Binding and Unbinding a DNAT Gateway Address

Scenarios

Supabase applications support binding and unbinding DNAT gateways. After configuring a gateway address, you can use an Elastic IP (EIP) and a public port to access the application.

Prerequisites

• You have registered a Huawei ID and enabled Huawei Cloud services.
• You can create an IAM user and user group on the IAM console and grant the user specific operation permissions, to perform refined management on Huawei Cloud. For details, see Using IAM Roles or Policies to Grant Access to RDS.
• You must use a login account assigned the rds:instance:modifyPublicAccess, vpc:publicIps:update, rds:aiApplication:get, and rds:aiApplication:list actions.

Precautions

• You must configure security group rules to allow the private IP addresses and ports that need to access the application. Only then can the application be accessed over a public network. Before accessing the Supabase application, you must add an individual IP address or an IP address range that will access the application to inbound rules. For details, see Configuring a Security Group Rule.
• You need to pay for the NAT Gateway and EIP services separately. For details about their pricing, see NAT Gateway Pricing Details and EIP Pricing Details.
• Use NAT Gateway to map different ports of the same EIP to different applications. If you cannot access the application after the gateway address is bound, troubleshoot the fault by referring to What Can I Do If the Connection Between My Servers and the Internet Fails After a NAT Gateway Is Configured?

Constraints

• If a gateway address is already bound to your application, you must unbind it before binding a new gateway address.
• The gateway and application must be in the same subnet and the EIP cannot be used by any other gateways or applications.

Permission Requirements

• If you bind a gateway address using a Huawei Cloud account, no additional configuration is required. If you bind it as an IAM user for the first time, you must obtain the permission to create an agency.
• When configuring policy-based authorization, use IAM project authorization to bind and unbind gateway addresses. Enterprise project authorization is not supported.
• The IAM user must have the following permissions to bind a gateway address.

  Table 1 Permission requirements for the IAM user to bind a gateway address

  Current IAM Policy	Required IAM 3.0 Permissions	Required IAM 5.0 Permissions
  Role/Policy-based (IAM 3.0)	gaussdb:instance:unbindPublicIp gaussdb:instance:bindPublicIp gaussdb:instance:list nat:dnatRules:create nat:natGateways:list nat:snatRules:list nat:dnatRules:delete nat:natGateways:get nat:dnatRules:get nat:dnatRules:update nat:dnatRules:list If you do not have these permissions, create a custom policy.	eip:publicIps:associateInstance eip:publicIps:disassociateInstance nat:natGateways:listTags If you do not have these permissions, create a custom identity policy and attach it to the principal.
  Identity policy-based (IAM 5.0)	N/A	nat:dnatRules:create nat:dnatRules:delete nat:dnatRules:get nat:dnatRules:list nat:dnatRules:update nat:natGateways:get nat:natGateways:list nat:natGateways:listTags nat:snatRules:list eip:publicIps:associateInstance eip:publicIps:disassociateInstance If you do not have these permissions, create a custom identity policy and attach it to the principal.

Procedure