Help Center/ GeminiDB/ GeminiDB DynamoDB-Compatible API/ Best Practices/ Security Best Practices for GeminiDB DynamoDB-Compatible API
Updated on 2026-03-02 GMT+08:00
View PDF
Share

Security Best Practices for GeminiDB DynamoDB-Compatible API

Security is a shared responsibility between Huawei Cloud and you. Huawei Cloud provides secure cloud services. As a tenant, you should properly use the security capabilities provided by cloud services to protect data, and securely use the cloud. For details, see Shared Responsibility.

This section provides best practices for enhancing security of GeminiDB DynamoDB-Compatible API. You can continuously evaluate the security status of your GeminiDB DynamoDB-Compatible instances and combine different security capabilities provided by GeminiDB DynamoDB-Compatible API. By doing this, data in GeminiDB DynamoDB-Compatible instances can be protected from being disclosed or tampered with.

Consider the following aspects for your security configurations:

Avoiding Binding EIPs to GeminiDB DynamoDB-Compatible Instances for Internet Access

Do not deploy GeminiDB DynamoDB-Compatible API on the Internet or DMZ. Deploy GeminiDB DynamoDB-Compatible API on your internal network and use routers or firewalls to protect GeminiDB DynamoDB-Compatible API. Do not bind EIPs to GeminiDB DynamoDB-Compatible instances for Internet access. This prevents unauthorized access and DDoS attacks. You are not advised to bind EIPs to instances. If EIPs are necessary, set security groups.

Avoiding Weak Passwords

When setting or changing an account password, ensure that the password meets the password complexity requirements and do not use weak passwords. By doing so, passwords can be protected from hacker and rainbow table attacks. You can check password strength using the API.

Enabling SSL

If SSL is disabled, data transmitted between the DynamoDB client and server is vulnerable to eavesdropping, tampering, and man-in-the-middle attacks. To improve data transmission security, you are advised to enable SSL. For details, see Encrypting Data over SSL.

Enabling SSL and Setting the CCM PCA or SSL Certificate

Since April 2017, GeminiDB has offered a new root certificate that has a 20-year validation period. The new certificate takes effect after DB instances are rebooted. Replace the old certificate before it expires to improve system security.

Using a Unique CCM Certificate for Each Instance

Configuring a unique SSL certificate for each instance can significantly improve the system security and help organizations better cope with potential threats.

Replacing the Instance Certificate Before It Expires

You can configure notification policies for the instance certificate before it expires. Renew or replace the certificate in a timely manner to avoid affecting instance functions.

Enabling Disk Encryption

Disk encryption improves data security. For details, see the description about disk encryption in Buying a GeminiDB DynamoDB-Compatible Instance.

Enabling Data Backup

GeminiDB DynamoDB-Compatible instances support automated and manual backups. You can periodically back up databases. If a database is faulty or data is corrupted, you can restore the database using backups to ensure data reliability. For details, see Data Backup.

Configuring Monitoring by Seconds and Alarm Rules

GeminiDB DynamoDB-Compatible instances are monitored by default. If a metric exceeds the specified threshold, an alarm is triggered and automatically sent to the cloud account through SMN, so you can stay on top of your GeminiDB DynamoDB-Compatible instance status. Configure monitoring and alarm rules based on service requirements. For details, see Monitoring and Alarms.

Upgrading the Version

A minor version of GeminiDB DynamoDB-Compatible API can be upgraded to add new functions, fix issues, and improve security and performance. You are advised to upgrade the version in a timely manner.

Parent Topic: Best Practices