Database Autonomy Service:Security management

Overview

The security baseline check feature in DAS offers a fully automated security assessment for your databases. It periodically scans database instances based on industry standards and security best practices to quickly identify vulnerabilities such as weak passwords, excessive permissions, and missing audit logs, and provides professional remediation advice. This feature supports centralized checks for multiple database types and performs 24/7 automated inspections to help you continuously optimize security configurations and strengthen your data security.

Usage notes

Your database instance must be in one of the following regions:

• Public cloud

  China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Shenzhen), China (Heyuan), China (Zhangjiakou), China (Hohhot), China (Chengdu), China (Guangzhou), China (Ulanqab), Indonesia (Jakarta), US (Virginia), US (Silicon Valley), Japan (Tokyo), Germany (Frankfurt), UK (London), Philippines (Manila), Malaysia (Kuala Lumpur), Singapore, and China (Hong Kong).

• Finance

  China (Hangzhou) Finance, China (Shanghai) Finance, China (Beijing) Finance (invitation only), and China (Shenzhen) Finance.

Procedure

1. Log on to the DAS console.

2. In the left-side navigation pane, choose Security Center > Global Security Management.

   • When you navigate to this page for the first time, the purchase page for the Security Management service appears. Click Buy Now to open the Activate Security Management Services dialog box.

   • In the Select Instance section, select the instances you want to add.

   • In the Security Scenario configuration section:

     • Select Security Management and choose an appropriate quota from the Security Management Quota drop-down list.

     • Select Sensitive Identification & Column Encryption.

   • After confirming the configuration, click Submit to enable the service.

3. On the Global Security Management page, click the Security Baseline Check tab.

   • Initiate Inspection: Click Initiate Inspection. In the dialog box that appears, select the instances you want to inspect, click to move them to the right panel, and then click OK to start the security inspection for the selected database instances.

     Note

     • First, you must perform the Enable Security Center operation for the instance on the Instances page. You can go to this page by clicking Cloud Instances in the Initiate Inspection dialog box. Then, in the Security Services column of the target instance, click Activate to complete the authorization.

     • A security inspection can be time-consuming, ranging from several minutes to more than thirty minutes, depending on the number and complexity of your instances. You do not need to wait for the task to complete. You can return to this page later to view the inspection results.

     Security baseline inspection is supported only for RDS (MySQL, PostgreSQL), PolarDB (MySQL, PostgreSQL, Oracle), PolarDB-X, SQL Server, Redis, and MongoDB instances.

   • Inspection list: The page displays the inspection results in a list, with one row per instance.

     Note

     The system uses clear visual cues to indicate the results: red for risks, yellow for warnings, and green for secure.

     The inspection list includes basic information columns such as Task ID, Instance ID, Database type, Region, and Inspection time, as well as security dimension columns such as Weak password, Whitelist, SSL certificate, Backup, Audit, TDE, and KMS key. Click Details in the Actions column to view the specific inspection results.

   • View details: Click Details in the Actions column for the corresponding inspection task to view its details.

     Note

     In the dialog box, you can click Inspect Again at the bottom to re-run the inspection for the current instance.

     The inspection details dialog box contains three sections: The Basic information section displays the task ID, instance name, database type, inspection time, and region. The AI best practices section lists risk items and remediation suggestions, such as "[High-risk] TDE is not enabled" (click Configure TDE Encryption to remediate) and "[High-risk] SSL encryption is not enforced" (click SSL Link Encryption to remediate). The Inspection results section lists the status of each check, including Weak password, Whitelist, Backup, and Audit (with a green "Secure" label), as well as SSL certificate and TDE (with an orange "Warning" label), and KMS key. You can expand each item to view more details.

   • Download: Click the download icon in the upper-right corner of the inspection list to download the current list of inspection results.

   • Inspection subscription: You can enable the inspection subscription service by using the toggle switch in the upper-right corner.

     Note

     After you enable the subscription service, Alibaba Cloud will send you security notifications through various channels, such as internal messages and SMS, at the following key moments:

     • When Alibaba Cloud receives or discovers new security threat intelligence.

     • When regulatory authorities, such as the Cyberspace Administration of China, release the latest compliance requirements.

Detection items and remediation suggestions

Overview

An SSL certificate is a crucial security mechanism that encrypts data transmitted between a client and a database, preventing eavesdropping and tampering. The SSL certificate management feature provided by DAS helps you centrally monitor the certificate status of all your database instances, identify risks promptly and prevent connection interruptions from expired certificates. The system provides automatic expiration warnings, one-click renewal operations, and a centralized download portal to enhance the convenience and security of certificate management.

Usage notes

• The target database instance is connected to DAS.

• The database instance is one of the following types:

  • RDS MySQL

  • PolarDB for MySQL

• To use the SSL certificate management feature as a RAM user, you must grant the RAM user the AliyunHDMReadOnlyAccess or AliyunHDMFullAccess permission. For more information, see How can a RAM user use DAS?.

• SSL for proxies is not included in the statistics.

Procedure

1. Log on to the DAS console.

2. In the left-side navigation pane, choose Security Center > Global Security Management.

3. On the Global Security Management page, click the SSL Certificate tab.

   Note

   • SSL Enabled Instances: The number of instances with the feature enabled (including fully and partially enabled) / The total number of connected instances.

   • In the main table, click an Instance ID to go to the Basic Information page of the instance console. Click Details to go to the SSL Management page of the instance console, where you can perform SSL-related changes.

   Main table
   SSL Certificate Status	The overall SSL status of the instance. Options are Enabled, Partially Enabled, and Not Enabled. Note Only endpoints that support the SSL feature are counted. RDS MySQL instances do not support enabling SSL per endpoint and do not distinguish between specific endpoints. The SSL information in the sub-table is the same as the SSL information for the instance. As a result, RDS MySQL instances can only have a status of Enabled or Not Enabled. For PolarDB for MySQL instances, SSL is supported for three endpoint types: primary, cluster, and custom.
   SSL Certificate Expiration Time	The earliest SSL certificate expiration date among all endpoints of the instance.

4. Click the arrow to the left of a target instance to view its detailed SSL information.

   Sub-table
   Endpoint ID	This field is empty for RDS MySQL. For PolarDB for MySQL, it corresponds to the EndpointId field on the Basic Information page in the instance console.
   Endpoint Type	This field is empty for RDS MySQL. For PolarDB for MySQL, the options are Primary, Cluster, and Custom.
   SSL-protected Endpoint	The SSL-encrypted connection string for the instance endpoint.
   SSL Certificate Status	The SSL status of the instance endpoint. Options are Enabled and Not Enabled. Note When the certificate status is Not Enabled, the SSL-protected Endpoint, SSL Certificate Type, and SSL Certificate Expiration Time fields are empty.
   SSL Certificate Type	The SSL certificate type for the instance endpoint. Options are Cloud Certificate and Custom Certificate, which correspond to Use Cloud Certificate and Use Custom Certificate, respectively. Note PolarDB for MySQL instances do not support custom certificates.
   SSL Certificate Expiration Time	The expiration date of the SSL certificate for the instance endpoint. Note The SSL certificate validity period is displayed in your browser's time zone.

Overview

The cross-engine whitelist template feature in DAS lets you centrally manage and apply network access permissions across different database engines. This improves efficiency, reduces configuration errors from repetitive manual tasks, and unifies access control across database engines.

Usage notes

• Supported database engine types:

  ApsaraDB RDS for MySQL, ApsaraDB RDS for PostgreSQL, PolarDB for MySQL, PolarDB for PostgreSQL, and Tair (Redis OSS-compatible).

• Your database instance must be in one of the following regions:

  China (Hangzhou), China (Shanghai), China (Nantong), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Chengdu), China (Hong Kong), Japan (Tokyo), UK (London), US (Virginia), US (Silicon Valley), Singapore, Philippines (Manila), Thailand (Bangkok), Germany (Frankfurt), UAE (Dubai), Malaysia (Kuala Lumpur), Indonesia (Jakarta), and South Korea (Seoul).

• A whitelist template can contain a maximum of 1,000 whitelist rules. A rule can be a specific IP address or an IP address range in CIDR format. Exceeding this limit causes an error when you modify the IP whitelist or associate the template.

• A whitelist template can be associated with a maximum of 500 instances.

• A user can create a maximum of 100 whitelist templates in a single region.

• An instance can only be associated with IP whitelist templates in the same region. A single instance can be associated with multiple IP whitelist templates.

• Operations on a whitelist template take effect immediately. Operations on the IP whitelist groups of associated instances take effect in about one minute.

• If a whitelist template is associated with multiple instances, modifying the template will affect all associated instances. Evaluate the impact before you proceed.

• Deleting a whitelist template disassociates it from all linked instances. We recommend disassociating all instances from a template before deleting it.

• Cross-engine whitelist templates associated in DAS do not appear on the consoles of the corresponding RDS and Tair instances.

Procedure

1. Log on to the DAS console.

2. In the left-side navigation pane, choose Security Center > Global Security Management.

3. On the Global Security Management page, click the Whitelist Template tab.

   • Create a whitelist template: Click Create IP Whitelist Template. In the panel that appears on the right, enter a Whitelist Template Name and the IP Addresses in Whitelist, select a Region, and then click OK.

     Note

     • Setting the whitelist IP range to 0.0.0.0/0 allows access from all IP addresses. Use this setting with caution.

     • If the whitelist contains only 127.0.0.1, all access is blocked. If other IP addresses are present, the 127.0.0.1 entry is ignored.

     • A newly created group whitelist takes effect in about one minute.

   • Modify a whitelist template: In the list, click Modify in the Actions column for the target template. In the panel that appears on the right, modify the whitelist template name and edit the IP addresses or IP address ranges in the template, and then click OK.

     Important

     Modifications to a whitelist template are applied to all instances associated with it.

   • Associate or disassociate instances: In the list, click Associate Instance in the Actions column for the target template. In the panel that appears on the right, perform the following operations, and then click OK.

     1. Select the product type to associate. Available tabs include RDS, PolarDB, Tair, and MongoDB.

     2. After selecting a product, select the engine type to associate. Supported product types include RDS MySQL and RDS PostgreSQL.

     3. In the All instances panel on the left, you can search for instances and associate them in batches. After you select instances, they appear under Change Overview > Instances to Be Associated.

        Note

        To disassociate an instance, clear its checkbox. The instance then appears under Change Overview > Instances to Be Disassociated. On the Change overview page, the Instances to be associated (0) section is collapsed, and the Instances to be disassociated (5) section is expanded, showing five RDS instances that start with RDS: rm-.

   • Delete a whitelist template: In the list, click Delete in the Actions column for the target template. In the dialog box that appears, click OK.

     Important

     • Deleting a whitelist template disassociates it from all linked instances and removes the IP rules in the template from those instances. This action does not affect the default whitelist of an instance or other whitelist templates associated with that instance.

     • If an instance is associated with multiple templates that contain duplicate whitelist entries, deleting one of the templates does not remove the duplicate entries that are also part of other templates.