The BestPracticesForPolarDB compliance package checks whether each PolarDB cluster uses a stable kernel version and is appropriately configured, and whether risks exist in backup settings, Internet access and whitelist settings, instance renewal and expiration, and change management. This ensures the stability and security of your PolarDB clusters. The following table describes the default rules in this compliance package.
|
Rule name |
Rule description |
|
A PolarDB cluster is compliant if its kernel version is not in the version list specified by the parameter. By default, the parameter specifies kernel versions with potential stability risks. This rule applies only to PolarDB for MySQL clusters. |
|
|
Subscription PolarDB clusters must be renewed before they expire to prevent service interruptions. A cluster is compliant if the duration between its expiration date and the check date exceeds the specified number of days. Default period: 30 days. Clusters with auto-renewal enabled are also compliant. This rule does not apply to pay-as-you-go PolarDB clusters. |
|
|
A PolarDB cluster is compliant if the SQL Explorer and Audit feature is enabled. |
|
|
A PolarDB cluster is compliant if its edition is Cluster Edition or Multi-master Cluster Edition. Use caution with Single Node Edition, which provides slow failovers. |
|
|
A PolarDB cluster is compliant if its maintenance period matches one of the specified time ranges. Ensure that the maintenance period does not overlap with your peak business hours. |
|
|
A PolarDB cluster is compliant if deletion protection is enabled. This rule does not apply to subscription PolarDB clusters. |
|
|
A PolarDB cluster is non-compliant if Internet access is enabled but traffic is allowed from all IP addresses. |
|
|
A PolarDB cluster is compliant if the retention period of its level-2 backups is no less than the specified number of days. Default period: 30 days. A cluster is non-compliant if the level-2 backup feature is disabled or the retention period is shorter than specified. |
|
|
A PolarDB cluster is compliant if the retention period of its level-1 backups is no less than the specified number of days. Default period: 30 days. A cluster is non-compliant if the log backup feature is disabled or the retention period is shorter than specified. |
|
|
A PolarDB cluster is compliant if the default_time_zone parameter is not set to SYSTEM. We recommend that you specify a valid time zone for each PolarDB cluster. |