data in the databases of the instance, authorize access to the databases first. For details, see Authorizing Access to a Database Asset.

Adding a User-Built External Database Instance

You can use Direct Connect to connect your on-premises assets to the proxy VPCs in the cloud, and subsequently add your on-premises databases to DSC.

1. Log in to the DSC console.
2. Click in the upper left corner and select a region or project.
3. In the navigation pane on the left, choose Asset Center > Asset Management.
4. Choose Databases > Self-built databases. The Databases tab is displayed.
5. Click the Database Instances tab.
6. Click Add External Database Instance in the upper left corner. The Add Database Instance dialog box is displayed.
   Figure 2 Adding a User-Built External Database Instance
   

7. Set parameters based on Table 3 and click OK.

   Table 3 Configuring database instance information

   Parameter	Description
   Region	Region where the instance is deployed.
   Proxy VPC	Select a proxy VPC from the drop-down list.
   Subnet	Select a subnet from the drop-down list.
   Security Group	Select a security group from the drop-down list.
   Database Engine	Select a DB engine from the drop-down list. Currently, the DB engines in Data Source Types and Versions Supported by DSC are supported.
   Version	Select a DB engine version from the drop-down list box.
   Connection Method	This parameter is displayed when Database Engine is set to Oracle. Select a connection mode from the drop-down list. Service Name: Enter the service name. SID: Enter the SID.
   Database Server Address	Enter the IP address of the host where the asset is located.
   Port	Enter an integer ranging from 0 to 65535.
   Database	Enter a database name.
   Username	Enter the database username.
   Password	Enter the database password.
   Asset	Enter 4 to 255 characters. Only letters, digits, hyphens (-), and "_" are allowed. The value must start with a letter.

8. After Creating a metadata drawing task is enabled, metadata tasks are automatically delivered based on the default database of the instance to obtain the database, table, and column information of the instance.
9. After an instance is added, if you need to identify and mask sensitive data in the databases of the instance, authorize access to the databases first. For details, see Authorizing Access to a Database Asset.

Adding User-Built External Instances and Databases in Batches

You can use Direct Connect to connect your on-premises assets to the proxy VPCs in the cloud, and subsequently add your on-premises databases to DSC in batches.

1. Log in to the DSC console.
2. Click in the upper left corner and select a region or project.
3. In the navigation pane on the left, choose Asset Center > Asset Management.
4. Choose Databases > Self-built databases. The Database Instances tab is displayed.
5. Click the Database Instances tab.
6. Click Add Instances and Databases in Batches in the upper left corner.
7. In the displayed dialog box, click Download Template to download the Excel template and set parameters based on Table 4.

   Table 4 Database Instance Information

   Parameter	Description
   Asset Name	User-defined asset name displayed in the database instance list.
   ECS Instance ID	You do not need to enter the ID for an external user-built database. However, if you purchase an ECS user-built database, you must enter the ID of the corresponding ECS instance.
   Oracle SID	Enter the SID of the Oracle database.
   Oracle Service Name	Enter the Oracle service name.
   Proxy VPC	This parameter is optional for cloud databases and is mandatory for external user-built databases. It corresponds to the proxy VPC of the ECS.
   Subnet	This parameter is optional for cloud databases and is mandatory for external ECSs. It corresponds to the ECS subnet ID.
   Security Group	This parameter is optional for cloud databases and mandatory for external ECSs. It corresponds to the security group of the ECS.
   Database Engine	If an ECS instance has been added, the engine of the added ECS will be used.
   Version	If an ECS instance has been added, the version of the added ECS will be used.
   Host IP Address	If an ECS has been added, the IP address of the added ECS will be used.
   Port	If an ECS has been added, the port of the added ECS will be used.
   Database	Database name
   User	Database account
   Password	Database password

8. Click Select File, select the prepared template, and click OK.
9. After an instance is added, if you need to identify and mask sensitive data in the databases of the instance, authorize access to the databases first. For details, see Authorizing Access to a Database Asset.

Adding a Cross-Account or Cross-VPC DWS Instance

1. Log in to the DSC console.
2. Click in the upper left corner and select a region or project.
3. In the navigation pane on the left, choose Asset Center > Asset Management.
4. Choose Databases > DWS. The Database Instances tab is displayed.
5. Click the Database Instances tab. In the upper left corner of the instance list, click Add Cross-Account or Cross-VPC Instance. The Add Database Instance dialog box is displayed.
   Figure 3 Adding a database instance
   

6. Set parameters based on Table 5 and click OK.

   Table 5 Parameters for configuring a cross-account/cross-VPC instance

   Parameter	Description
   Proxy VPC	Choose a proxy VPC from the dropdown list.
   Subnet	Select a subnet from the drop-down list.
   Security Group	Select a security group from the drop-down list.
   Instance Name	Enter the name of the instance to be added.
   Version	Select a version from the drop-down list. For details about the supported versions, see Data Source Types and Versions Supported by DSC.
   Database Server Address	Enter the obtained host IP address.
   Port	Enter a database port.
   Database	Enter a database name.
   Username	Enter the username for connecting to the database.
   Password	Enter the password for connecting to the database.
   Asset	Enter an asset name. Enter 4 to 255 characters. Only letters, digits, hyphens (-), and "_" are allowed. The value must start with a letter.
   Creating a metadata drawing task	After Creating a metadata drawing task is enabled, metadata tasks are automatically delivered based on the default database of the instance to obtain the database, table, and column information of the instance.

7. After an instance is added, if you need to identify and mask sensitive data in the databases of the instance, authorize access to the databases first. For details, see Authorizing Access to a Database Asset.

Authorizing Access to Cloud Databases and User-Built Databases

1. Log in to the DSC console.
2. Click in the upper left corner and select a region or project.
3. In the navigation pane on the left, choose Asset Center > Asset Management.
4. Click RDS. The RDS Databases tab is displayed.
   Figure 4 RDS database instances
   

5. Click the Database Instances tab. Authorization can be performed in either of the following ways:
   • Method 1
     1. Locate the database instance in the list and click Authorize in the Operation column. Then, enter the database information for authorization.
        Figure 5 Database authorization
        

     2. Configure Permission Settings (required only for RDS databases).
        • Grant the read-only permission: Only the sensitive data identification function can be used.
        • Grant the read and write permission: The sensitive data identification and data anonymization functions can be used.
          

          • After the RDS read-only permission is authorized, DSC creates the account dsc_readonly in RDS.
            • After the password of the dsc_readonly account is reset in RDS, the new password is not automatically synchronized to DSC. As a result, the sensitive data identification task will fail. For this reason, do not reset the password of this account.
            • If you have reset the password of dsc_readonly in RDS, delete the authorized RDS DB instance in DSC and configure permissions on the instance again.
          • DSC cannot scan and mask sensitive data in MySQL databases within RDS instances where SSL has been enabled.
     3. Enter the database name, asset name, username, and password.
        • The database name can contain only letters, digits, underscores (_), and hyphens (-).
        • The asset name must contain 4 to 255 characters.
     4. (Optional) Select a group from the drop-down list. After selecting a group, you can view the group information on the asset group management page. If you do not select a group, the asset is displayed in default group list by default.
     5. Click Add to add multiple databases for authorization at the same time.
   • Method 2
     1. Click the instance name to go to the instance details page. Click Authorize in the Operation column for database authorization.
        Figure 6 Instance details
        
     2. Select multiple databases and click Authorize Selected in the upper left corner to authorize them in batches.
     3. Enter the database name, asset name, username, and password.
        • The database name can contain only letters, digits, underscores (_), and hyphens (-).
        • The asset name must contain 4 to 255 characters.
     4. (Optional) Select a group from the drop-down list. After selecting a group, you can view the group information on the asset group management page. If you do not select a group, the asset is displayed in default group list by default.
     5. Click Add to add multiple databases for authorization at the same time.

6. After the authorization is complete, click the Databases tab to view the connection status of the authorized database.
   After the asset authorization is complete, the Connection Status of the asset is Checking, which means DSC is checking the database connectivity.

   • DSC can access the added database normally if the Connection Status of the database is Succeeded.
   • DSC cannot access the added database normally if the Connection Status of the database is Failed. Hover the cursor over Failed to view the failure cause or rectify the fault by referring to How Do I Troubleshoot the Failure in Connecting to the Added Database?