Creating a Database Rule

Scenarios

Database rules are used to intercept sensitive database session operations, implementing fine-grained control over database operations. When an authorized system user logs in to a database related to a database rule, their sensitive operations will be intercepted once the database rule is triggered.

With database rules, you can:

• Period of validity: Configure the start and end time of the rule validity period. To make the rule valid permanently, leave this parameter empty.
• Time Limit: Set the days and time when the rule is valid or invalid.
• Action: Set the action allowed by the rule.
  • Disconnect: After a database rule is triggered, the system rejects executing the operation and disconnects the O&M session. The system displays a message indicating that the connection is forcibly disconnected by the administrator.
  • Reject: After a database rule is triggered, the system rejects executing the operation and displays a message indicating that the operation has been intercepted.
  • Dynamic approval: After a database rule is triggered, the system reject executing the operation. The system displays a message indicating that the operation has been intercepted and asking you to submit a database approval ticket. A database approval ticket is automatically generated. The command can be executed only after the ticket is submitted and approved.
  • Permit: By default, all operations are allowed. After a database rule is triggered, operations in the related regulation set are allowed.

Notes and Constraints

• The database operation audit is available only in professional editions.
• Database rules apply only to MySQL, Oracle, PostgreSQL, and GaussDB databases for fine-grained permission control.

Precautions

On the rule list page, policies are sorted by priority. The rule in the upper position has higher priority than those in a lower position. To change the priority of a rule, select the rule and drag and drop it to an upper or lower position.

Prerequisites

Your role has the management permission for the DB Rules module. For details about the permissions of each role, see Role.

Method 1: Creating a Database Rule

1. Log in to your bastion host system.
2. In the navigation pane on the left, choose Policy > DB Rules > DB Rules.
3. On the displayed page, click New in the upper right corner of the page.
4. Configure the basic information.

   Table 1 Database rule parameters

   Parameter	Description
   Rule Name	Enter a custom name for the database rule. The rule name must be unique in a bastion host. Naming rules: The value can contain 1 to 64 characters. Only letters, digits, and hyphens (-) are allowed.
   Action	Select the action executed by the rule. Disconnect: After a database rule is triggered, the system rejects executing the operation and disconnects the O&M session. The system displays a message indicating that the connection is forcibly disconnected by the administrator. Reject: After a database rule is triggered, the system rejects executing the operation and displays a message indicating that the operation has been intercepted. Dynamic approval: After a database rule is triggered, the system reject executing the operation. The system displays a message indicating that the operation has been intercepted and asking you to submit a database approval ticket. A database approval ticket is automatically generated. The command can be executed only after the ticket is submitted and approved. Permit: By default, all operations are allowed. After a database rule is triggered, operations in the related regulation set are allowed.
   Period of validity	Configure the start and end time for the rule validity period. To make the rule valid permanently, leave this parameter empty.
   Time Limit	Set the days and time when the rule is valid or invalid.

5. Click Next and start to associate the rule with a rule set.
   • You can associate a rule with multiple rule sets at once. For details about how to create a rule set, see Creating and Managing a Rule Set.
     • Selecting rule sets: Select rule sets in the Selectable RegSets area and click to move them to the Selected RegSets area.
     • Removing rule sets: Select rule sets in the Selected RegSets area and click to move them back to the Selectable RegSets area.
   • After a rule set is associated with a rule, rules added to the rule set automatically inherit the permissions of that rule.
   • If you skip this step, you can associate rule sets with the rule later on the database rule list page or details page.

6. Click Next and start to relate the command rule to one or more users or user groups.
   Make sure the associated users or users in the associated user groups have the permissions for the DB Tickets module. Otherwise, after they log in to the system, the DB Tickets module will be unavailable to them. This means they cannot submit tickets to obtain approval during operation. For details about the permissions of each role, see Role.

   • You can associate a rule with multiple users or user groups at once.
     • Select users or user groups: On the Relate User or Relate User Group tab, select users or user groups in the Selectable users or Selectable user groups box, and click to move them to the Selected users or Selected user groups box.
     • Remove users or user groups: On the Relate User or Relate User Group tab, select users or user groups in the Selected users or Selected user groups box, and click to move them back to the Selectable users or Selectable user groups box.
   • After a user group is associated with a rule, users automatically obtain the permissions of the rule the instant they are added to the user group.
   • If you skip this step, you can associate users or user groups with the rule later on the database rule list page or details page.

7. Click Next and start to associate the rule with one or more accounts or account groups.
   • You can associate a rule with multiple managed resource accounts or account groups at once.
     • Select a resource account or account group: On the Relate Account or Relate Account Group tab, select the target resource account or account group in the Selectable accounts or Selectable account groups box, and click to move it to the Selected accounts or Selected account groups box.
     • Remove a resource account or account group: On the Relate Account or Relate Account Group tab, select the target resource account or account group in the Selected accounts or Selected account groups box, and click to remove it back to the Selectable accounts or Selectable account groups box.
   • After an account group is associated with a rule, accounts automatically obtain the permissions of the rule the instant they are added to the account group.
   • If you skip this step, you can associate resource accounts or account groups with the rule later on the database rule list page or details page.

8. Click OK.

   You can return to the rule list page and view the new database rule. During operation, when the rule is triggered, the system executes configured actions accordingly.

Method 2: Inserting a Database Rule

You can create a rule and insert it before an existing rule. The inserted rule has a higher priority.

1. Log in to your bastion host system.
2. In the navigation pane on the left, choose Policy > DB Rules > DB Rules.
3. In the row containing the target rule, click Insert in the Operation column.
4. Configure the rule by referring to Table 1 and click Next.
5. Associate the rule with a rule set by referring to 5 and click Next.
6. Associate the rule with a user or user group by referring to 6 and click Next.
7. Associate the rule with a resource account or account group by referring to 7, and click OK.

   On the database rule list page, you can view the inserted rule.