Data Audit for Third-Party Cloud Platforms and On-Premises IDCs

Step 1: Create a VPC on Huawei Cloud

You can create a VPC and use multiple Huawei Cloud network products to ensure security and stability. Third-party cloud platforms or local data center resources can be efficiently expanded and interconnected with Huawei Cloud.

1. Go to the Create VPC page.
2. Click Create VPC, and configure parameters for the VPC and subnet as prompted.
   • Region: Select the region where you want to create cloud resources.
   • IPv4 CIDR Block: Avoid IP address conflicts if you need to connect a VPC to an on-premises data center or connect two VPCs.
     • You are advised to use the private IPv4 address ranges specified in RFC 1918 as the CIDR block.
     • Do not use 100.64.0.0/10, 214.0.0.0/4, 198.18.0.0/15, 169.254.0.0/16, 0.0.0.0/8, 127.0.0.0/8, or 240.0.0.0/4.
   • IPv4 CIDR Block under Subnet: A subnet mask can be between the netmask of its VPC CIDR block and the /29 netmask. If a VPC CIDR block is 10.0.0.0/16, its subnet mask can range from 16 to 29. For details about VPC subnet planning, see VPC Network Planning Suggestions.
   • Set other parameters as prompted. For details, see Creating a VPC with a Subnet.

Step 2: Connect the Network

Connect the network via VPN gateway, DC, or Cloud Connect (CC) by referring to the references in the following table.

Step 3: Add User-Built Databases on DSC

1. Log in to the DSC console.
2. Click in the upper left corner and select a region or project.
3. In the navigation pane on the left, choose Asset Center > Asset Management.
4. Click User-built databases under Database. The Databases tab is displayed.
5. Click the Database Instances tab.
6. Click add in the upper left corner. Set related parameters based on Table 1 and click OK to add a user-built database instance.
   Figure 1 Adding a database instance

   

   Table 1 Configuring database instance information

   Parameter	Description
   Region	By default, it is the region selected in the upper left corner of the console.
   Organization Member Account	This parameter is displayed if you have added an organization member to DSC based on multi-account management. Click to select an account and view its information.
   ECS	Select the ECS of the user-built database instance from the drop-down list.
   Security Group	Select a security group from the drop-down list.
   Database Engine	Select the engine of the user-built database from the drop-down list.
   Version	Select a database engine version from the drop-down list.
   Connection Method	This parameter is displayed when Database Engine is set to Oracle. Select a connection mode from the drop-down list. Service Name: Enter the service name. SID: Enter the SID.
   Schema	Enter the database schema name when Database Engine is set to DMDBMS.
   Database Server Address	Select a server address from the drop-down list. In cluster deployment mode, set this parameter to the IP address of the primary node if data masking is required.
   Port	Enter an integer ranging from 0 to 65535.
   Database	Enter a database name.
   Username/Password	Enter the username and password of the database.
   Asset	Enter 4 to 255 characters. Only letters, digits, hyphens (-), and underscores (_) are allowed. The value must start with a letter.
   Creating a metadata drawing task	Databases of a metadata task are supported. After this function is enabled, metadata tasks are automatically delivered based on the default database of the instance to obtain the database, table, and column information of the instance. If Database Engine is set to SQL Server, Oracle, MongoDB, or GaussDB, metadata drawing tasks cannot be created.

Step 4: Configure a Security Group Access Control Policy

Add a new agent or choose an existing agent for the database to be audited, depending on your database type. The agent will obtain database access traffic, upload traffic statistics to the audit system, receive audit system configuration commands, and report database monitoring data.

After the agent is added, you need to configure TCP (port 8000) and UDP (ports 7000 to 7100) in the security group inbound rule of the database audit instance to allow the agent to communicate with the audit instance.

1. Add an agent.
2. Download and install the agent.
3. In the navigation pane on the left, choose Databases.
4. In the Instance drop-down list, select the instance whose security group rule is to be added.
5. Record the IP address of the agent node.

   Locate the target database and click View Agent in the Agent column. In the Agents area, record the value in the Installing Node IP Address column.

   Figure 2 Installing node IP address
   

6. Click Add Security Group Rule.
7. In the displayed dialog box, record the security group name (for example, default) of the database audit instance.
8. Click Go to VPC.
9. In the search box above the list, select an attribute or enter a keyword to search for a security group. Then, click the security group name.
10. Click the Inbound Rules tab.

    Check whether TCP (port number 8000) and UDP protocols (port number from 7000 to 7100) are configured in the inbound rules of the security group for the IP address of the installing node.

    • If the inbound rules of the security group have been configured for the installing node, go to Step 5: Enable Database Audit.
    • If no inbound rules of the security group have been configured for the installing node, go to 11.

11. Add an inbound rule for the installing node.
    1. On the Inbound Rules tab, click Add Rule.
       Figure 3 Adding rules
       
    2. In the Add Inbound Rule dialog box, add TCP (port number 8000) and UDP protocols (port number from 7000 to 7100).
       

       The source can be an IP address, an IP address segment, or a security group. Examples:

       • IP address: 192.168.10.10/32
       • IP address segment: 192.168.52.0/24
       • All IP addresses: 0.0.0.0/0
       • Security group: sg-abc
       Figure 4 Add Inbound Rule dialog box
       
    3. Click OK.

Step 5: Enable Database Audit

By default, database audit complies with a full audit rule, which is used to audit all databases that are connected to the database audit instance. You can enable audit and check audit results.

1. Log in to the DSC console.
2. Click in the upper left corner and select a region or project.
3. In the navigation pane on the left, choose Data Audit > Database Security Audit.
4. In the navigation pane on the left, choose Databases.
5. Select a database audit instance from the Instance drop-down list.
6. In the database list, click Enable in the Operation column of the database you want to audit.

   The Audit Status of the database is Enabled. You do not need to restart the database.

Step 6: Verify the Audit Effect on the DBSS Page

1. Run an SQL statement (for example, show databases) in the target database.
2. In the navigation tree on the left, choose Data Reports.
3. In the Instance drop-down list, select the instance that audits the target database.
4. Click the Statements tab.
5. Expand the drop-down list and select All time, Last 30 minutes, 1 hour, Today, 7 days, 30 days, or set a custom time range. Click the search box, select a filter, or enter a keyword.
   • If the SQL statement is displayed in the SQL statements, the audit is successful.
   • If the SQL statement is not displayed in the SQL statements, the network communication between the agent and the database audit instance is abnormal. For details, see What Do I Do If the Communication Between the Agent and Database Audit Instance Is Abnormal?
   Figure 5 Viewing SQL statements
   

   Table 2 SQL statement parameters

   Parameter	Description
   SQL Statements	Entire SQL statement.
   Client IP Address	IP address of the client where an SQL statement is executed
   Database IP Address/Domain Name	IP address or the domain name of the database where an SQL statement is executed
   Database User	Database user for executing an SQL statement
   Name	Database name for executing an SQL statement
   Risk Level	Risk level of executing an SQL statement. High Medium Low No risk
   Rule	Name of the rule for executing an SQL statement.
   Operation Type	Type of an SQL statement operation
   Result	Response to an SQL statement
   Generated	Time when an SQL statement is generated
   Operation	Operations that can be performed on SQL statements Add to Whitelist: Add an SQL statement to the whitelist.