Managing Data Security Zones

Prerequisites

You have purchased the AI-assisted data security function expansion package. For details about how to purchase it, see Upgrading Edition and Specifications.

Creating a Data Security Zone

1. Log in to the DSC console.
2. In the navigation pane on the left, choose Data Security Zone > Zone Management. The Data Security Zone page is displayed.
3. Click Create Zone. On the Create Data Security Zone page, configure Basic Configuration.
   • Zone Name: Enter a zone name.
   • Zone Description: Optional. You can briefly describe the purpose of the zone.
   • Default Policies: DSC provides the following policies: In the Operation column of a policy, click View Policy.
     • DenyNonZoneUserAccessZoneResource${zone-id}: An IAM zone access control policy. It prevents users outside the zone from accessing zone-tagged resources.
     • DSC-Policy-DSZ-TagProtection: An IAM tag protection policy. It prohibits IAM users from directly modifying zone tags and restricts non-administrator users from modifying the data-zone tag.
     • DSC-Policy-DSZ-NetworkDeny: A network egress control policy. It prohibits public network access (via EIP, NAT Gateway, or EIPs) to zone resources and blocks cross-region VPC interconnection.
     • DSC-Policy-DSZ-OBSBucket: An OBS bucket and bucket ACL policy. It restricts the overall access scope.
     • DSC-Policy-DSZ-VPCEP: A VPC Endpoint policy. It restricts VPC Endpoint access exclusively to zone users.

4. Click Next. Configure Add IAM User and Network.
   • Add IAM Users: Select IAM users from the drop-down list. The data-security-zone tag will be bound to the IAM users you add. The users will have the permissions to access the resources within the zone.
   • Add Network: Select VPC networks from the drop-down list. After a network is added, the system automatically binds the data-security-zone tag to the selected VPC network resources and applies the default policies to the VPC endpoint of KMS within that VPC.

5. Click Next to add resources.
   Select a resource type from the Type drop-down list. Click Add Resource. You can add multiple resources. To delete a resource, click Delete in its upper right corner.

   • Set Type to Elastic Cloud Server (ECS), Cloud Container Engine (CCE), ModelArts dedicated resource pool, or OBS, and select a resource.
   • If Type is set to Local client, configure the client name, private IP address range (optional), and public IP address range (optional).

6. Click OK.

Viewing Basic Information About a Data Security Zone

1. Log in to the DSC console.
2. In the navigation pane on the left, choose Data Security Zone > Zone Management. The Data Security Zone page is displayed.
3. Click the zone name to go to the Basic Information page.
4. On the Basic Information tab page, you can view the Basic Information, Default Policy, and Resource Topology of the data security zone.
   Figure 1 Basic zone information
   

Managing IAM Users

After an IAM user is added, the data-security-zone tag will be automatically bound to the user. Resource access within the zone will be restricted exclusively to users assigned to the zone.

1. Log in to the DSC console.
2. In the navigation pane on the left, choose Data Security Zone > Zone Management. The Data Security Zone page is displayed.
3. Click the zone name to go to the Basic Information page.
4. Click the IAM Users tab.
5. Click Add User. In the dialog box that is displayed, select an IAM user and click OK.

   If you do not want a user to access resources in the zone, click Remove in its Operation column.

Managing Networks

After a network is added, the system automatically binds the data-security-zone tag to the selected VPC network resources and applies the default policies to the KMS VPC endpoint within that VPC.

1. Log in to the DSC console.
2. In the navigation pane on the left, choose Data Security Zone > Zone Management. The Data Security Zone page is displayed.
3. Click the zone name to go to the Basic Information page.
4. Click the Networks tab page.
5. Click Add Network. In the dialog box that is displayed, select a VPC and click OK.

   If you do not want users in a network to access resources in the zone, click Remove in the Operation column of the VPC.

Managing Resources

In DSC, you can add OBS, ECS, CCE, ModelArts dedicated resource pool, and local client resources to a data security zone. Added resources are automatically bound with the data-security-zone tag. Resource access within the zone will be restricted exclusively to users assigned to the zone.

Data Transfer

If log collection is not enabled, click Enable Now. In the dialog box that is displayed, click OK to start collecting data operation logs.

OBS read/write logs and KMS encryption/decryption SDK operation logs within the zone will be collected and dumped to LTS for data transfer analysis and operation audit. Enabling this function will incur LTS storage fees. For details, see LTS Pricing Details.

1. Log in to the DSC console.
2. In the navigation pane on the left, choose Data Security Zone > Zone Management. The Data Security Zone page is displayed.
3. Click the zone name to enter the Basic Information page.
4. Click the Data Transfer tab page. The Data Transfer tab is displayed. To disable operation log collection, click .
5. Select a time range and the target resources to view their corresponding logs.
6. Click the Data Transfer tab page and click the Operation Logs tab.
7. Click Data Operation Logs and Encryption and Decryption Operation Logs to view OBS read/write logs and KMS encryption/decryption SDK data operation logs in the zone, respectively.

Related Operations

• Editing a zone: In the Operation column of a zone, click Edit. Modify its name or description and click OK.
• Deleting a zone: In the Operation column of a zone, click Delete. In the displayed dialog box, enter DELETE and click OK.