Enabling Separation of Permissions for DWS Database Users

Scenario

To ensure cluster data security, DWS supports separation of permissions for clusters. Database management permissions are granted to different types of users based on their responsibilities, achieving a balance between permissions. By default, the administrator specified when you create a DWS cluster is the database system administrator. The administrator can create other users and view the audit logs of the database. That is, separation of permissions is disabled.

When separation of permissions is enabled, the system administrator's original capabilities of creating other users and viewing audit logs are now assumed by the security administrator and audit administrator, respectively. The three types of administrators have their own responsibilities and restrict each other. To meet internal permission separation and compliance audit requirements (such as graded protection assessment and financial, government, and enterprise supervision requirements), you are advised to enable separation of permissions to reduce the security risks caused by leakage or unauthorized operations of a single administrator account.

For details about the default permissions mode and the separation of permissions mode, see Separation of Duties in DWS in the Data Warehouse Service (DWS) Developer Guide.

Impact on the System

• After you modify security parameters and the modifications take effect, you may restart the cluster, which makes the cluster unavailable temporarily.
• When a Storage-compute decoupled cluster is created, a virtual warehouse is created by default. After the separation of permissions is enabled, only the system administrator has the permission to create, modify, delete, and allocate logical clusters. Accessing a virtual warehouse requires permissions.

Prerequisites

To modify the cluster's security configuration, ensure that the following conditions are met:

• The cluster status is Available, To be restarted, or Unbalanced.
• There are no ongoing tasks in the cluster, such as scale-out, scale-in, and redistribution.

Procedure

1. Log in to the DWS console.
2. In the navigation pane on the left, choose Cluster > Cluster List.
3. In the cluster list, click the name of a cluster. In the navigation pane, choose Security Settings.

   By default, Configuration Status is Synchronized, which indicates that the latest database result is displayed.

4. On the Security Settings page, enable Separation of Permissions.
   When separation of permissions is enabled, configure the username and password for Security Administrator and Audit Administrator. Then the system automatically creates these two users. You can use these two users to connect to the database and perform database-related operations. By default, this function is disabled.

   Table 1 Security parameters

   Parameter	Description	Example Value
   Security Administrator	Administrator account used for user and permission security management after separation of permissions is enabled. The username must meet the following requirements: Consists of lowercase letters, digits, or underscores. Starts with a lowercase letter or an underscore. Contains 6 to 64 characters. The username cannot be a reserved keyword of the DWS database. For details about the keywords of the DWS database, see Keyword.	security_admin
   Password	Login password of the security administrator. The password complexity requirements are as follows: Contains 12 to 32 characters. Cannot be the username or the username spelled backwards. Contains at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters (~!?,.:;_(){}[]/<>@#%^&*+|\=-) Perform the weak password check on the passwords that you have created.	-
   Confirm Password	Enter the security administrator password again. Confirm Password and Password must be the same.	-
   Audit Administrator	Administrator account used for viewing and managing audit logs after separation of permissions is enabled. The username must meet the following requirements: Consists of lowercase letters, digits, or underscores. Starts with a lowercase letter or an underscore. Contains 6 to 64 characters. The username cannot be a reserved keyword of the DWS database. For details about the keywords of the DWS database, see Keyword.	audit_admin
   Password	Login password of the audit administrator. The password complexity requirements are as follows: Contains 12 to 32 characters. Cannot be the username or the username spelled backwards. Contains at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters (~!?,.:;_(){}[]/<>@#%^&*+|\=-) Passes the weak password check.	-
   Confirm Password	Enter the audit administrator password again. Confirm Password and Password must be the same.	-

5. Click Apply.
6. In the displayed Save Configuration dialog box, select or deselect Restart the cluster and click Save.
   • If you select Restart the cluster, the system saves the settings on the Security Settings page and restarts the cluster immediately. After the cluster is restarted, the security settings take effect immediately.
   • If you do not select Restart the cluster, the system only saves the settings on the Security Settings page. Later, you need to manually restart the cluster for the security settings to take effect.

   After the security settings are complete, Configuration Status can be one of the following on the Security Settings page:

   • Applying: The system is saving the settings.
   • Synchronized: The settings have been saved and taken effect.
   • Take effect after restart: The settings have been saved but have not taken effect. Restart the cluster for the settings to take effect.

7. Use the created security administrator and audit administrator accounts to connect to the database and perform operations for which they have permissions.

Documentation

• Permission details before separation of permissions and permission changes after the separation: Separation of Duties in DWS
• Configuring database account security: Cyber Security