Creating and Managing a Rule Set

Scenarios

You can add multiple rules to a rule set and associate the rule set with a database rule to enable centralized authorization. This eliminates the need to add database rules one by one.

There are 29 preconfigured common database operation commands, including ALTER, TRUNCATE, EXECUTE, INSERT, DELETE, UPDATE, SELECT, GRANT, REVOKE, HANDLER, DEALLOCATE, SET, COMMIT, ROLLBACK, PREPARE, CREATEINDEX, DROPINDEX, CREATEFUNCTION, DROPFUNCTION, CREATEVIEW, DROPVIEW, CREATEDATABASE, DROPDATABASE, CREATEPROCEDURE, DROPPROCEDURE, CREATETABLE, DROPTABLE, CALL, and ACCESS.

Notes and Constraints

When you create a rule set, it automatically belongs to your department by default. The department cannot be changed.

Prerequisites

Your role has the management permission for the DB Rules module. For details about the permissions of each role, see Role.

Creating a Regulation Set

1. Log in to your bastion host system.
2. In the navigation pane on the left, choose Policy > DB Rules > RegSet to go to the rule set list.
3. On the displayed page, click New in the upper right corner of the page.
4. Configure rule set information.

   Table 1 Rule set parameters

   Parameter	Description
   RegSet name	Enter a custom name for the rule set. The name must be unique in the system. Naming rules: The value can contain 1 to 64 characters. Only letters, digits, and hyphens (-) are allowed.
   Protocol	Set the database protocol type of the rule set. Currently, MySQL, Oracle, PostgreSQL, GaussDB, and DM are supported. The protocol type cannot be changed after the rule set is created.

5. Click OK.

   You can return to the rule set list page and view the new rule set. You also need to add rules to the rule set. For details, see Adding Rules to a Rule Set.

Adding Rules to a Rule Set

1. Log in to your bastion host system.
2. In the navigation pane on the left, choose Policy > DB Rules > RegSet to go to the rule set list.
3. In the Operation column of the target rule set, click Add regulation.
4. Configure rule details.

   Table 2 Parameters for adding regulation

   Parameter	Description
   Lib	This parameter is optional. It can be set to a regular expression to match the library name. By default, all SQL statements that use this command are intercepted.
   Table	This parameter is optional. It can be set to a regular expression to match the table name. By default, all SQL statements that use this command are intercepted.
   Cmd	This parameter is mandatory. Select at least one preconfigured command. You can select multiple commands at once. There are 29 preconfigured common database operation commands, including ALTER, TRUNCATE, EXECUTE, INSERT, DELETE, UPDATE, SELECT, GRANT, REVOKE, HANDLER, DEALLOCATE, SET, COMMIT, ROLLBACK, PREPARE, CREATEINDEX, DROPINDEX, CREATEFUNCTION, DROPFUNCTION, CREATEVIEW, DROPVIEW, CREATEDATABASE, DROPDATABASE, CREATEPROCEDURE, DROPPROCEDURE, CREATETABLE, DROPTABLE, CALL, and ACCESS.

5. Click OK.

Viewing and Editing a Rule Set

1. Log in to your bastion host system.
2. In the navigation pane on the left, choose Policy > DB Rules > RegSet to go to the rule set list.
3. Locate the row that contains the target rule set, and click the rule set name or click Manage in the Operation column to go to the details page.
4. View and modify the basic information about the rule set.
   • In the Basic Info area, view the department, name, and protocol type of the current rule set.
   • In the Basic Info area, click Edit on the right. In the displayed dialog box, change the rule set name.

5. View and modify the rules in the rule set.
   • In the Regulation area, view the rules in the current rule set.
   • In the Regulation area, click Add on the right to add a rule to the current rule set. For details about the parameters, see Table 2.
   • In the row containing the target rule, click Edit or Remove in the Operation column, respectively, to modify the rule, or delete the rule from the current rule set.

Deleting a Regulation Set

1. Log in to your bastion host system.
2. In the navigation pane on the left, choose Policy > DB Rules > RegSet to go to the rule set list.
3. Delete a rule set.
   • Deleting a single rule set
     1. In the row containing the target rule set, click Delete in the Operation column.
     2. In the displayed dialog box, click OK.
   • Batch deleting rule sets
     1. On the rule set list page, select multiple rule sets.
     2. Click Delete in the lower left corner.
     3. In the displayed dialog box, click OK.