Managing the Security Group of an Application

Scenarios

A security group is a logical group that provides access control policies for Elastic Cloud Servers (ECS) and RDS Supabase applications within the same Virtual Private Cloud (VPC) that share the same security requirements and trust relationships.

To ensure the security and stability of your RDS Supabase application, you must configure a security group before using the application to allow the IP addresses and ports that need to access the application.

When accessing a Supabase application through a DNAT-bound EIP, you must configure corresponding inbound rules for the security group associated with the application.

Prerequisites

• Sign up for a Huawei Cloud account.
• If you need fine-grained management of resources on Huawei Cloud, use Identity and Access Management (IAM) to create IAM users and user groups, and grant them specific permissions so that the IAM users can obtain required permissions. For details, see Using IAM Roles or Policies to Grant Access to RDS.

Precautions

• To ensure data and application security, grant only necessary permissions. Apply the principle of least privilege for database access. Restrict access by setting the allowed IP address to either the remote server's specific address or its smallest subnet range.

  The default source IP address 0.0.0.0/0 allows all IP addresses to access the Supabase application in the security group.

• You must configure security group rules to allow the IP addresses and ports that need to access the application. Only then can the Supabase application be accessed. Before accessing the application, add the IP address or CIDR block that will access the application to the inbound rules of the security group.
• For details about the requirements for adding security group rules, see Adding a Security Group Rule in Virtual Private Cloud User Guide.
• You can go to the Create Security Group page to create a security group that meets your requirements and configure access rules.
  • Ensure that the inbound rules allow traffic to the application and NAT-mapped ports.
    Figure 1 Configuring inbound rules for AI application public access
    
  • Ensure that the outbound rules allow traffic to service ports (such as the email server, GitHub, and user frontend project integrated in Auth configurations).
• For a hosted RDS instance, inbound rules for the database port must be added to the security group. Otherwise, the Supabase application cannot connect to the database, causing application errors and making features unavailable.
  • If the DB instance port is not set (the default port is 5432), you can select the default security group, which has a preset inbound rule for port 5432.
  • If the DB instance port has been set (not port 5432), you cannot directly use the default security group and you must ensure that the selected security group has the correct inbound rule for the specified database port.

Constraints

• Security group configuration cannot be performed for applications that are undergoing active operations. Wait until the operations are complete.
• Supabase application features are unavailable while you are modifying the security group. Perform this operation during off-peak hours to avoid affecting peak-time workloads.

Procedure

1. Log in to the RDS console.
2. Click in the upper left corner and select a region.
3. In the navigation pane, choose AI App Dev Platform.
4. On the AI App Dev Platform page, click the target AI application name to open its details page.
5. On the details page, click Manage under the Security Group field in the Network Info area.
6. In the displayed dialog box, select the target security group and click OK.
   Figure 2 Modifying the security group configuration for the AI application
   

7. Refresh the details page later and check the security group configuration in the Network Info area. Verify that the security group is modified.