Purchasing and Enabling DBSS

Database Security Service (DBSS) is an intelligent database security service. Based on the big data analytics technologies, it can audit your databases, detect SQL injection attacks, and identify high-risk operations.

The section describes how to purchase the professional edition to manage one database and enable DBSS. You can use the default audit rules to detect abnormal behavior through multi-dimensional analysis, real-time alarms, and reports.

Operation Process

Procedure	Description
Preparation	You need to register a HUAWEI ID and top up your account.
Step 1: Buy Starter Edition DBSS	Set the configuration items, such as the subnet, security group, and required duration, and purchase DBSS of the starter edition.
Step 2: Add a Database	Add a database. You can select agent-free or agent-installed based on the database type.
Step 3: Enable Database Audit	Enable database audit and verify the audit result.
Related Operations	Customize audit rules and view audit results and monitoring information.

Preparation

Before purchasing DBSS, sign up for a Huawei Cloud account. For details, see Signing Up for a Huawei Cloud Account and Real-Name Authentication.
If you have enabled Huawei Cloud and completed real-name authentication, skip this step.
Ensure that your account has sufficient balance.

Step 1: Buy Starter Edition DBSS

Log in to the DBSS console.
Click in the upper left corner on the displayed page and select a region.
In the upper right corner, click Buy DBSS.

On the DBSS purchase page, complete the following configurations.

**Table 1** Database audit parameters
Parameter		Description
Basic Settings	Service Type	Select a service type. Only Database Audit Service is supported.
	Billing Mode	Select a billing mode for the instance. Only Yearly/Monthly is supported.
	Region	Select the region where the database audit instance is located. For details, see Selecting a Region.
	AZ Type	Select an AZ type. Only General is supported.
	AZ	Select an AZ. For details, see Selecting an AZ
Edition Configuration	Edition	DBAS provides four editions: starter, basic, professional, and advanced. For details, see Edition Differences.
Network Configuration	VPC	You can select an existing VPC, or click View VPC to create one on the VPC console. NOTE: Select the VPC of the node (application or database side) where you plan to install the agent. For more information, see How Do I Determine Where to Install an Agent? To change the VPC of a DBSS instance, unsubscribe from it and purchase a new one. For more information about VPC, see Virtual Private Cloud User Guide.
	Subnet	You can select a subnet configured in the VPC or create a subnet on the VPC console.
	Security Group	You can select an existing security group in the region or create a security group on the VPC console. Once a security group is selected for an instance, the instance is protected by the access rules of this security group. For more information about security groups, see Virtual Private Cloud User Guide.
Advanced Settings	Name	You can enter a custom instance name. The name can contain a maximum of 64 characters. Only letters, digits, underscores (_), and hyphens (-) are allowed.
	Remarks	You can add instance remarks. The remarks can contain a maximum of 225 characters. Only letters, digits, spaces, underscores (_), and hyphens (-) are allowed.
	Enterprise Project	This parameter is provided for enterprise users. An enterprise project groups cloud resources, so you can manage resources and members by project. The default project is default. Select an enterprise project from the drop-down list. For more information about enterprise project, see Enterprise Management User Guide.
	Tag	(Optional) Identifier of the database audit instance. Tags can be used to easily identify and manage your DBSS resources. Each instance can have up to 50 tags. If your organization has configured tag policies for DBSS, add tags to the database audit instance based on the policies. If you add a tag that does not comply with the tag policies, the database audit instance may fail to be created. Contact your organization administrator to learn more about tag policies.
Required Duration		Select a required duration for the instance. You can purchase DBSS by month or year.
Auto-renew		After you select Auto-renew, the system automatically renews the instance upon expiry if your account balance is sufficient. You can continue to use the instance. Table 2 describes the auto-renewal period.

**Table 2** Auto-renewal period description
Required Duration	Auto-renewal Period
1, 2, 3, 4, 5, 6, 7, 8, or 9 months	1 month
1 year, 2 years, or 3 years	1 year

Confirm the configuration and click Next.

For any doubts about the pricing, click Pricing details to understand more.
On the Details page, read the Database Security Service Statement, select I have read and agree to the Database Security Service Statement, and click Submit.
On the displayed page, select a payment method.
After you pay for your order, you can view the creation status of your instances.

Step 2: Add a Database

Databases audited by DBSS support agent-free installation and agent installation. For details about the database types and versions that support agent-free installation and agent installation, see Limitations and Constraints > Database Audit. You can enable database audit without installing an agent or by installing an agent based on the database type and version.

Adding a Database Without Installing an Agent

In the navigation tree on the left, choose Databases.
In the Instance drop-down list, select the instance whose database is to be added.
Click Add Database.
In the displayed dialog box, set the database parameters.
Click OK. A database whose Audit Status is Disabled is added to the database list.

Adding a Database By Installing an Agent

Add a database.
1. In the navigation tree on the left, choose Databases.
2. In the Instance drop-down list, select the instance whose database is to be added.
3. Click Add Database.
4. In the displayed dialog box, set the database parameters.
5. Click OK. A database whose Audit Status is Disabled is added to the database list.
Add an agent.
1. In the navigation tree on the left, choose Databases.
2. In the Instance drop-down list, select the instance whose agent is to be added.
3. In the Agent column of the desired database, click Add.
4. In the displayed dialog box, select an add mode.
5. Click OK.
Download and install an agent.
1. In the navigation tree on the left, choose Databases.
2. In the Instance drop-down list, select the instance whose agent is to be downloaded.
3. Click in the lower part of the database list to expand the agent details. Locate the target agent and click Download Agent in the Operation column The agent installation package will be downloaded.
4. Install an agent.
  1. Upload the downloaded agent installation package xxx.tar.gz to the node (for example, using WinSCP).
  2. Log in to the node as user root using SSH through a cross-platform remote access tool (for example, PuTTY).
  3. Run the following command to access the directory where the agent installation package xxx.tar.gz is stored:
```
cd Directory_containing_agent_installation_package
```
  4. Run the following command to decompress the installation package xxx.tar.gz:
```
tar -xvf xxx.tar.gz
```
  5. Run the following command to switch to the directory containing the decompressed files:
```
cd Decompressed_package_directory
```
  6. Run the following command to install the agent:
```
sh install.sh
```
  7. Run the following command to view the running status of the agent program:
```
service audit_agent status
```
    If the following information is displayed, the agent is running properly:
```
audit agent is running.
```

Step 3: Enable Database Audit

Enable database audit.
1. In the navigation tree on the left, choose Databases.
2. Select a database audit instance from the Instance drop-down list.
3. In the database list, click Enable in the Operation column of the database you want to audit.
  The Audit Status of the database is Enabled. You do not need to restart the database.
Verify the audit result.
1. Run an SQL statement (for example, show databases) in the target database.
2. In the navigation tree on the left, choose Data Reports. The Data Reports page is displayed.
3. In the Instance drop-down list, select the instance that audits the target database.
4. Click the Statements tab.
5. Click on the right of Time, select the start time and end time, and click Submit. The SQL statement entered in Figure 1 is displayed in the list.
  Figure 1 Viewing SQL statements

Related Operations

To effectively audit the database, you can customize audit rules and view audit results and monitoring information. This helps you locate internal violations and improper operations and ensure data asset security. For details, see Configuring Audit Rules, Viewing Audit Results, and Viewing Monitoring Information.

Next topic: Getting Started with Common Practices