Help Center> Database Security Service> User Guide> Shared VPC
Updated on 2024-05-13 GMT+08:00
View PDF

Shared VPC

Scenario

Ensure the VPC of the database audit instance is the same as that of the node (application side or database side) where you plan to install the database audit agent. Otherwise, the instance will be unable to connect to the agent or perform audit.

Creating a VPC

  1. Log in to the management console.
  2. Click in the upper left corner, choose Management & Governance > Resource Access Manager, and go to the resource access management page.
  3. Choose Shared by Me > Resource Shares.
  4. Click Create Resource Share in the upper right corner.
  5. Set resource type to vpc:subnet, choose the corresponding region, and select VPCs to be shared. Click Next: Associate Permissions.
  6. Associate a RAM managed permission with each resource type on the displayed page. Then, click Next: Grant Access to Principals in the lower right corner.
  7. Specify the principals that you want to have access to the resources on the displayed page. Then, click Next: Confirm in the lower right corner.

    Table 1 Parameter descriptions

    Parameter

    Description

    Principal Type
    • Organization

      For details about how to create an organization, see .

      NOTE:

      If you have not enabled resource sharing with organizations, this parameter cannot be set to Organization. For details, see .

    • Huawei Cloud account ID

  8. Check the configurations and click OK.

Using a VPC

  1. Log in to the management console.
  2. Click and choose Security & Compliance > Database Security Service. The Dashboard page is displayed.
  3. In the upper right corner, click Buy Database Audit.
  4. Select a region, a project, an AZ, and an edition. See Figure 1.

    Figure 1 Selecting an AZ and an edition

    Select an enterprise project. The DBSS you purchase will be put under this project. Billing and permissions management are performed based on enterprise projects.

    Table 2 describes the database audit editions.
    Table 2 Database audit editions

    Edition

    Maximum Databases

    System Resource

    Performance

    Professional

    6
    • CPU: 8 vCPUs
    • Memory: 32 GB
    • Hard disk: 1,084 GB
    • Peak QPS: 6,000 queries/second
    • Database load rate: 7.2 million statements/hour
    • Stores 600 million online SQL statements.
    • Stores 10 billion archived SQL statements.

    Advanced

    30
    • CPU: 16 vCPUs
    • Memory: 64 GB
    • Hard disk: 2,108 GB
    • Peak QPS: 30,000 queries/second
    • Database load rate: 10.8 million records/hour
    • Stores 1.5 billion online SQL statements.
    • Stores 60 billion archived SQL statements.
    • A database instance is uniquely defined by its database IP address and port.

      The number of database instances equals the number of database ports. If a database IP address has N database ports, there are N database instances.

      Example: A user has two database IP addresses, IP1 and IP2. IP1 has a database port. IP2 has three database ports. IP1 and IP2 have four database instances in total. To audit all of them, select professional edition DBSS, which supports a maximum of six database instances.

    • To change the edition of a DBSS instance, unsubscribe from it and purchase a new one.
    • The cloud native edition can be purchased only on the RDS console.
    • The table above lists the system resources consumed by a database audit instance. Ensure your system has the required configurations before purchasing database audit instances.
    • Online SQL statements are counted based on the assumption that the capacity of an SQL statement is 1 KB.

  5. Select the VPC and subnet for database audit. For details about related parameters, see Table 3.

    Figure 2 Setting database audit parameters
    Table 3 Database audit instance parameters

    Parameter

    Description

    VPC

    You can select an existing VPC, or click View VPC to create one on the VPC console.

    NOTE:
    • Select the VPC of the node (application or database side) where you plan to install the agent. For more information, see How Do I Determine Where to Install an Agent?
    • To change the VPC of a DBSS instance, unsubscribe from it and purchase a new one.

    For more information about VPC, see Virtual Private Cloud User Guide.

    Security Group

    You can select an existing security group in the region or create a security group on the VPC console. Once a security group is selected for an instance, the instance is protected by the access rules of this security group.

    For more information about security groups, see Virtual Private Cloud User Guide.

    Subnet

    You can select a subnet configured in the VPC or create a subnet on the VPC console.

    Name

    Instance name